{ "analysis_id": "720a1250-ec20-4280-911f-2a97345018f1", "session_id": "e81e8f60-468f-4cc1-a8e4-2c0bac2dbd15", "status": "completed", "filename": "2018-08-12-traffic-analysis-exercise.pcap", "source_sha256": "c9e136e6e53daec4deec416e545d56e3c430dbc2d38374cf7a4dc839a0f4a3ff", "source_size_bytes": 30004191, "schema_version": "pcap-analysis-v1", "semantic_sha256": "eff186db84f39bad8d8e2238b877933bb8a81647330004f85a47dde7eb9b8ce5", "analyzer_manifest": { "limits": { "max_flows": 50000, "max_endpoints": 20000, "max_upload_bytes": 536870912, "max_exported_files": 50000, "max_events_per_kind": 50000, "max_exported_objects": 500, "tool_timeout_seconds": 300, "max_object_hash_index": 50000, "max_tool_output_bytes": 268435456, "max_exported_total_bytes": 268435456, "max_exported_object_bytes": 52428800 }, "profile_id": "tshark-evidence-v6", "profile_sha256": "aff64bf3786902d5d7a2c1a9be158a5246cc81aecea6c44eda74701431070465", "schema_version": "pcap-analyzer-manifest-v1", "tshark_version": "TShark (Wireshark) 4.4.18.", "manifest_sha256": "1f3c02483cfea06d85bd326f6e225f3f41a4ab703677d40537577e8bb85c1ce0", "capinfos_version": "Capinfos (Wireshark) 4.4.18.", "rulepack_version": "pcap-rules-v5", "implementation_sha256": "1a7d19199ff58059a12b34656620481b502fadc52d115b5f4b42fc28e5817c3c", "requested_fields_sha256": "e7a6eff11f7ae2101845897ce7e3b0a0e9cea31bdea4a824734869f39f3fb4f3", "supported_profile_fields_sha256": "6d94b9bc3aea93d5f7f4f815bdd025560ceba0d5e27b380ad14da28b44947994" }, "summary": "Decoded 47177 packets across 267 IP endpoints and 1605 transport flows. Observed 737 DNS events, 154 HTTP requests, 1089 TLS ClientHello events, and 110 recovered file/message object(s). Deterministic rules produced 45 finding(s): 1 high, 40 medium, and 4 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.", "report": "# AdversaryGraph Deterministic PCAP Analysis\n\nSource: 2018-08-12-traffic-analysis-exercise.pcap\nCapture SHA-256: `c9e136e6e53daec4deec416e545d56e3c430dbc2d38374cf7a4dc839a0f4a3ff`\nSemantic result SHA-256: `eff186db84f39bad8d8e2238b877933bb8a81647330004f85a47dde7eb9b8ce5`\nAnalyzer manifest SHA-256: `1f3c02483cfea06d85bd326f6e225f3f41a4ab703677d40537577e8bb85c1ce0`\n\n## Executive summary\n\nDecoded 47177 packets across 267 IP endpoints and 1605 transport flows. Observed 737 DNS events, 154 HTTP requests, 1089 TLS ClientHello events, and 110 recovered file/message object(s). Deterministic rules produced 45 finding(s): 1 high, 40 medium, and 4 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.\n\n## Capture facts\n\n- Packets: 47177\n- Duration: 1398.54051 seconds\n- Captured bytes: 29249335\n- Endpoints: 267\n- Flows: 1605\n\n## Deterministic findings\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 7263 / TCP stream 178, frame 7266 / TCP stream 178.\n\nMetrics: `{\"content_type\":\"application/x-rar-compressed\",\"declared_body_bytes\":154,\"destination\":\"192.168.1.95\",\"response_count\":1,\"source\":\"149.129.222.112\",\"uri\":\"/1.rar\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 7277 / TCP stream 179, frame 7279 / TCP stream 179.\n\nMetrics: `{\"content_type\":\"application/zip\",\"declared_body_bytes\":299,\"destination\":\"192.168.1.95\",\"response_count\":1,\"source\":\"149.129.222.112\",\"uri\":\"/1.zip\"}`\n\n### HIGH — Periodic HTTP callback pattern\n\nRepeated requests have a stable cadence consistent with automated callback or beacon behavior.\n\nRule: `periodic-http-callbacks@pcap-rules-v5`; confidence: 0.88; evidence: frame 39557 / TCP stream 1036, frame 39676 / TCP stream 1046, frame 39681 / TCP stream 1046, frame 39699 / TCP stream 1047, frame 39712 / TCP stream 1048.\n\nMetrics: `{\"destination\":\"185.68.93.18\",\"host\":\"185.68.93.18\",\"median_absolute_deviation\":0.098,\"median_interval_seconds\":16.172,\"method\":\"POST\",\"port\":80,\"request_count\":33,\"source\":\"192.168.1.95\",\"uri\":\"/dot.php\"}`\n\n### MEDIUM — Repeated outbound HTTP POST activity\n\nThe same endpoint pair and HTTP target produced repeated POST requests suitable for beaconing or data transfer review.\n\nRule: `repeated-http-posts@pcap-rules-v5`; confidence: 0.72; evidence: frame 39557 / TCP stream 1036, frame 39676 / TCP stream 1046, frame 39681 / TCP stream 1046, frame 39699 / TCP stream 1047, frame 39712 / TCP stream 1048.\n\nMetrics: `{\"declared_body_bytes\":2722,\"destination\":\"185.68.93.18\",\"host\":\"185.68.93.18\",\"port\":80,\"request_count\":33,\"source\":\"192.168.1.95\",\"uri\":\"/dot.php\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 40113 / TCP stream 1070, frame 41024 / TCP stream 1070.\n\nMetrics: `{\"content_type\":\"application/javascript\",\"declared_body_bytes\":93636,\"destination\":\"192.168.1.95\",\"response_count\":1,\"source\":\"103.5.149.72\",\"uri\":\"/js/jquery-1.8.3.min.js?v=1533913284\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 40209 / TCP stream 1076, frame 40506 / TCP stream 1076.\n\nMetrics: `{\"content_type\":\"application/x-javascript\",\"declared_body_bytes\":0,\"destination\":\"192.168.1.95\",\"response_count\":1,\"source\":\"87.240.129.133\",\"uri\":\"/js/api/openapi.js?v=1533913284\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 41126 / TCP stream 1071, frame 43633 / TCP stream 1071.\n\nMetrics: `{\"content_type\":\"application/javascript\",\"declared_body_bytes\":88650,\"destination\":\"192.168.1.95\",\"response_count\":1,\"source\":\"103.5.149.72\",\"uri\":\"/js/jquery-ui.min.js?v=1533913284\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 41347 / TCP stream 1073, frame 41786 / TCP stream 1073.\n\nMetrics: `{\"content_type\":\"application/javascript\",\"declared_body_bytes\":572,\"destination\":\"192.168.1.95\",\"response_count\":1,\"source\":\"103.5.149.72\",\"uri\":\"/js/common/infinite-scroll.js?v=1533913284\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 41353 / TCP stream 1072, frame 42689 / TCP stream 1072.\n\nMetrics: `{\"content_type\":\"application/javascript\",\"declared_body_bytes\":21191,\"destination\":\"192.168.1.95\",\"response_count\":1,\"source\":\"103.5.149.72\",\"uri\":\"/js/common/angular-touch.js?v=1533913284\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 41365 / TCP stream 1070, frame 41848 / TCP stream 1070.\n\nMetrics: `{\"content_type\":\"application/javascript\",\"declared_body_bytes\":31135,\"destination\":\"192.168.1.95\",\"response_count\":1,\"source\":\"103.5.149.72\",\"uri\":\"/js/zoom/angular.rangeSlider.js?v=1533913284\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 41391 / TCP stream 1074, frame 42201 / TCP stream 1074.\n\nMetrics: `{\"content_type\":\"application/javascript\",\"declared_body_bytes\":5404,\"destination\":\"192.168.1.95\",\"response_count\":1,\"source\":\"103.5.149.72\",\"uri\":\"/js/zoom/ng-pinch-zoom.js?v=1533913284\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 41437 / TCP stream 1075, frame 41872 / TCP stream 1075.\n\nMetrics: `{\"content_type\":\"application/javascript\",\"declared_body_bytes\":6084,\"destination\":\"192.168.1.95\",\"response_count\":1,\"source\":\"103.5.149.72\",\"uri\":\"/js/common/tass.js?v=1533913284\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 41781 / TCP stream 1132, frame 42224 / TCP stream 1132.\n\nMetrics: `{\"content_type\":\"application/javascript\",\"declared_body_bytes\":4247,\"destination\":\"192.168.1.95\",\"response_count\":1,\"source\":\"103.5.149.72\",\"uri\":\"/js/common/angular-sanitize.min.js?v=1533913284\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 41784 / TCP stream 1133, frame 43154 / TCP stream 1133.\n\nMetrics: `{\"content_type\":\"application/javascript\",\"declared_body_bytes\":99790,\"destination\":\"192.168.1.95\",\"response_count\":1,\"source\":\"103.5.149.72\",\"uri\":\"/js/angular-1.2.4.min.js?v=1533913284\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 41791 / TCP stream 1073, frame 42246 / TCP stream 1073.\n\nMetrics: `{\"content_type\":\"application/javascript\",\"declared_body_bytes\":1519,\"destination\":\"192.168.1.95\",\"response_count\":1,\"source\":\"103.5.149.72\",\"uri\":\"/js/common/photoModeController.js?v=1533913284\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 41850 / TCP stream 1070, frame 42263 / TCP stream 1070.\n\nMetrics: `{\"content_type\":\"application/javascript\",\"declared_body_bytes\":15430,\"destination\":\"192.168.1.95\",\"response_count\":1,\"source\":\"103.5.149.72\",\"uri\":\"/js/common/mainTopSlider.js?v=1533913284\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 41876 / TCP stream 1075, frame 42283 / TCP stream 1075.\n\nMetrics: `{\"content_type\":\"application/javascript\",\"declared_body_bytes\":9636,\"destination\":\"192.168.1.95\",\"response_count\":1,\"source\":\"103.5.149.72\",\"uri\":\"/js/common/pressCenterCalendar.js?v=1533913284\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 42021 / TCP stream 1134, frame 42702 / TCP stream 1134.\n\nMetrics: `{\"content_type\":\"application/javascript\",\"declared_body_bytes\":19588,\"destination\":\"192.168.1.95\",\"response_count\":1,\"source\":\"103.5.149.72\",\"uri\":\"/js/common/mainDirect.js?v=1533913284\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 42022 / TCP stream 1135, frame 42485 / TCP stream 1135.\n\nMetrics: `{\"content_type\":\"application/javascript\",\"declared_body_bytes\":3543,\"destination\":\"192.168.1.95\",\"response_count\":1,\"source\":\"103.5.149.72\",\"uri\":\"/js/activeViewService.js?v=1533913284\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 42049 / TCP stream 1130, frame 42522 / TCP stream 1130.\n\nMetrics: `{\"content_type\":\"application/javascript\",\"declared_body_bytes\":3448,\"destination\":\"192.168.1.95\",\"response_count\":1,\"source\":\"103.5.149.72\",\"uri\":\"/js/doublephoto/doublephoto.js?v=1533913284\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 42057 / TCP stream 1131, frame 42755 / TCP stream 1131.\n\nMetrics: `{\"content_type\":\"application/javascript\",\"declared_body_bytes\":18358,\"destination\":\"192.168.1.95\",\"response_count\":1,\"source\":\"103.5.149.72\",\"uri\":\"/js/hammer.min.js?v=1533913284\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 42204 / TCP stream 1074, frame 42975 / TCP stream 1074.\n\nMetrics: `{\"content_type\":\"application/javascript\",\"declared_body_bytes\":14904,\"destination\":\"192.168.1.95\",\"response_count\":1,\"source\":\"103.5.149.72\",\"uri\":\"/js/zoom/zoomController.js?v=1533913284\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 42230 / TCP stream 1132, frame 42749 / TCP stream 1132.\n\nMetrics: `{\"content_type\":\"application/javascript\",\"declared_body_bytes\":9712,\"destination\":\"192.168.1.95\",\"response_count\":1,\"source\":\"103.5.149.72\",\"uri\":\"/js/common/mediaBlocksController.js?v=1533913284\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 42248 / TCP stream 1073, frame 42762 / TCP stream 1073.\n\nMetrics: `{\"content_type\":\"application/javascript\",\"declared_body_bytes\":3121,\"destination\":\"192.168.1.95\",\"response_count\":1,\"source\":\"103.5.149.72\",\"uri\":\"/js/jquery.cookie.js?v=1533913284\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 42266 / TCP stream 1070, frame 43271 / TCP stream 1070.\n\nMetrics: `{\"content_type\":\"application/javascript\",\"declared_body_bytes\":153909,\"destination\":\"192.168.1.95\",\"response_count\":1,\"source\":\"103.5.149.72\",\"uri\":\"/js/highcharts/highcharts.js?v=1533913284\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 42289 / TCP stream 1075, frame 42849 / TCP stream 1075.\n\nMetrics: `{\"content_type\":\"application/javascript\",\"declared_body_bytes\":2985,\"destination\":\"192.168.1.95\",\"response_count\":1,\"source\":\"103.5.149.72\",\"uri\":\"/js/adfox.asyn.code.scroll.js\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 42488 / TCP stream 1135, frame 42903 / TCP stream 1135.\n\nMetrics: `{\"content_type\":\"application/javascript\",\"declared_body_bytes\":350,\"destination\":\"192.168.1.95\",\"response_count\":1,\"source\":\"103.5.149.72\",\"uri\":\"/js/mainSliderWidget.js\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 42524 / TCP stream 1130, frame 43539 / TCP stream 1130.\n\nMetrics: `{\"content_type\":\"application/javascript\",\"declared_body_bytes\":192101,\"destination\":\"192.168.1.95\",\"response_count\":1,\"source\":\"103.5.149.72\",\"uri\":\"/assets/bfcd510f/libs.min.js?v=1533913284\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 42696 / TCP stream 1072, frame 43580 / TCP stream 1072.\n\nMetrics: `{\"content_type\":\"application/javascript\",\"declared_body_bytes\":69253,\"destination\":\"192.168.1.95\",\"response_count\":1,\"source\":\"103.5.149.72\",\"uri\":\"/assets/287c4a4b/itar.min.js?v=1533913284\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 43669 / TCP stream 1139, frame 43720 / TCP stream 1139.\n\nMetrics: `{\"content_type\":\"text/javascript\",\"declared_body_bytes\":7819,\"destination\":\"192.168.1.95\",\"response_count\":1,\"source\":\"216.58.194.162\",\"uri\":\"/tag/js/gpt.js\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 43682 / TCP stream 1146, frame 43740 / TCP stream 1146.\n\nMetrics: `{\"content_type\":\"text/html\",\"declared_body_bytes\":144,\"destination\":\"192.168.1.95\",\"response_count\":1,\"source\":\"74.119.117.100\",\"uri\":\"/delivery/rta/rta.js?netId=5895&cookieName=crtg_rta&rnd=74932308510&varName=crtg_content\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 43686 / TCP stream 1147, frame 44010 / TCP stream 1147.\n\nMetrics: `{\"content_type\":\"application/javascript; charset=utf-8\",\"declared_body_bytes\":51691,\"destination\":\"192.168.1.95\",\"response_count\":1,\"source\":\"216.58.192.8\",\"uri\":\"/gtm.js?id=GTM-KX9ZXT\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 43690 / TCP stream 1151, frame 43966 / TCP stream 1151.\n\nMetrics: `{\"content_type\":\"application/x-javascript; charset=utf-8\",\"declared_body_bytes\":67344,\"destination\":\"192.168.1.95\",\"response_count\":1,\"source\":\"157.240.11.22\",\"uri\":\"/en_US/sdk.js\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 43698 / TCP stream 1150, frame 43810 / TCP stream 1150.\n\nMetrics: `{\"content_type\":\"application/javascript; charset=utf-8\",\"declared_body_bytes\":35362,\"destination\":\"192.168.1.95\",\"response_count\":1,\"source\":\"192.229.163.25\",\"uri\":\"/widgets.js\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 44800 / TCP stream 1187, frame 45009 / TCP stream 1187.\n\nMetrics: `{\"content_type\":\"text/javascript; charset=utf-8\",\"declared_body_bytes\":26268,\"destination\":\"192.168.1.95\",\"response_count\":1,\"source\":\"216.58.194.162\",\"uri\":\"/pagead/osd.js\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 46427 / TCP stream 1130, frame 46593 / TCP stream 1130.\n\nMetrics: `{\"content_type\":\"application/javascript\",\"declared_body_bytes\":10013,\"destination\":\"192.168.1.95\",\"response_count\":1,\"source\":\"103.5.149.72\",\"uri\":\"/js/common/textBroadcastController.js?v=1533913284\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 46441 / TCP stream 1071, frame 46630 / TCP stream 1071.\n\nMetrics: `{\"content_type\":\"application/javascript\",\"declared_body_bytes\":3364,\"destination\":\"192.168.1.95\",\"response_count\":1,\"source\":\"103.5.149.72\",\"uri\":\"/js/audioWidget.js\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 46465 / TCP stream 1133, frame 46683 / TCP stream 1133.\n\nMetrics: `{\"content_type\":\"application/javascript\",\"declared_body_bytes\":11271,\"destination\":\"192.168.1.95\",\"response_count\":1,\"source\":\"103.5.149.72\",\"uri\":\"/js/videoWidget.js\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 46484 / TCP stream 1070, frame 46735 / TCP stream 1070.\n\nMetrics: `{\"content_type\":\"application/javascript\",\"declared_body_bytes\":12028,\"destination\":\"192.168.1.95\",\"response_count\":1,\"source\":\"103.5.149.72\",\"uri\":\"/js/social/socialDirective.js\"}`\n\n### MEDIUM — Repeated TLS cadence across multiple names\n\nA client fingerprint repeats connections across several names at regular per-name intervals. Telemetry and legitimate agents can do this; TLS payload content and attribution remain unknown.\n\nRule: `multi-host-tls-cadence@pcap-rules-v5`; confidence: 0.6; evidence: frame 550 / TCP stream 37, frame 552 / TCP stream 38, frame 624 / TCP stream 48, frame 626 / TCP stream 47, frame 636 / TCP stream 42.\n\nMetrics: `{\"client_hello_count\":1084,\"hosts\":[\"a1.adform.net\",\"c1.adform.net\",\"da4pli3l5vc0d.cloudfront.net\",\"ib.adnxs.com\",\"magnetic.t.domdex.com\",\"pixel.rubiconproject.com\",\"secure.adnxs.com\",\"small-video.edgecast.syn-cdn.com\",\"vid-io.springserve.net\"],\"ja3\":\"4d7a28d6f2263ed61de88ca66eb011e3\",\"other_names_sharing_fingerprint\":[\"2886.tm.zedo.com\",\"a.company-target.com\",\"a.tribalfusion.com\",\"a1.seadform.net\",\"aa.agkn.com\",\"acdn.adnxs.com\",\"ad.360yield.com\",\"ad.lkqd.net\",\"ad.sxp.smartclip.net\",\"ad.turn.com\",\"ade.googlesyndication.com\",\"ads.adaptv.advertising.com\",\"ads.creative-serving.com\",\"ads.deliverimp.com\",\"ads.lfstmedia.com\",\"ads.pubmatic.com\",\"ads.rubiconproject.com\",\"ads.scorecardresearch.com\",\"ads.stickyadstv.com\",\"ads.yahoo.com\",\"adserver.adtech.advertising.com\",\"adservice.google.com\",\"adventori.com\",\"ag.innovid.com\",\"ajax.googleapis.com\",\"an.yandex.ru\",\"apnx-match.dotomi.com\",\"appnexus-partners.tremorhub.com\",\"b1sync.zemanta.com\",\"bcp.crwdcntrl.net\",\"beacon.tru.am\",\"beacon.walmart.com\",\"bh.contextweb.com\",\"bid.contextweb.com\",\"bid.g.doubleclick.net\",\"bidder.criteo.com\",\"bttrack.com\",\"c.bing.com\",\"cdn-ssl.vidible.tv\",\"cdn.adnxs.com\",\"cdn.doubleverify.com\",\"cdn.jsdelivr.net\",\"cdn.marphezis.com\",\"cdn.onthe.io\",\"cdn1.tass.ru\",\"cdn2.tass.ru\",\"cdn3.doubleverify.com\",\"cdni.rt.com\",\"ce.lijit.com\",\"cm.adform.net\",\"cm.adgrx.com\",\"cm.eyereturn.com\",\"cm.g.doubleclick.net\",\"cms.quantserve.com\",\"code.createjs.com\",\"contextual.media.net\",\"cookie.brealtime.com\",\"cookiex.ngd.yahoo.com\",\"counter.yadro.ru\",\"cs.adingo.jp\",\"csi.gstatic.com\",\"d5p.de17a.com\",\"delivery-us-west-1.openx.net\",\"delivery.h.switchadhub.com\",\"dh.serving-sys.com\",\"dis.criteo.com\",\"dmp.brand-display.com\",\"dpm.demdex.net\",\"dsp.adfarm1.adition.com\",\"dsp.adkernel.com\",\"dsum-sec.casalemedia.com\",\"e.nexac.com\",\"e1.emxdgt.com\",\"eb2.3lift.com\",\"ebdr3.com\",\"eus.rubiconproject.com\",\"fastlane-adv.rubiconproject.com\",\"fonts.googleapis.com\",\"fonts.gstatic.com\",\"g2.gumgum.com\",\"googleads.g.doubleclick.net\",\"googleads4.g.doubleclick.net\",\"hb-api.omnitagjs.com\",\"hbevents.1rx.io\",\"i.w55c.net\",\"i.ytimg.com\",\"id.rlcdn.com\",\"idpix.media6degrees.com\",\"idsync.rlcdn.com\",\"iecvlist.microsoft.com\",\"image2.pubmatic.com\",\"image4.pubmatic.com\",\"image6.pubmatic.com\",\"images.outbrainimg.com\",\"images9.engageya.com\",\"imasdk.googleapis.com\",\"jadserve.postrelease.com\",\"launcher.spot.im\",\"lax1-ib.adnxs.com\",\"load77.exelator.com\",\"loadm.exelator.com\",\"m.adnxs.com\",\"match.adsrvr.org\",\"match.basebanner.com\",\"match.bnmla.com\",\"match.prod.bidr.io\",\"match.rundsp.com\",\"match.sharethrough.com\",\"match.taboola.com\",\"mc.yandex.ru\",\"melia.sp1.convertro.com\",\"mixi.media\",\"ml314.com\",\"mm.melia.com\",\"net.finam.ru\",\"odb.outbrain.com\",\"odr.mookie1.com\",\"optimized-by.rubiconproject.com\",\"ox.pxl.ace.advertising.com\",\"oxp.mxptint.net\",\"p.adsymptotic.com\",\"p.rfihub.com\",\"p.skimresources.com\",\"pagead2.googlesyndication.com\",\"phototass1.cdnvideo.ru\",\"phototass2.cdnvideo.ru\",\"phototass3.cdnvideo.ru\",\"phototass4.cdnvideo.ru\",\"ping.chartbeat.net\",\"pippio.com\",\"pix.impdesk.com\",\"pix.spot.im\",\"pixel-a.sitescout.com\",\"pixel-sc2.adsymptotic.com\",\"pixel-sync.sitescout.com\",\"pixel-us-east.rubiconproject.com\",\"pixel.advertising.com\",\"pixel.quantserve.com\",\"pixel.sitescout.com\",\"pixel.tapad.com\",\"pixeltrack.eyeviewads.com\",\"platform.twitter.com\",\"pm.w55c.net\",\"pmp.mxptint.net\",\"pp.lp4.io\",\"pr-bh.ybp.yahoo.com\",\"pre-usermatch.targeting.unrulymedia.com\",\"prod.y-medialink.com\",\"pubads.g.doubleclick.net\",\"pubmatic-match.dotomi.com\",\"pubmatic2waycm-atl.netmng.com\",\"px.adhigh.net\",\"px.moatads.com\",\"px.owneriq.net\",\"px.powerlinks.com\",\"pxl.connexity.net\",\"qcx.quantserve.com\",\"r.nexac.com\",\"rbp.mxptint.net\",\"recs.engageya.com\",\"relap.io\",\"rp.gwallet.com\",\"rtb-csync.smartadserver.com\",\"rtb.adentifi.com\",\"rtb.gumgum.com\",\"rtb.openx.net\",\"rtb0.doubleverify.com\",\"rtr.innovid.com\",\"rub.pxl.ace.advertising.com\",\"rubicon-match.dotomi.com\",\"rum-collector-2.pingdom.net\",\"rum-collector.pingdom.net\",\"rum-static.pingdom.net\",\"ruptly-d.openx.net\",\"s-static.innovid.com\",\"s.amazon-adsystem.com\",\"s.innovid.com\",\"s.thebrighttag.com\",\"s.ytimg.com\",\"s0.2mdn.net\",\"s2.adform.net\",\"saxp.zedo.com\",\"sb.scorecardresearch.com\",\"secure-assets.rubiconproject.com\",\"securepubads.g.doubleclick.net\",\"simage2.pubmatic.com\",\"simage4.pubmatic.com\",\"smi2.net\",\"smi2.ru\",\"ss3.zedo.com\",\"stags.bluekai.com\",\"stat.media\",\"static.chartbeat.com\",\"static.criteo.net\",\"static.doubleclick.net\",\"static.mixi.media\",\"static2.mixi.media\",\"static4.mixi.media\",\"static5.mixi.media\",\"staticxx.facebook.com\",\"stats.g.doubleclick.net\",\"su.addthis.com\",\"synacor.autoplay-plugins.static-origin.syn-cdn.com\",\"sync-tm.everesttech.net\",\"sync.1rx.io\",\"sync.adotmob.com\",\"sync.aralego.com\",\"sync.crwdcntrl.net\",\"sync.extend.tv\",\"sync.ipredictive.com\",\"sync.ligadx.com\",\"sync.mathtag.com\",\"sync.search.spotxchange.com\",\"sync.springserve.com\",\"sync.teads.tv\",\"sync.tidaltv.com\",\"synchroscript.deliveryengine.adswizz.com\",\"syndication.twitter.com\",\"t.cwkuki.com\",\"t.lkqd.net\",\"t.mookie1.com\",\"t.wayfair.com\",\"tag.1rx.io\",\"tags.bluekai.com\",\"tags.crwdcntrl.net\",\"target.mixi.media\",\"teutorigos-cat.com\",\"thrtle.com\",\"token.rubiconproject.com\",\"tpc.googlesyndication.com\",\"tps.doubleverify.com\",\"tps700.doubleverify.com\",\"tps702.doubleverify.com\",\"track.eyeviewads.com\",\"trc.taboola.com\",\"tru.am\",\"tt.onthe.io\",\"tt1.zedo.com\",\"tt3.zedo.com\",\"uat-net.technoratimedia.com\",\"uat-secure.technoratimedia.com\",\"ucs02.engageya.com\",\"um.simpli.fi\",\"us-u.openx.net\",\"v.lkqd.net\",\"vcdn.adnxs.com\",\"vid-io.springserve.com\",\"vid.springserve.com\",\"vk.com\",\"vpaid.springserve.net\",\"widget.engageya.com\",\"widgets.outbrain.com\",\"www.google-analytics.com\",\"www.google.com\",\"www.googletagservices.com\",\"www.rt.com\",\"www.tns-counter.ru\",\"www.youtube.com\",\"x.bidswitch.net\",\"x.dlx.addthis.com\",\"x.skimresources.com\",\"yastatic.net\",\"z.moatads.com\",\"zedo-d.openx.net\"],\"per_host_median_intervals\":[68.327,37.964,62.88,20.119,102.577,87.449,48.725,65.904,20.343],\"regular_hosts\":9,\"source\":\"192.168.1.95\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 166 / TCP stream 9, frame 168 / TCP stream 9, frame 170 / TCP stream 9, frame 172 / TCP stream 9, frame 445 / TCP stream 9.\n\nMetrics: `{\"destination\":\"192.168.1.95\",\"event_count\":8,\"operation_numbers\":[\"0\",\"1\",\"12\"],\"protocol\":\"drsuapi\",\"source\":\"192.168.1.6\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 84 / TCP stream 5, frame 98 / TCP stream 5, frame 187 / TCP stream 13, frame 191 / TCP stream 13, frame 203 / TCP stream 13.\n\nMetrics: `{\"destination\":\"192.168.1.95\",\"event_count\":33,\"operation_numbers\":[\"\",\"1\",\"4,19,19,19,5\",\"4,5\",\"5\"],\"protocol\":\"ldap\",\"source\":\"192.168.1.6\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 165 / TCP stream 9, frame 167 / TCP stream 9, frame 169 / TCP stream 9, frame 171 / TCP stream 9, frame 444 / TCP stream 9.\n\nMetrics: `{\"destination\":\"192.168.1.6\",\"event_count\":8,\"operation_numbers\":[\"0\",\"1\",\"12\"],\"protocol\":\"drsuapi\",\"source\":\"192.168.1.95\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 83 / TCP stream 5, frame 96 / TCP stream 5, frame 99 / TCP stream 5, frame 186 / TCP stream 13, frame 189 / TCP stream 13.\n\nMetrics: `{\"destination\":\"192.168.1.6\",\"event_count\":41,\"operation_numbers\":[\"\",\"0\",\"2\",\"3\"],\"protocol\":\"ldap\",\"source\":\"192.168.1.95\"}`\n\n### MEDIUM — Sustained external TCP conversation outside decoded application coverage\n\nThe flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.\n\nRule: `unclassified-external-tcp@pcap-rules-v5`; confidence: 0.7; evidence: frame 32315 / TCP stream 882.\n\nMetrics: `{\"destination\":\"207.244.102.143\",\"destination_port\":443,\"duration_seconds\":49.953,\"packets\":22,\"source\":\"192.168.1.95\",\"wire_bytes\":7427}`\n\n## ATT&CK candidates\n\n- T1071.001 Application Layer Protocol: Web Protocols (command-and-control), confidence=0.85, status=suggested; basis=versioned-deterministic-rule.\n- T1105 Ingress Tool Transfer (command-and-control), confidence=0.8, status=suggested; basis=versioned-deterministic-rule.\n\n## Identities\n\n- account: `mikhail.petrov`; client IPs: 192.168.1.95; frames: 403, 411, 412, 422, 434\n- account: `petrov2018-pc$`; client IPs: 192.168.1.95; frames: 38, 46, 47, 57, 67\n- hostname: `Petrov2018-PC`; client IPs: 192.168.1.95; frames: 1, 288, 6562, 7257, 39646\n- netbios-group: `SPUTNIKHOUSE`; client IPs: unbound subject; frames: 9, 177, 283, 300, 304\n\n## Observed network and file inventory — not an IOC verdict\n\n- domain: `1605158521.rsc.cdn77.org`; roles: dns-cname\n- domain: `2886.tm.zedo.com`; roles: dns-query, tls-sni\n- domain: `506163eff52ac0e798da9465b8af1d86.lswcdn.net`; roles: dns-cname\n- domain: `a.company-target.com`; roles: dns-query, tls-sni\n- domain: `a.tribalfusion.com`; roles: dns-query, tls-sni\n- domain: `a1.adform.net`; roles: dns-query, tls-sni\n- domain: `a1.seadform.net`; roles: dns-query, tls-sni\n- domain: `aa.agkn.com`; roles: dns-query, tls-sni\n- domain: `acdn.adnxs.com`; roles: dns-query, tls-sni\n- domain: `ad.360yield.com`; roles: dns-query, tls-sni\n- domain: `ad.lkqd.net`; roles: dns-query, tls-sni\n- domain: `ad.sxp.smartclip.net`; roles: dns-query, tls-sni\n- domain: `ad.turn.com`; roles: dns-query, tls-sni\n- domain: `ad.turn.com.akadns.net`; roles: dns-cname\n- domain: `ade.googlesyndication.com`; roles: dns-query, tls-sni\n- domain: `ads-bid.l.doubleclick.net`; roles: dns-cname\n- domain: `ads-east1-132899269.us-east-1.elb.amazonaws.com`; roles: dns-cname\n- domain: `ads-sc2-lb9.adsymptotic.com`; roles: dns-cname\n- domain: `ads.adaptv.advertising.com`; roles: dns-query, tls-sni\n- domain: `ads.creative-serving.com`; roles: dns-query, tls-sni\n- domain: `ads.deliverimp.com`; roles: dns-query, tls-sni\n- domain: `ads.lfstmedia.com`; roles: dns-query, tls-sni\n- domain: `ads.pubmatic.com`; roles: dns-query, tls-sni\n- domain: `ads.rubiconproject.com`; roles: dns-query, tls-sni\n- domain: `ads.scorecardresearch.com`; roles: dns-query, tls-sni\n- domain: `ads.stickyadstv.com`; roles: dns-query, tls-sni\n- domain: `ads.yahoo.com`; roles: dns-query, tls-sni\n- domain: `adserver.adtech.advertising.com`; roles: dns-query, tls-sni\n- domain: `adservice.google.com`; roles: dns-query, tls-sni\n- domain: `adventori.com`; roles: dns-query, tls-sni\n- domain: `ag.innovid.com`; roles: dns-query, tls-sni\n- domain: `ajax.googleapis.com`; roles: dns-query, tls-sni\n- domain: `alb-vpc-pixel-tracker-front-prod-1906776940.us-east-1.elb.amazonaws.com`; roles: dns-cname\n- domain: `an.yandex.ru`; roles: dns-query, tls-sni\n- domain: `api.bing.com`; roles: dns-query\n- domain: `apnx-match.dotomi.com`; roles: dns-query, tls-sni\n- domain: `appnexus-partners.tremorhub.com`; roles: dns-query, tls-sni\n- domain: `apps.digsigtrust.com`; roles: dns-cname\n- domain: `apps.identrust.com`; roles: dns-query, http-host\n- domain: `b1-lsw-use1.zemanta.com`; roles: dns-cname\n- domain: `b1sync.zemanta.com`; roles: dns-query, tls-sni\n- domain: `bcp.crwdcntrl.net`; roles: dns-query, tls-sni\n- domain: `beacon-cdn.walmart.com.akadns.net`; roles: dns-cname\n- domain: `beacon.tru.am`; roles: dns-query, tls-sni\n- domain: `beacon.walmart.com`; roles: dns-query, tls-sni\n- domain: `bh.contextweb.com`; roles: dns-query, tls-sni\n- domain: `bid.contextweb.com`; roles: dns-query, tls-sni\n- domain: `bid.g.doubleclick.net`; roles: dns-query, tls-sni\n- domain: `bidder.criteo.com`; roles: dns-query, tls-sni\n- domain: `bttrack.com`; roles: dns-query, tls-sni\n- domain: `c.bing.com`; roles: dns-query, tls-sni\n- domain: `c1.adform.net`; roles: dns-query, tls-sni\n- domain: `cacerts.digicert.com`; roles: dns-query, http-host\n- domain: `cdn-na.onthe.io`; roles: dns-cname\n- domain: `cdn-ssl.vidible.tv`; roles: dns-query, tls-sni\n- domain: `cdn.adnxs.com`; roles: dns-query, tls-sni\n- domain: `cdn.digicertcdn.com`; roles: dns-cname\n- domain: `cdn.doubleverify.com`; roles: dns-query, tls-sni\n- domain: `cdn.jsdelivr.net`; roles: dns-query, tls-sni\n- domain: `cdn.marphezis.com`; roles: dns-query, tls-sni\n- domain: `cdn.onthe.io`; roles: dns-query, tls-sni\n- domain: `cdn1.tass.ru`; roles: dns-query, tls-sni\n- domain: `cdn2.tass.ru`; roles: dns-query, tls-sni\n- domain: `cdn3.doubleverify.com`; roles: dns-query, tls-sni\n- domain: `cdni.rt.com`; roles: dns-query, tls-sni\n- domain: `cds.n3g2w2j5.hwcdn.net`; roles: dns-cname\n- domain: `cds.p5q6b2e4.hwcdn.net`; roles: dns-cname\n- domain: `ce.lijit.com`; roles: dns-query, tls-sni\n- domain: `cm.adform.net`; roles: dns-query, tls-sni\n- domain: `cm.adgrx.com`; roles: dns-query, tls-sni\n- domain: `cm.eyereturn.com`; roles: dns-query, tls-sni\n- domain: `cm.g.doubleclick.net`; roles: dns-query, tls-sni\n- domain: `cms.quantserve.com`; roles: dns-query, tls-sni\n- domain: `code.createjs.com`; roles: dns-query, tls-sni\n- domain: `comet.tass.ru`; roles: dns-query, http-host\n- domain: `connect.facebook.net`; roles: dns-query, http-host\n- domain: `contextual.media.net`; roles: dns-query, tls-sni\n- domain: `cookie.brealtime.com`; roles: dns-query, tls-sni\n- domain: `cookie.brealtime.com.cdn.cloudflare.net`; roles: dns-cname\n- domain: `cookiesyncing-1395500543.us-east-1.elb.amazonaws.com`; roles: dns-cname\n- domain: `cookiex.ngd.yahoo.com`; roles: dns-query, tls-sni\n- domain: `counter.yadro.ru`; roles: dns-query, http-host, tls-sni\n- domain: `crt.comodoca.com`; roles: dns-query, http-host\n- domain: `crt.comodoca.com.cdn.cloudflare.net`; roles: dns-cname\n- domain: `cs.adingo.jp`; roles: dns-query, tls-sni\n- domain: `cs574.wpc.edgecastcdn.net`; roles: dns-cname\n- domain: `cs84.wac.edgecastcdn.net`; roles: dns-cname\n- domain: `csi.gstatic.com`; roles: dns-query, tls-sni\n- domain: `d3f7zc5bbfci5.cloudfront.net`; roles: dns-cname\n- domain: `d5p.de17a.com`; roles: dns-query, tls-sni\n- domain: `da4pli3l5vc0d.cloudfront.net`; roles: dns-query, tls-sni\n- domain: `delivery-us-west-1.openx.net`; roles: dns-query, tls-sni\n- domain: `delivery.h.switchadhub.com`; roles: dns-query, tls-sni\n- domain: `dh.serving-sys.com`; roles: dns-query, tls-sni\n- domain: `dis.criteo.com`; roles: dns-query, tls-sni\n- domain: `dmp-pixel.aolp-prd.public.aol.com`; roles: dns-cname\n- domain: `dmp.brand-display.com`; roles: dns-query, tls-sni\n- domain: `dpm.demdex.net`; roles: dns-query, tls-sni\n- domain: `dsp.adfarm1.adition.com`; roles: dns-query, tls-sni\n- domain: `dsp.adkernel.com`; roles: dns-query, tls-sni\n- domain: `dsum-sec.casalemedia.com`; roles: dns-query, tls-sni\n- domain: `dxedge-prod-lb-1585771072.us-west-2.elb.amazonaws.com`; roles: dns-cname\n- domain: `e.nexac.com`; roles: dns-query, tls-sni\n- domain: `e1.emxdgt.com`; roles: dns-query, tls-sni\n- domain: `eb2.3lift.com`; roles: dns-query, tls-sni\n- domain: `ebdr3.com`; roles: dns-query, tls-sni\n- domain: `elb-aws-ca-clickdistrict-2095435364.us-west-1.elb.amazonaws.com`; roles: dns-cname\n- domain: `eus.rubiconproject.com`; roles: dns-query, tls-sni\n- domain: `f2.shared.global.fastly.net`; roles: dns-cname\n- domain: `fastlane-adv.rubiconproject.com`; roles: dns-query, tls-sni\n- domain: `fo-fd-world-new.yax.gysm.yahoodns.net`; roles: dns-cname\n- domain: `fonts.googleapis.com`; roles: dns-query, http-host, tls-sni\n- domain: `fonts.gstatic.com`; roles: dns-query, http-host, tls-sni\n- domain: `g2.gumgum.com`; roles: dns-query, tls-sni\n- domain: `googleadapis.l.google.com`; roles: dns-cname\n- domain: `googleads.g.doubleclick.net`; roles: dns-query, tls-sni\n- domain: `googleads4.g.doubleclick.net`; roles: dns-query, tls-sni\n- domain: `googleapis.l.google.com`; roles: dns-cname\n- domain: `gstaticadssl.l.google.com`; roles: dns-cname\n- domain: `hb-api-usa02.omnitagjs.com`; roles: dns-cname\n- domain: `hb-api.omnitagjs.com`; roles: dns-query, tls-sni\n- domain: `hbevents.1rx.io`; roles: dns-query, tls-sni\n- domain: `i.w55c.net`; roles: dns-query, tls-sni\n- domain: `i.ytimg.com`; roles: dns-query, tls-sni\n- domain: `ib.adnxs.com`; roles: dns-query, tls-sni\n- domain: `id.rlcdn.com`; roles: dns-query, tls-sni\n- domain: `idpix.media6degrees.com`; roles: dns-query, tls-sni\n- domain: `idsync-ext-weight-2.rlcdn.com`; roles: dns-cname\n- domain: `idsync.rlcdn.com`; roles: dns-query, tls-sni\n- domain: `iecvlist.microsoft.com`; roles: dns-query, tls-sni\n- domain: `image2.pubmatic.com`; roles: dns-query, tls-sni\n- domain: `image4.pubmatic.com`; roles: dns-query, tls-sni\n- domain: `image6.pubmatic.com`; roles: dns-query, tls-sni\n- domain: `images.outbrainimg.com`; roles: dns-query, tls-sni\n- domain: `images9.engageya.com`; roles: dns-query, tls-sni\n- domain: `imasdk.googleapis.com`; roles: dns-query, tls-sni\n- domain: `isatap.localdomain`; roles: dns-query\n- domain: `jadserve.postrelease.com`; roles: dns-query, tls-sni\n- domain: `jadserve.postrelease.com.akadns.net`; roles: dns-cname\n- domain: `launcher.spot.im`; roles: dns-query, tls-sni\n- domain: `lax1-ib.adnxs.com`; roles: dns-query, tls-sni\n- domain: `load77.exelator.com`; roles: dns-query, tls-sni\n- domain: `loadm.exelator.com`; roles: dns-query, tls-sni\n- domain: `m.adnxs.com`; roles: dns-query, tls-sni\n- domain: `magnetic.t.domdex.com`; roles: dns-query, tls-sni\n- domain: `match-243508202.us-west-2.elb.amazonaws.com`; roles: dns-cname\n- domain: `match-us-east-1.sharethrough.com`; roles: dns-cname\n- domain: `match.adsrvr.org`; roles: dns-query, tls-sni\n- domain: `match.basebanner.com`; roles: dns-query, tls-sni\n- domain: `match.bnmla.com`; roles: dns-query, tls-sni\n- domain: `match.prod.bidr.io`; roles: dns-query, tls-sni\n- domain: `match.rundsp.com`; roles: dns-query, tls-sni\n- domain: `match.sharethrough.com`; roles: dns-query, tls-sni\n- domain: `match.taboola.com`; roles: dns-query, tls-sni\n- domain: `matchuswest-922949909.us-west-1.elb.amazonaws.com`; roles: dns-cname\n- domain: `mc.yandex.ru`; roles: dns-query, tls-sni\n- domain: `melia.sp1.convertro.com`; roles: dns-query, tls-sni\n- domain: `mixi.media`; roles: dns-query, tls-sni\n- domain: `mixi1-1.s1.mixi.space`; roles: dns-cname\n- domain: `ml314.com`; roles: dns-query, tls-sni\n- domain: `mm.melia.com`; roles: dns-query, tls-sni\n- domain: `na-eb2.3lift.com`; roles: dns-cname\n- domain: `net.finam.ru`; roles: dns-query, tls-sni\n- domain: `odb.outbrain.com`; roles: dns-query, tls-sni\n- domain: `odr-712357372.us-east-1.elb.amazonaws.com`; roles: dns-cname\n- domain: `odr.mookie1.com`; roles: dns-query, tls-sni\n- domain: `optimized-by.rubiconproject.com`; roles: dns-query, tls-sni\n- domain: `ox.pxl.ace.advertising.com`; roles: dns-query, tls-sni\n- domain: `oxp.mxptint.net`; roles: dns-query, tls-sni\n- domain: `p.adsymptotic.com`; roles: dns-query, tls-sni\n- domain: `p.rfihub.com`; roles: dns-query, tls-sni\n- domain: `p.skimresources.com`; roles: dns-query, tls-sni\n- domain: `pagead-googlehosted.l.google.com`; roles: dns-cname\n- domain: `pagead.l.doubleclick.net`; roles: dns-cname\n- domain: `pagead2.googlesyndication.com`; roles: dns-query, http-host, tls-sni\n- domain: `pagead46.l.doubleclick.net`; roles: dns-cname\n- domain: `partnerad.l.doubleclick.net`; roles: dns-cname\n- domain: `partners-1732315393.us-east-1.elb.amazonaws.com`; roles: dns-cname\n- domain: `perf-token.rubiconproject.net.akadns.net`; roles: dns-cname\n- domain: `petrov2018-pc.sputnikhouse.org`; roles: dns-query\n- domain: `phototass1.cdnvideo.ru`; roles: dns-query, tls-sni\n- domain: `phototass2.cdnvideo.ru`; roles: dns-query, tls-sni\n- domain: `phototass3.cdnvideo.ru`; roles: dns-query, tls-sni\n- domain: `phototass4.cdnvideo.ru`; roles: dns-query, tls-sni\n- domain: `ping.chartbeat.net`; roles: dns-query, tls-sni\n- domain: `pippio.com`; roles: dns-query, tls-sni\n- domain: `pix.impdesk.com`; roles: dns-query, tls-sni\n- domain: `pix.spot.im`; roles: dns-query, tls-sni\n- domain: `pixel-a.sitescout.com`; roles: dns-cname, dns-query, tls-sni\n- domain: `pixel-origin.mathtag.com`; roles: dns-cname\n- domain: `pixel-sc2.adsymptotic.com`; roles: dns-query, tls-sni\n- domain: `pixel-sync.sitescout.com`; roles: dns-query, tls-sni\n- domain: `pixel-us-east.rubiconproject.com`; roles: dns-query, tls-sni\n- domain: `pixel-us-east.rubiconproject.net.akadns.net`; roles: dns-cname\n- domain: `pixel.advertising.com`; roles: dns-query, tls-sni\n- domain: `pixel.quantserve.com`; roles: dns-query, tls-sni\n- domain: `pixel.rubiconproject.com`; roles: dns-query, tls-sni\n- domain: `pixel.rubiconproject.net.akadns.net`; roles: dns-cname\n- domain: `pixel.sitescout.com`; roles: dns-query, tls-sni\n- domain: `pixel.tapad.com`; roles: dns-query, tls-sni\n- domain: `pixeltrack.eyeviewads.com`; roles: dns-query, tls-sni\n- domain: `platform.twitter.com`; roles: dns-query, http-host, tls-sni\n- domain: `pm.w55c.net`; roles: dns-query, tls-sni\n- domain: `pmp.mxptint.net`; roles: dns-query, tls-sni\n- domain: `pool.tokyo.iponweb.net`; roles: dns-cname\n- domain: `pop.yandex.com`; roles: dns-query, tls-sni\n- domain: `pop.yandex.ru`; roles: dns-cname\n- domain: `pp.lp4.io`; roles: dns-query, tls-sni\n- domain: `pr-bh.ybp.gysm.yahoodns.net`; roles: dns-cname\n- domain: `pr-bh.ybp.yahoo.com`; roles: dns-query, tls-sni\n- domain: `pre-usermatch.targeting.unrulymedia.com`; roles: dns-query, tls-sni\n- domain: `prod-dem-collector-elb-611025824.eu-west-1.elb.amazonaws.com`; roles: dns-cname\n- domain: `prod.appnexus.map.fastly.net`; roles: dns-cname\n- domain: `prod.contextweb.map.fastlylb.net`; roles: dns-cname\n- domain: `prod.outbrain.map.fastlylb.net`; roles: dns-cname\n- domain: `prod.y-medialink.com`; roles: dns-query, tls-sni\n- domain: `pubads.g.doubleclick.net`; roles: dns-query, tls-sni\n- domain: `pubmatic-match.dotomi.com`; roles: dns-query, tls-sni\n- domain: `pubmatic2waycm-atl.netmng.com`; roles: dns-query, tls-sni\n- domain: `px-us-ca.adhigh.net`; roles: dns-cname\n- domain: `px.adhigh.net`; roles: dns-query, tls-sni\n- domain: `px.moatads.com`; roles: dns-query, tls-sni\n- domain: `px.owneriq.net`; roles: dns-query, tls-sni\n- domain: `px.powerlinks.com`; roles: dns-query, tls-sni\n- domain: `pxl.connexity.net`; roles: dns-query, tls-sni\n- domain: `qcx.quantserve.com`; roles: dns-query, tls-sni\n- domain: `r.nexac.com`; roles: dns-query, tls-sni\n- domain: `r53x.com`; roles: dns-query, http-host\n- domain: `rbp.mxptint.net`; roles: dns-query, tls-sni\n- domain: `recs.engageya.com`; roles: dns-query, tls-sni\n- domain: `relap.io`; roles: dns-query, tls-sni\n- domain: `rp.gwallet.com`; roles: dns-query, tls-sni\n- domain: `rs-lb-b.lkqd.net`; roles: dns-cname\n- domain: `rtax.criteo.com`; roles: dns-query, http-host\n- domain: `rtb-csync.smartadserver.com`; roles: dns-query, tls-sni\n- domain: `rtb.adentifi.com`; roles: dns-query, tls-sni\n- domain: `rtb.adgrx.com`; roles: dns-cname\n- domain: `rtb.gumgum.com`; roles: dns-query, tls-sni\n- domain: `rtb.openx.net`; roles: dns-query, tls-sni\n- domain: `rtb0.doubleverify.com`; roles: dns-query, tls-sni\n- domain: `rtr.innovid.com`; roles: dns-query, tls-sni\n- domain: `rub.pxl.ace.advertising.com`; roles: dns-query, tls-sni\n- domain: `rubicon-match.dotomi.com`; roles: dns-query, tls-sni\n- domain: `rum-collector-2.pingdom.net`; roles: dns-query, tls-sni\n- domain: `rum-collector.pingdom.net`; roles: dns-query, tls-sni\n- domain: `rum-static.pingdom.net`; roles: dns-query, tls-sni\n- domain: `ruptly-d.openx.net`; roles: dns-query, tls-sni\n- domain: `s-static.innovid.com`; roles: dns-query, tls-sni\n- domain: `s.amazon-adsystem.com`; roles: dns-query, tls-sni\n- domain: `s.gycs.b.yahoodns.net`; roles: dns-cname\n- domain: `s.innovid.com`; roles: dns-query, tls-sni\n- domain: `s.thebrighttag.com`; roles: dns-query, tls-sni\n- domain: `s.ytimg.com`; roles: dns-query, tls-sni\n- domain: `s0-2mdn-net.l.google.com`; roles: dns-cname\n- domain: `s0.2mdn.net`; roles: dns-query, tls-sni\n- domain: `s2.adform.net`; roles: dns-query, tls-sni\n- domain: `saxp.zedo.com`; roles: dns-query, tls-sni\n- domain: `sb.scorecardresearch.com`; roles: dns-query, tls-sni\n- domain: `scontent.xx.fbcdn.net`; roles: dns-cname\n- domain: `secure-assets.rubiconproject.com`; roles: dns-query, tls-sni\n- domain: `secure.adnxs.com`; roles: dns-query, tls-sni\n- domain: `securepubads.g.doubleclick.net`; roles: dns-query, tls-sni\n- domain: `simage2.pubmatic.com`; roles: dns-query, tls-sni\n- domain: `simage4.pubmatic.com`; roles: dns-query, tls-sni\n- domain: `small-video.edgecast.syn-cdn.com`; roles: dns-query, tls-sni\n- domain: `smi2.net`; roles: dns-cname, dns-query, tls-sni\n- domain: `smi2.ru`; roles: dns-query, tls-sni\n- domain: `smtp.yandex.com`; roles: dns-query, tls-sni\n- domain: `smtp.yandex.ru`; roles: dns-cname\n- domain: `sputnikhouse-dc.sputnikhouse.org`; roles: dns-query\n- domain: `sputnikhouse.org`; roles: dns-query\n- domain: `ss3.zedo.com`; roles: dns-query, tls-sni\n- domain: `ssl.cdn.marphezis.com.c.footprint.net`; roles: dns-cname\n- domain: `ssl.trustwave.com`; roles: dns-query, http-host\n- domain: `stags.bluekai.com`; roles: dns-query, tls-sni\n- domain: `stat.media`; roles: dns-query, tls-sni\n- domain: `static-doubleclick-net.l.google.com`; roles: dns-cname\n- domain: `static.chartbeat.com`; roles: dns-query, tls-sni\n- domain: `static.criteo.net`; roles: dns-query, tls-sni\n- domain: `static.doubleclick.net`; roles: dns-query, tls-sni\n- domain: `static.mixi.media`; roles: dns-query, tls-sni\n- domain: `static2.mixi.media`; roles: dns-query, tls-sni\n- domain: `static4.mixi.media`; roles: dns-query, tls-sni\n- domain: `static5.mixi.media`; roles: dns-query, tls-sni\n- domain: `staticxx.facebook.com`; roles: dns-query, tls-sni\n- domain: `stats.g.doubleclick.net`; roles: dns-query, tls-sni\n- domain: `stats.l.doubleclick.net`; roles: dns-cname\n- domain: `su.addthis.com`; roles: dns-query, tls-sni\n- domain: `synacor.autoplay-plugins.static-origin.syn-cdn.com`; roles: dns-query, tls-sni\n- domain: `sync-tm.everesttech.net`; roles: dns-query, tls-sni\n- domain: `sync.1rx.io`; roles: dns-query, tls-sni\n- domain: `sync.adotmob.com`; roles: dns-query, tls-sni\n- domain: `sync.aralego.com`; roles: dns-query, tls-sni\n- domain: `sync.crwdcntrl.net`; roles: dns-query, tls-sni\n- domain: `sync.extend.tv`; roles: dns-query, tls-sni\n- domain: `sync.ipredictive.com`; roles: dns-query, tls-sni\n- domain: `sync.ligadx.com`; roles: dns-query, tls-sni\n- domain: `sync.mathtag.com`; roles: dns-query, tls-sni\n- domain: `sync.search.spotxchange.com`; roles: dns-query, tls-sni\n- domain: `sync.springserve.com`; roles: dns-query, tls-sni\n- domain: `sync.teads.tv`; roles: dns-query, tls-sni\n- domain: `sync.tidaltv.com`; roles: dns-query, tls-sni\n- domain: `synchroscript.deliveryengine.adswizz.com`; roles: dns-query, tls-sni\n- domain: `syndication.twitter.com`; roles: dns-query, tls-sni\n- domain: `t.cwkuki.com`; roles: dns-query, tls-sni\n- domain: `t.lkqd.net`; roles: dns-query, tls-sni\n- domain: `t.mookie1.com`; roles: dns-query, tls-sni\n- domain: `t.wayfair.com`; roles: dns-query, tls-sni\n- domain: `tag.1rx.io`; roles: dns-query, tls-sni\n- domain: `tags.bluekai.com`; roles: dns-query, tls-sni\n- domain: `tags.crwdcntrl.net`; roles: dns-query, tls-sni\n- domain: `target.mixi.media`; roles: dns-query, tls-sni\n- domain: `tass.com`; roles: dns-query, http-host\n- domain: `td.thebrighttag.com`; roles: dns-cname\n- domain: `teutorigos-cat.com`; roles: dns-query, tls-sni\n- domain: `thrtle.com`; roles: dns-query, tls-sni\n- domain: `token.rubiconproject.com`; roles: dns-query, tls-sni\n- domain: `tpc.googlesyndication.com`; roles: dns-query, http-host, tls-sni\n- domain: `tps.doubleverify.com`; roles: dns-query, tls-sni\n- domain: `tps700.doubleverify.com`; roles: dns-query, tls-sni\n- domain: `tps702.doubleverify.com`; roles: dns-query, tls-sni\n- domain: `track-eu.adformnet.akadns.net`; roles: dns-cname\n- domain: `track.eyeviewads.com`; roles: dns-query, tls-sni\n- domain: `tracking-prod-public-741746200.us-west-1.elb.amazonaws.com`; roles: dns-cname\n- domain: `trc.taboola.com`; roles: dns-query, tls-sni\n- domain: `trc.taboola.map.fastly.net`; roles: dns-cname\n- domain: `tru.am`; roles: dns-query, tls-sni\n- domain: `tt.onthe.io`; roles: dns-query, tls-sni\n- domain: `tt1.zedo.com`; roles: dns-query, tls-sni\n- domain: `tt3.zedo.com`; roles: dns-query, tls-sni\n- domain: `uat-net.technoratimedia.com`; roles: dns-query, tls-sni\n- domain: `uat-secure.technoratimedia.com`; roles: dns-query, tls-sni\n- domain: `ucs02.engageya.com`; roles: dns-query, tls-sni\n- domain: `um.simpli.fi`; roles: dns-query, tls-sni\n- domain: `us-u.openx.net`; roles: dns-query, tls-sni\n- domain: `usorlzdiprd-external-190420686.us-west-2.elb.amazonaws.com`; roles: dns-cname\n- domain: `v.lkqd.net`; roles: dns-query, tls-sni\n- domain: `vap.lijit.com`; roles: dns-cname\n- domain: `vcdn.adnxs.com`; roles: dns-query, tls-sni\n- domain: `vid-io.springserve.com`; roles: dns-query, tls-sni\n- domain: `vid-io.springserve.net`; roles: dns-query, tls-sni\n- domain: `vid.springserve.com`; roles: dns-query, tls-sni\n- domain: `vk.com`; roles: dns-query, http-host, tls-sni\n- domain: `vpaid-springserve-net.ssmb.netdna-cdn.com`; roles: dns-cname\n- domain: `vpaid.springserve.net`; roles: dns-query, tls-sni\n- domain: `widget.engageya.com`; roles: dns-query, tls-sni\n- domain: `widgets.outbrain.com`; roles: dns-query, tls-sni\n- domain: `wpad.localdomain`; roles: dns-query\n- domain: `wpad.sputnikhouse.org`; roles: dns-query\n- domain: `wpc.en.rt.com`; roles: dns-cname\n- domain: `www-google-analytics.l.google.com`; roles: dns-cname\n- domain: `www-googletagmanager.l.google.com`; roles: dns-cname\n- domain: `www.bing.com`; roles: dns-query\n- domain: `www.download.windowsupdate.com`; roles: dns-query, http-host\n- domain: `www.google-analytics.com`; roles: dns-query, tls-sni\n- domain: `www.google.com`; roles: dns-query, http-host, tls-sni\n- domain: `www.googletagmanager.com`; roles: dns-query, http-host\n- domain: `www.googletagservices.com`; roles: dns-query, http-host, tls-sni\n- domain: `www.msftncsi.com`; roles: dns-query, http-host\n- domain: `www.rt.com`; roles: dns-query, tls-sni\n- domain: `www.tns-counter.ru`; roles: dns-query, http-host, tls-sni\n- domain: `www.youtube.com`; roles: dns-query, tls-sni\n- domain: `x.bidswitch.net`; roles: dns-query, tls-sni\n- domain: `x.dlx.addthis.com`; roles: dns-query, tls-sni\n- domain: `x.skimresources.com`; roles: dns-query, tls-sni\n- domain: `x.ss2.us`; roles: dns-query, http-host\n- domain: `xs2-1096111735.us-east-1.elb.amazonaws.com`; roles: dns-cname\n- domain: `yastatic.net`; roles: dns-query, tls-sni\n- domain: `youtube-ui.l.google.com`; roles: dns-cname\n- domain: `ytimg-edge-static.l.google.com`; roles: dns-cname\n- domain: `ytstatic.l.google.com`; roles: dns-cname\n- domain: `z.moatads.com`; roles: dns-query, tls-sni\n- domain: `zedo-d.openx.net`; roles: dns-query, tls-sni\n- domain: `ztag-trackedevents-enterprise-1441845540.us-west-2.elb.amazonaws.com`; roles: dns-cname\n- ipv4: `0.0.0.0`; roles: network-endpoint\n- ipv4: `103.5.149.72`; roles: dns-answer, network-endpoint\n- ipv4: `103.5.149.77`; roles: dns-answer, network-endpoint\n- ipv4: `104.110.128.239`; roles: dns-answer, network-endpoint\n- ipv4: `104.16.237.184`; roles: dns-answer\n- ipv4: `104.16.238.184`; roles: dns-answer\n- ipv4: `104.16.239.184`; roles: dns-answer\n- ipv4: `104.16.240.184`; roles: dns-answer, network-endpoint\n- ipv4: `104.16.241.184`; roles: dns-answer\n- ipv4: `104.16.89.188`; roles: dns-answer\n- ipv4: `104.16.90.188`; roles: dns-answer, network-endpoint\n- ipv4: `104.16.91.188`; roles: dns-answer\n- ipv4: `104.16.92.188`; roles: dns-answer\n- ipv4: `104.16.93.188`; roles: dns-answer\n- ipv4: `104.193.83.156`; roles: dns-answer, network-endpoint\n- ipv4: `104.193.83.157`; roles: dns-answer\n- ipv4: `104.198.109.132`; roles: dns-answer\n- ipv4: `104.20.20.239`; roles: dns-answer\n- ipv4: `104.20.21.239`; roles: dns-answer, network-endpoint\n- ipv4: `104.24.246.16`; roles: dns-answer, network-endpoint\n- ipv4: `104.24.247.16`; roles: dns-answer\n- ipv4: `104.25.162.34`; roles: dns-answer\n- ipv4: `104.25.163.34`; roles: dns-answer, network-endpoint\n- ipv4: `104.254.150.108`; roles: dns-answer\n- ipv4: `104.254.150.11`; roles: dns-answer\n- ipv4: `104.254.150.13`; roles: dns-answer\n- ipv4: `104.254.150.179`; roles: dns-answer, network-endpoint\n- ipv4: `104.254.150.37`; roles: dns-answer\n- ipv4: `104.254.150.4`; roles: dns-answer\n- ipv4: `104.254.150.58`; roles: dns-answer\n- ipv4: `104.254.150.59`; roles: dns-answer\n- ipv4: `104.254.150.69`; roles: dns-answer, network-endpoint\n- ipv4: `104.254.150.70`; roles: dns-answer\n- ipv4: `104.254.150.77`; roles: dns-answer, network-endpoint\n- ipv4: `104.254.150.9`; roles: dns-answer\n- ipv4: `104.36.113.17`; roles: dns-answer, network-endpoint\n- ipv4: `104.36.113.23`; roles: dns-answer, network-endpoint\n- ipv4: `104.36.113.24`; roles: dns-answer, network-endpoint\n- ipv4: `107.178.242.85`; roles: dns-answer, network-endpoint\n- ipv4: `107.178.254.65`; roles: dns-answer, network-endpoint\n- ipv4: `107.21.48.136`; roles: dns-answer\n- ipv4: `107.23.160.218`; roles: dns-answer\n- ipv4: `107.23.83.163`; roles: dns-answer\n- ipv4: `108.177.12.120`; roles: dns-answer\n- ipv4: `108.177.12.94`; roles: dns-answer\n- ipv4: `108.59.0.12`; roles: dns-answer\n- ipv4: `108.59.0.8`; roles: dns-answer\n- ipv4: `108.59.4.171`; roles: dns-answer\n- ipv4: `108.59.4.172`; roles: dns-answer\n- ipv4: `108.59.4.173`; roles: dns-answer\n- ipv4: `109.201.156.81`; roles: dns-answer, network-endpoint\n- ipv4: `109.232.197.110`; roles: dns-answer, network-endpoint\n- ipv4: `109.232.197.33`; roles: dns-answer\n- ipv4: `13.107.21.200`; roles: dns-answer\n- ipv4: `13.107.4.50`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.5.80`; roles: dns-answer\n- ipv4: `13.33.106.254`; roles: dns-answer, network-endpoint\n- ipv4: `13.33.107.131`; roles: dns-answer\n- ipv4: `13.33.107.160`; roles: dns-answer, network-endpoint\n- ipv4: `13.33.107.209`; roles: dns-answer\n- ipv4: `13.33.107.212`; roles: dns-answer\n- ipv4: `13.33.78.101`; roles: dns-answer, network-endpoint\n- ipv4: `13.33.78.144`; roles: dns-answer\n- ipv4: `13.33.78.186`; roles: dns-answer, network-endpoint\n- ipv4: `13.33.78.214`; roles: dns-answer\n- ipv4: `13.33.78.217`; roles: dns-answer\n- ipv4: `13.33.78.38`; roles: dns-answer\n- ipv4: `13.33.78.48`; roles: dns-answer\n- ipv4: `13.33.78.61`; roles: dns-answer\n- ipv4: `13.56.1.77`; roles: dns-answer\n- ipv4: `13.57.103.80`; roles: dns-answer\n- ipv4: `13.57.162.22`; roles: dns-answer\n- ipv4: `13.57.70.199`; roles: dns-answer, network-endpoint\n- ipv4: `13.57.96.247`; roles: dns-answer\n- ipv4: `13.59.169.161`; roles: dns-answer\n- ipv4: `13.59.61.143`; roles: dns-answer\n- ipv4: `136.243.151.13`; roles: dns-answer, network-endpoint\n- ipv4: `136.243.249.79`; roles: dns-answer\n- ipv4: `136.243.25.70`; roles: dns-answer, network-endpoint\n- ipv4: `136.243.42.207`; roles: dns-answer\n- ipv4: `136.243.42.249`; roles: dns-answer, network-endpoint\n- ipv4: `136.243.7.47`; roles: dns-answer\n- ipv4: `136.243.73.56`; roles: dns-answer\n- ipv4: `136.243.95.174`; roles: dns-answer\n- ipv4: `136.243.95.176`; roles: dns-answer\n- ipv4: `142.93.53.73`; roles: dns-answer\n- ipv4: `142.93.61.36`; roles: dns-answer\n- ipv4: `142.93.61.37`; roles: dns-answer, network-endpoint\n- ipv4: `142.93.61.39`; roles: dns-answer\n- ipv4: `142.93.61.40`; roles: dns-answer\n- ipv4: `144.76.121.172`; roles: dns-answer\n- ipv4: `146.20.132.242`; roles: dns-answer\n- ipv4: `146.20.132.243`; roles: dns-answer, network-endpoint\n- ipv4: `146.20.132.244`; roles: dns-answer\n- ipv4: `146.20.132.245`; roles: dns-answer\n- ipv4: `146.20.132.246`; roles: dns-answer\n- ipv4: `146.20.132.247`; roles: dns-answer\n- ipv4: `146.20.132.248`; roles: dns-answer\n- ipv4: `146.20.132.249`; roles: dns-answer\n- ipv4: `146.20.132.250`; roles: dns-answer\n- ipv4: `146.20.132.251`; roles: dns-answer\n- ipv4: `146.20.132.252`; roles: dns-answer\n- ipv4: `146.20.132.253`; roles: dns-answer\n- ipv4: `146.20.132.254`; roles: dns-answer\n- ipv4: `146.20.132.255`; roles: dns-answer\n- ipv4: `146.20.133.0`; roles: dns-answer\n- ipv4: `146.20.133.1`; roles: dns-answer\n- ipv4: `146.20.133.82`; roles: dns-answer\n- ipv4: `146.20.133.83`; roles: dns-answer\n- ipv4: `146.20.133.84`; roles: dns-answer\n- ipv4: `146.20.133.85`; roles: dns-answer\n- ipv4: `146.20.133.86`; roles: dns-answer\n- ipv4: `146.20.133.87`; roles: dns-answer, network-endpoint\n- ipv4: `146.20.133.88`; roles: dns-answer\n- ipv4: `146.20.133.89`; roles: dns-answer\n- ipv4: `146.20.133.90`; roles: dns-answer\n- ipv4: `146.20.133.91`; roles: dns-answer\n- ipv4: `146.20.133.92`; roles: dns-answer\n- ipv4: `146.20.133.93`; roles: dns-answer\n- ipv4: `146.20.133.94`; roles: dns-answer\n- ipv4: `146.20.133.95`; roles: dns-answer\n- ipv4: `146.20.133.96`; roles: dns-answer\n- ipv4: `146.20.133.97`; roles: dns-answer\n- ipv4: `148.251.82.59`; roles: dns-answer, network-endpoint\n- ipv4: `149.129.222.112`; roles: dns-answer, network-endpoint\n- ipv4: `149.174.66.131`; roles: dns-answer, network-endpoint\n- exported object `gtm.js%3fid=GTM-KX9ZXT`; SHA-256 `225bd232b88e6072f4601058ebf7a0db0fa5cb3bf7537350c7de0bf5f2f5c54a`; size 401284 bytes\n SHA-1: `e4cc38a71bbe474ca7daab4dd6628c35a51afe27`; MD5: `937cfd8c2d60d04068169c159d51308b`; completeness: unknown; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":43686,\"response_frame\":44010,\"server_ip\":\"216.58.192.8\",\"status_code\":\"200\",\"tcp_stream\":1147,\"url\":\"http://www.googletagmanager.com/gtm.js?id=GTM-KX9ZXT\"}]`.\n Static content: `{\"content_kind\":\"script-like-text\",\"features\":[{\"excerpt\":\"eval(\",\"feature\":\"dynamic-evaluation\",\"offset\":107}],\"inspected_bytes\":262144,\"inspection_truncated\":true,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\",\"pe_kind\":null}`. Not execution proof.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":262144,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":true}`; do not infer the destination without an exact transfer binding.\n- exported object `sdk.js`; SHA-256 `87da7fce38fb944279568a460f952df3009b4398083bbe5dedb489fde5f46814`; size 222891 bytes\n SHA-1: `9d25368a5f7c928f5dc37c3081c6a70b8ced2bf7`; MD5: `564019f236046fdd622404a4925dfe36`; completeness: unknown; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":43690,\"response_frame\":43966,\"server_ip\":\"157.240.11.22\",\"status_code\":\"200\",\"tcp_stream\":1151,\"url\":\"http://connect.facebook.net/en_US/sdk.js\"}]`.\n Static content: `{\"content_kind\":\"script-like-text\",\"features\":[{\"excerpt\":\"eval(\",\"feature\":\"dynamic-evaluation\",\"offset\":205419}],\"inspected_bytes\":222891,\"inspection_truncated\":false,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\",\"pe_kind\":null}`. Not execution proof.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":222891,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `a3.dat`; SHA-256 `bc1fc69f9747dc034ece7d9bb795c5e596d9be6ca71efe75c6c0fd18f3cbfbf5`; size 104048 bytes\n SHA-1: `fa99241ee9581f281544423881cf702375d33c23`; MD5: `5473299167525c8d0addb8248900606a`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":7280,\"response_frame\":7325,\"server_ip\":\"149.129.222.112\",\"status_code\":\"200\",\"tcp_stream\":179,\"url\":\"http://r53x.com/a3.dat\"}]`.\n Static content: `{\"content_kind\":\"pe\",\"features\":[],\"inspected_bytes\":104048,\"inspection_truncated\":false,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\",\"pe_kind\":\"executable\"}`. Not execution proof.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":104048,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `angular-1.2.4.min.js%3fv=1533913284`; SHA-256 `8ed22d97053651c1bf38b50de0630657e03c9dc1b82f2c80241d72dd68c34fc8`; size 99790 bytes\n SHA-1: `3098130b71a6c55c28b476748f70823ecf8275c3`; MD5: `63664393c63e67de2220279605bcdd0a`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":41784,\"response_frame\":43154,\"server_ip\":\"103.5.149.72\",\"status_code\":\"200\",\"tcp_stream\":1133,\"url\":\"http://tass.com/js/angular-1.2.4.min.js?v=1533913284\"}]`.\n Static content: `{\"content_kind\":\"script-like-text\",\"features\":[{\"excerpt\":\"eval(\",\"feature\":\"dynamic-evaluation\",\"offset\":47556}],\"inspected_bytes\":99790,\"inspection_truncated\":false,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\",\"pe_kind\":null}`. Not execution proof.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":99790,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `openapi.js%3fv=1533913284`; SHA-256 `1d762c3dcf8ec1d7cf68b813aed274886103a60b67c11ff9f166398e96fdedaf`; size 95382 bytes\n SHA-1: `fe19f37b9339a8ed146765594f15c7af6d4f0e93`; MD5: `5efb803ef77f2864d09850c27aaa2459`; completeness: unknown; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":40209,\"response_frame\":40506,\"server_ip\":\"87.240.129.133\",\"status_code\":\"200\",\"tcp_stream\":1076,\"url\":\"http://vk.com/js/api/openapi.js?v=1533913284\"}]`.\n Static content: `{\"content_kind\":\"script-like-text\",\"features\":[{\"excerpt\":\"eval(\",\"feature\":\"dynamic-evaluation\",\"offset\":29791}],\"inspected_bytes\":95382,\"inspection_truncated\":false,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\",\"pe_kind\":null}`. Not execution proof.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":95382,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `mainDirect.js%3fv=1533913284`; SHA-256 `fb03a6b96e7aa8dc5c4e079289c84f446a7374d65f7bb79a734c34c9fb8e7703`; size 19588 bytes\n SHA-1: `baf2cfd86bbce816513cd99b19ddfe182aa4d2a4`; MD5: `c53003b9bc15025f27eece7e47ea92c6`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":42021,\"response_frame\":42702,\"server_ip\":\"103.5.149.72\",\"status_code\":\"200\",\"tcp_stream\":1134,\"url\":\"http://tass.com/js/common/mainDirect.js?v=1533913284\"}]`.\n Static content: `{\"content_kind\":\"script-like-text\",\"features\":[{\"excerpt\":\"eval(\",\"feature\":\"dynamic-evaluation\",\"offset\":634}],\"inspected_bytes\":19588,\"inspection_truncated\":false,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\",\"pe_kind\":null}`. Not execution proof.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":19588,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `infinite-scroll.js%3fv=1533913284`; SHA-256 `beff9a913c0887163fd4a17d037f2188ed9e93f6c57f770448c2f7046ca7d141`; size 572 bytes\n SHA-1: `729ebe0cb523e9ca7c6bf434917ae81daac9f96f`; MD5: `66f5668ac5056b7badf79cbed592104a`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":41347,\"response_frame\":41786,\"server_ip\":\"103.5.149.72\",\"status_code\":\"200\",\"tcp_stream\":1073,\"url\":\"http://tass.com/js/common/infinite-scroll.js?v=1533913284\"}]`.\n Static content: `{\"content_kind\":\"script-like-text\",\"features\":[{\"excerpt\":\"eval(\",\"feature\":\"dynamic-evaluation\",\"offset\":355}],\"inspected_bytes\":572,\"inspection_truncated\":false,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\",\"pe_kind\":null}`. Not execution proof.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":572,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `1.zip`; SHA-256 `c0d599b80025a70004d813d62b587af4f8ae8abd64f514f280b6e4899436623f`; size 299 bytes\n SHA-1: `7cd1a717f77e35646866e5b810df89fd7df8b27c`; MD5: `b3022d6e52378fe96ce7d21355c91361`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":7277,\"response_frame\":7279,\"server_ip\":\"149.129.222.112\",\"status_code\":\"200\",\"tcp_stream\":179,\"url\":\"http://r53x.com/1.zip\"}]`.\n Static content: `{\"content_kind\":\"script-like-text\",\"features\":[{\"excerpt\":\"DownloadFile\",\"feature\":\"powershell-download\",\"offset\":184}],\"inspected_bytes\":299,\"inspection_truncated\":false,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\",\"pe_kind\":null}`. Not execution proof.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":299,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `1(1).rar`; SHA-256 `b908d9b1001d0a39ba92501c086b1c25b05b171eeda035ae9f3e129d2776a314`; size 154 bytes\n SHA-1: `a5404c174b4acaaa5f26efb95c6aa589c1230152`; MD5: `4b8139414b01d7728ce273c2a0f565c2`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":7263,\"response_frame\":7266,\"server_ip\":\"149.129.222.112\",\"status_code\":\"200\",\"tcp_stream\":178,\"url\":\"http://r53x.com/1.rar\"}]`.\n Static content: `{\"content_kind\":\"script-like-text\",\"features\":[{\"excerpt\":\"downloadstring\",\"feature\":\"powershell-download\",\"offset\":108},{\"excerpt\":\"IEX\",\"feature\":\"dynamic-evaluation\",\"offset\":76}],\"inspected_bytes\":154,\"inspection_truncated\":false,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\",\"pe_kind\":null}`. Not execution proof.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":154,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `layout.min.css%3fv=1533913284`; SHA-256 `c87f78fc36289e69a164914c940e5cecd31024d0a06089c2fab4dcd23e507ae6`; size 216785 bytes\n SHA-1: `b282418ff07e48b0c9dcb5560baf5c2c93f36ac6`; MD5: `4d6877668d58be1c8add1842b356295e`; completeness: unknown; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":40173,\"response_frame\":41020,\"server_ip\":\"103.5.149.72\",\"status_code\":\"200\",\"tcp_stream\":1073,\"url\":\"http://tass.com/assets/14df3cc8/layout.min.css?v=1533913284\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":216785,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `libs.min.js%3fv=1533913284`; SHA-256 `cc59dfc0669d00ad2b72411ff19cf555e4d0f1b940f0c674904004c73a3edb07`; size 192101 bytes\n SHA-1: `de6d849aed84c7a87790131ad7e89d54bb2b93bf`; MD5: `35d1e2a5f6babed038652f187d9401dd`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":42524,\"response_frame\":43539,\"server_ip\":\"103.5.149.72\",\"status_code\":\"200\",\"tcp_stream\":1130,\"url\":\"http://tass.com/assets/bfcd510f/libs.min.js?v=1533913284\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":192101,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `highcharts.js%3fv=1533913284`; SHA-256 `af5e4f327b79424352a42bf43df71e6a2f52d6f8948b82d6a42b4c2e97f7bfea`; size 153909 bytes\n SHA-1: `9305510952cfeb4ed26cc43965d070afadc1e021`; MD5: `bdd06f45e34c33dfaaac249f3eb50040`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":42266,\"response_frame\":43271,\"server_ip\":\"103.5.149.72\",\"status_code\":\"200\",\"tcp_stream\":1070,\"url\":\"http://tass.com/js/highcharts/highcharts.js?v=1533913284\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":153909,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `1016847`; SHA-256 `1dc9f4fe16b9590b8044c7389d2d1c37fb18ef5dad0ef801a6071f4df7c7a9d5`; size 127688 bytes\n SHA-1: `50ee146fa2e6903813f79c7ce4cdd77a0aa26f8e`; MD5: `9ffa7d68589ad062d994a6eb0a097e12`; completeness: unknown; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":46268,\"response_frame\":46359,\"server_ip\":\"103.5.149.72\",\"status_code\":\"200\",\"tcp_stream\":1070,\"url\":\"http://tass.com/economy/1016847\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":127688,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `widgets.js`; SHA-256 `7d856e9985a83e2e6fa80ea41c6e67c8db9e19d9f30ce8d0a8d87ad942a00a31`; size 121199 bytes\n SHA-1: `b01ea2aeccec8b33e543f4988eff30a68317a37c`; MD5: `6a149d6ef4cd817b9ca0747ca86325e5`; completeness: unknown; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":43698,\"response_frame\":43810,\"server_ip\":\"192.229.163.25\",\"status_code\":\"200\",\"tcp_stream\":1150,\"url\":\"http://platform.twitter.com/widgets.js\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":121199,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `jquery-1.8.3.min.js%3fv=1533913284`; SHA-256 `61c6caebd23921741fb5ffe6603f16634fca9840c2bf56ac8201e9264d6daccf`; size 93636 bytes\n SHA-1: `06e872300088b9ba8a08427d28ed0efcdf9c6ff5`; MD5: `3576a6e73c9dccdbbc4a2cf8ff544ad7`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":40113,\"response_frame\":41024,\"server_ip\":\"103.5.149.72\",\"status_code\":\"200\",\"tcp_stream\":1070,\"url\":\"http://tass.com/js/jquery-1.8.3.min.js?v=1533913284\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":93636,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `jquery-ui.min.js%3fv=1533913284`; SHA-256 `17f91f2405171b6857a93cb8c9b306144951f1e272a039a61a7753ba04eb0b52`; size 88650 bytes\n SHA-1: `b7a1fbfd8329d0a92ed755ec6ba432ae8dfab606`; MD5: `1f2043250a82536d35df77a7888a4964`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":41126,\"response_frame\":43633,\"server_ip\":\"103.5.149.72\",\"status_code\":\"200\",\"tcp_stream\":1071,\"url\":\"http://tass.com/js/jquery-ui.min.js?v=1533913284\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":88650,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `material.min.css%3fv=1533913284`; SHA-256 `110c07b1c1d0b56bb1755a621024babe4a7f60cacd8ffe605ef41826d3fe6784`; size 76152 bytes\n SHA-1: `4d4e996d695bc73f01692998b956b4b424bcbffe`; MD5: `e8b3f0da267d0861529b2b94a351eb84`; completeness: unknown; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":46355,\"response_frame\":46463,\"server_ip\":\"103.5.149.72\",\"status_code\":\"200\",\"tcp_stream\":1133,\"url\":\"http://tass.com/assets/88a00814/material.min.css?v=1533913284\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":76152,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `osd.js`; SHA-256 `2ea3ff820ddb55c4c951ff1c0fbfe8590ebff986b806fb351f2f32aded2fefc4`; size 72153 bytes\n SHA-1: `715452ba7b50babe4b3b78f8aab648b3a516899e`; MD5: `6d7a638336386d34c7413eb162eef754`; completeness: unknown; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":44800,\"response_frame\":45009,\"server_ip\":\"216.58.194.162\",\"status_code\":\"200\",\"tcp_stream\":1187,\"url\":\"http://pagead2.googlesyndication.com/pagead/osd.js\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":72153,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `itar.min.js%3fv=1533913284`; SHA-256 `ea843998fbbcd38dd92e228250a9bf15521391a26c88cb25a16b162d7f35d0e1`; size 69253 bytes\n SHA-1: `cfc2b137f04e6a529716db3d7576c5f72e322f84`; MD5: `7a99860d59c58ae3860b52603d4c7b3d`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":42696,\"response_frame\":43580,\"server_ip\":\"103.5.149.72\",\"status_code\":\"200\",\"tcp_stream\":1072,\"url\":\"http://tass.com/assets/287c4a4b/itar.min.js?v=1533913284\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":69253,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `authrootstl.cab`; SHA-256 `c0f37380971fb93ecb0cfa3c2bd6d91cc77f254f0a6ca41edeff47fda0e409cc`; size 54153 bytes\n SHA-1: `c56b126f887495918e8abcf813957780f0b9466a`; MD5: `767760b1b3b838b2de0599d0e76d1c76`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":39496,\"response_frame\":39550,\"server_ip\":\"205.185.216.42\",\"status_code\":\"200\",\"tcp_stream\":1035,\"url\":\"http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":54153,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `mainTopSlider.css%3fv=1533913284`; SHA-256 `a002c9d3c0bfd9a9ff3c9ff2b1dbd79beb6bf0af5b45933ccad66337bc6864eb`; size 48109 bytes\n SHA-1: `a3b123f3dd6e4470f953bcab0a06ebb1d01cd909`; MD5: `f0e8ef7b0f1c3270277a5187d01e8844`; completeness: unknown; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":40213,\"response_frame\":40357,\"server_ip\":\"103.5.149.72\",\"status_code\":\"200\",\"tcp_stream\":1071,\"url\":\"http://tass.com/assets/842758d5/mainTopSlider.css?v=1533913284\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":48109,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `mobile.css%3f_=1`; SHA-256 `2a44910e028b6d330cacd3462a0252019ce6c016805a1b16c1c9c52b5c1caa46`; size 44094 bytes\n SHA-1: `d6336336c7ab590b6715e998dca0e7a07ca8ce4e`; MD5: `126260b59895050de79f127386082964`; completeness: unknown; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":41022,\"response_frame\":41345,\"server_ip\":\"103.5.149.72\",\"status_code\":\"200\",\"tcp_stream\":1073,\"url\":\"http://tass.com/css/mobile.css?_=1\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":44094,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `favicon.ico%3f225`; SHA-256 `05879b64ff801a2c6fbc4e43a1872c6a0ab6a67d3839d1eb3ed8e4852d4d58bd`; size 34494 bytes\n SHA-1: `9a6714e86ecdf04be96e49baa9c099f7c9fa4920`; MD5: `062a3c7349b1a1d3830c2b6365190ef9`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":46258,\"response_frame\":46312,\"server_ip\":\"103.5.149.72\",\"status_code\":\"200\",\"tcp_stream\":1073,\"url\":\"http://tass.com/favicon.ico?225\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":34494,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `angular.rangeSlider.js%3fv=1533913284`; SHA-256 `f8e7288c0e055bff074b4d2f64cf687fa49de2e08955cd2cdb00d55eaacb3a61`; size 31135 bytes\n SHA-1: `1f4d1d835ec6d830fbcd286b93bf3b2afac5b1f9`; MD5: `bb2847431feb71a464e7ce9f51fb46f0`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":41365,\"response_frame\":41848,\"server_ip\":\"103.5.149.72\",\"status_code\":\"200\",\"tcp_stream\":1070,\"url\":\"http://tass.com/js/zoom/angular.rangeSlider.js?v=1533913284\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":31135,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `icontass.eot%3f`; SHA-256 `387ad007219e458d5db35423310dcbc61b583b2611fde57a36879e31b3fb1d99`; size 29052 bytes\n SHA-1: `c295d6006044234fc04b5544d6cd97687f35d38d`; MD5: `7641709db5179facf68bdb5c349d6eb3`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":43657,\"response_frame\":44328,\"server_ip\":\"103.5.149.72\",\"status_code\":\"200\",\"tcp_stream\":1071,\"url\":\"http://tass.com/fonts/icontass/icontass.eot?\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":29052,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `media-queries.css%3f_=3`; SHA-256 `7a44293f37ed3ab18757c89dc76b673aa3ff923e31933ba1bdae740fb0e7ddd4`; size 28223 bytes\n SHA-1: `123ba6628589c64cddf09b7ef5fb9da82eff2c61`; MD5: `d64fe6e6b2ad89fbc3cdbf24c08bfbdf`; completeness: unknown; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":41026,\"response_frame\":41363,\"server_ip\":\"103.5.149.72\",\"status_code\":\"200\",\"tcp_stream\":1070,\"url\":\"http://tass.com/css/media-queries.css?_=3\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":28223,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `lenta%3flimit=50`; SHA-256 `e4c763b60274fbb4f5ebfb43603452f0c592aedf39647951ce87182fdb702955`; size 27503 bytes\n SHA-1: `4a9cabfca33a5a00630c31819b4359468d9ff9de`; MD5: `db288e5dc92beb5b805f4349947f2e5c`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":44285,\"response_frame\":44488,\"server_ip\":\"103.5.149.72\",\"status_code\":\"200\",\"tcp_stream\":1073,\"url\":\"http://tass.com/api/news/lenta?limit=50\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":27503,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `lenta.min.css%3fv=1533913284`; SHA-256 `ad927cfd47a633c08193fec7881a927102c04802a42fa9d880c34dcba5d473ed`; size 22170 bytes\n SHA-1: `47d2bb69f7d2bf434698b7800f591df531c642a5`; MD5: `2fc3e42ef2eef26d296845e50f933f4d`; completeness: unknown; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":41322,\"response_frame\":42045,\"server_ip\":\"103.5.149.72\",\"status_code\":\"200\",\"tcp_stream\":1130,\"url\":\"http://tass.com/assets/666a6de7/lenta.min.css?v=1533913284\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":22170,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `angular-touch.js%3fv=1533913284`; SHA-256 `39f55c0059bfa765dbc67836a3c694c4257e3880c5323e14a2874d78f4de5582`; size 21191 bytes\n SHA-1: `1a5e93417ac099cf694a7bd8147162845e45518f`; MD5: `0464b22b1d966212326452d266840b7e`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":41353,\"response_frame\":42689,\"server_ip\":\"103.5.149.72\",\"status_code\":\"200\",\"tcp_stream\":1072,\"url\":\"http://tass.com/js/common/angular-touch.js?v=1533913284\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":21191,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `gpt.js`; SHA-256 `2361c69cc160246a46ecca25b6b50d825c2d950c39328c29aa1a168018640b11`; size 20578 bytes\n SHA-1: `f45fd04f3908053cdab19132c86438f9e2121386`; MD5: `41551a254f99036adbd05c9c0d10280f`; completeness: unknown; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":43669,\"response_frame\":43720,\"server_ip\":\"216.58.194.162\",\"status_code\":\"200\",\"tcp_stream\":1139,\"url\":\"http://www.googletagservices.com/tag/js/gpt.js\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":20578,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `KFOlCnqEu92Fr1MmSU5fBBc-.woff`; SHA-256 `3ab30e780c8b0bcc4998b838a5b30c3bfe28edead312906dc3c12271fae0699a`; size 19916 bytes\n SHA-1: `ff5673d89e6c2893d24c87bc9786c632290e150e`; MD5: `a1471d1d6431c893582a5f6a250db3f9`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":45321,\"response_frame\":45736,\"server_ip\":\"216.58.192.3\",\"status_code\":\"200\",\"tcp_stream\":1197,\"url\":\"http://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmSU5fBBc-.woff\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":19916,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `KFOlCnqEu92Fr1MmWUlfBBc-.woff`; SHA-256 `468e579fe1210fa55525b1c470ed2d1958404512a2dd4fb972cac5ce0ff00b1f`; size 19888 bytes\n SHA-1: `b2198c3fc1c72646d372f63e135e70ba2c9fed8e`; MD5: `cf6613d1adf490972c557a8e318e0868`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":45320,\"response_frame\":45737,\"server_ip\":\"216.58.192.3\",\"status_code\":\"200\",\"tcp_stream\":1198,\"url\":\"http://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmWUlfBBc-.woff\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":19888,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `hammer.min.js%3fv=1533913284`; SHA-256 `8500d605a74853787e140b8e1fcc945de816b28bda06093a3a9d3a9fe00b9b6e`; size 18358 bytes\n SHA-1: `acf211b20a4932fc5798a0d8605c6a2a319a5159`; MD5: `5e096613a4835a9f0756fd09d566e0ac`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":42057,\"response_frame\":42755,\"server_ip\":\"103.5.149.72\",\"status_code\":\"200\",\"tcp_stream\":1131,\"url\":\"http://tass.com/js/hammer.min.js?v=1533913284\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":18358,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `flags.min.css%3fv=1533913284`; SHA-256 `044e4bccabac4f77e55d287724125fd5e1df18597c7e1d38cf690aefdae255b4`; size 15473 bytes\n SHA-1: `718ef24efcae02c53eaa5ee6ea0a00a9fbda38d6`; MD5: `81630c91a18657993bc3fbf1d512f0cc`; completeness: unknown; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":40177,\"response_frame\":40560,\"server_ip\":\"103.5.149.72\",\"status_code\":\"200\",\"tcp_stream\":1075,\"url\":\"http://tass.com/assets/6f5f919/flags.min.css?v=1533913284\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":15473,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `mainTopSlider.js%3fv=1533913284`; SHA-256 `6281b1e2ea6a5d13e0fd8766295444b52867bc3298d5c2b6b55b1b22420f230c`; size 15430 bytes\n SHA-1: `d038ec54537f68952c7b47ae9cd9bc939cbde010`; MD5: `677b9f873fe8a5cb746ba4c6bd1619b8`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":41850,\"response_frame\":42263,\"server_ip\":\"103.5.149.72\",\"status_code\":\"200\",\"tcp_stream\":1070,\"url\":\"http://tass.com/js/common/mainTopSlider.js?v=1533913284\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":15430,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `zoomController.js%3fv=1533913284`; SHA-256 `826da83425629535790ab944e227e02a597999af91f0a662bcfb4351c950d274`; size 14904 bytes\n SHA-1: `638ce9703535186c0991f4d224256cd24b0da6f9`; MD5: `14fb97e33150e48e00aa1965a3200865`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":42204,\"response_frame\":42975,\"server_ip\":\"103.5.149.72\",\"status_code\":\"200\",\"tcp_stream\":1074,\"url\":\"http://tass.com/js/zoom/zoomController.js?v=1533913284\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":14904,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `appstore.svg`; SHA-256 `99fb918a282d39d585d3d759f7903f7508925d0f78ae80e427cec27378c5b71b`; size 14903 bytes\n SHA-1: `b0b1d1d3be98178b270499e0e91c97875a79aa65`; MD5: `a53fe746f15eaf6f18c612fbe2a5b5aa`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":44183,\"response_frame\":44312,\"server_ip\":\"103.5.149.72\",\"status_code\":\"200\",\"tcp_stream\":1133,\"url\":\"http://tass.com/images/appstore.svg\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":14903,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `socialDirective.js`; SHA-256 `a6dd05c22e36e46f367bb82192f989ccf6b9f5407e61addeaab44b7c53e30a00`; size 12028 bytes\n SHA-1: `6199efed932678781307c5808b9e2f7ae49320ee`; MD5: `f19c48dda2fdbde73b721f0ad9b5c148`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":46484,\"response_frame\":46735,\"server_ip\":\"103.5.149.72\",\"status_code\":\"200\",\"tcp_stream\":1070,\"url\":\"http://tass.com/js/social/socialDirective.js\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":12028,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `footer.min.css%3fv=1533913284`; SHA-256 `3715612c143dd7fbcd9db512e0cbd31334fe349c77f5ac4921d0646ca8bb6fdf`; size 11634 bytes\n SHA-1: `cdf7b8be227354c710602f8a2587ef80b94c4e4e`; MD5: `044820d45cea5cff311085b9687aa5fd`; completeness: unknown; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":41324,\"response_frame\":42053,\"server_ip\":\"103.5.149.72\",\"status_code\":\"200\",\"tcp_stream\":1131,\"url\":\"http://tass.com/assets/916e0df6/footer.min.css?v=1533913284\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":11634,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `videoWidget.js`; SHA-256 `5aa35acedcb1d276b3b3a71371eb51bc910b970deb8a3c6111fa99959fe6c9c7`; size 11271 bytes\n SHA-1: `08ef0bad1594a840895f9efc30dae52ec60cf3f3`; MD5: `0360fa936e78424436b212f7411a1356`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":46465,\"response_frame\":46683,\"server_ip\":\"103.5.149.72\",\"status_code\":\"200\",\"tcp_stream\":1133,\"url\":\"http://tass.com/js/videoWidget.js\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":11271,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `textBroadcastController.js%3fv=1533913284`; SHA-256 `a131c2b10883bc8647bffa08b4a6b27f04b376bbddb267a4d0c9d3e8ea851aa0`; size 10013 bytes\n SHA-1: `9a10d5e834a1c2626f891f4986658c20bb7243b9`; MD5: `0b3fcb496c4e9e08e0217f2a769c2d34`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":46427,\"response_frame\":46593,\"server_ip\":\"103.5.149.72\",\"status_code\":\"200\",\"tcp_stream\":1130,\"url\":\"http://tass.com/js/common/textBroadcastController.js?v=1533913284\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":10013,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `mediaBlocksController.js%3fv=1533913284`; SHA-256 `4efb8677134ae61413bf441d88c2e912ca065a68bb4566b30f935cae34f5a98e`; size 9712 bytes\n SHA-1: `f21b5b7f375ff4e42809e7f23e1042320be07c1c`; MD5: `f4ee02f5fdd6dfdb3a3aaf23b7065410`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":42230,\"response_frame\":42749,\"server_ip\":\"103.5.149.72\",\"status_code\":\"200\",\"tcp_stream\":1132,\"url\":\"http://tass.com/js/common/mediaBlocksController.js?v=1533913284\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":9712,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `pressCenterCalendar.js%3fv=1533913284`; SHA-256 `1434636c458ad8cda52b2e1cb38178b63d9af59579d7259a36a436c9c6a11a72`; size 9636 bytes\n SHA-1: `13096fb5b526a753db0a5571e58c383b6fa6190c`; MD5: `e27474d9542bb6a9bca30ba488e0c4d6`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":41876,\"response_frame\":42283,\"server_ip\":\"103.5.149.72\",\"status_code\":\"200\",\"tcp_stream\":1075,\"url\":\"http://tass.com/js/common/pressCenterCalendar.js?v=1533913284\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":9636,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `videoWidget.min.css%3fv=1533913284`; SHA-256 `ebdab894f319fe12a1b14f3dc8c883d45caf4c15e389fb9d6568145f926f4126`; size 7533 bytes\n SHA-1: `bce9ed854d3dff32b54b48719e423ac197cd5b6c`; MD5: `76e2c7c199d29ab66d2d7a00ccacbe68`; completeness: unknown; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":46345,\"response_frame\":46433,\"server_ip\":\"103.5.149.72\",\"status_code\":\"200\",\"tcp_stream\":1072,\"url\":\"http://tass.com/assets/7ce9e0a9/videoWidget.min.css?v=1533913284\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":7533,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `photoModeCss.css%3fv=1533913284`; SHA-256 `ad984172bbde72d905cb477edf2775b567580976ef1327612313d7490a3d30ae`; size 7317 bytes\n SHA-1: `6305dc72a581b486e0e7865b972a75416242fa4f`; MD5: `7aa858f22a5991daf6f47ee32486ef6c`; completeness: unknown; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":40165,\"response_frame\":40508,\"server_ip\":\"103.5.149.72\",\"status_code\":\"200\",\"tcp_stream\":1074,\"url\":\"http://tass.com/assets/d45d2990/photoModeCss.css?v=1533913284\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":7317,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `media-widget.min(1).css%3fv=1533913284`; SHA-256 `3836255ada8bd1d6a0ac85b332623efd56c48a84e44be7cdf39482e5e1fa9e3c`; size 6821 bytes\n SHA-1: `b17298c262c50c0cc4d30c93a5739edd97eaf5b2`; MD5: `cea74ce0dda7f6c872d0a04ecba87522`; completeness: unknown; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":46361,\"response_frame\":46475,\"server_ip\":\"103.5.149.72\",\"status_code\":\"200\",\"tcp_stream\":1070,\"url\":\"http://tass.com/assets/735f4b6e/media-widget.min.css?v=1533913284\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":6821,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `angular.rangeSlider.min.css%3fv=1533913284`; SHA-256 `1ed6dac934e53a42db49242075dee716837fe4115d998e45f5c52d4ae96923a2`; size 6314 bytes\n SHA-1: `260feb41e99159825c08867f2e5e5d4245c4f3f3`; MD5: `b2bd0b88c041578c03568b404155b06c`; completeness: unknown; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":40361,\"response_frame\":40735,\"server_ip\":\"103.5.149.72\",\"status_code\":\"200\",\"tcp_stream\":1071,\"url\":\"http://tass.com/assets/43ffdc60/angular.rangeSlider.min.css?v=1533913284\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":6314,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `tass.js%3fv=1533913284`; SHA-256 `1baf84b9f47c61803a5ea556eb3541f6ba74fc6e3c5261aac798aa19773e5cf1`; size 6084 bytes\n SHA-1: `220b7b63eb93911b478214193c0710dab241cf2f`; MD5: `c331b08cd289977cb9f292607a3289df`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":41437,\"response_frame\":41872,\"server_ip\":\"103.5.149.72\",\"status_code\":\"200\",\"tcp_stream\":1075,\"url\":\"http://tass.com/js/common/tass.js?v=1533913284\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":6084,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `b-search-icon.png`; SHA-256 `3cdffc1fdda52774a1ee46fcd7244b0ee88b11df0f7ddce7dc725609bd1f2a90`; size 5657 bytes\n SHA-1: `5fedd790998d38854cd2d83c18f8aad83130c15e`; MD5: `98fa87444f045f0fd676dc0cd8d1a480`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":43972,\"response_frame\":44170,\"server_ip\":\"103.5.149.72\",\"status_code\":\"200\",\"tcp_stream\":1073,\"url\":\"http://tass.com/i/b-search-icon.png\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":5657,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `loader_animation_lenta_new.gif`; SHA-256 `e2b232bd93d4faa6bd4156d3e31b542a24ac3afe877c6f7faf23c1f474eaf52a`; size 5563 bytes\n SHA-1: `ba117f39ba5ed5383fdff0458efd751616449971`; MD5: `6edd5ff7cf3c288df9f001bc130bb48b`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":42759,\"response_frame\":43041,\"server_ip\":\"103.5.149.72\",\"status_code\":\"200\",\"tcp_stream\":1131,\"url\":\"http://tass.com/i/loader_animation_lenta_new.gif\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":5563,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `ng-pinch-zoom.js%3fv=1533913284`; SHA-256 `9d0bbca6eb531759098a56914524f615a1d5a75a1b2c429d7b238973c2610c7a`; size 5404 bytes\n SHA-1: `75c56220e6265ead20d77a15c8856702c0f55c7b`; MD5: `144861f128c7e9d05240a2e51ed5fac6`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":41391,\"response_frame\":42201,\"server_ip\":\"103.5.149.72\",\"status_code\":\"200\",\"tcp_stream\":1074,\"url\":\"http://tass.com/js/zoom/ng-pinch-zoom.js?v=1533913284\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":5404,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `logo_web_eng.png`; SHA-256 `c735ac343470ff44195d0167c35e9cb3e0bc43a7c749b67f50fb662300f73d9f`; size 5079 bytes\n SHA-1: `db57418ca2b47ea16c2ce06d8358ad3a28029d53`; MD5: `ec87b286537eae6ac3785788ab717434`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":42704,\"response_frame\":43001,\"server_ip\":\"103.5.149.72\",\"status_code\":\"200\",\"tcp_stream\":1134,\"url\":\"http://tass.com/images/newStyle/normal/logo/logo_web_eng.png\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":5079,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `print.css%3fv=1`; SHA-256 `6db9e00a697b239f66e81bff6d475a80c885dd2e533c93ddeed3e5883a79b8e1`; size 5004 bytes\n SHA-1: `4f1ee9547bee6859509e2354be99a7ad8fe8d6ad`; MD5: `4fa118d0bb1fc3b19e26cdb73863d1b2`; completeness: unknown; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":41060,\"response_frame\":41435,\"server_ip\":\"103.5.149.72\",\"status_code\":\"200\",\"tcp_stream\":1075,\"url\":\"http://tass.com/css/print.css?v=1\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":5004,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `angular-sanitize.min.js%3fv=1533913284`; SHA-256 `1b78a08c32d00ced18d679a004b133df54370f1f1d359f29b64c44256aaf8302`; size 4247 bytes\n SHA-1: `22743b7de65004753f3674a7946e89d2b14ce957`; MD5: `8af4f6c8d3b860d7a0ab4e4b7766c09e`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":41781,\"response_frame\":42224,\"server_ip\":\"103.5.149.72\",\"status_code\":\"200\",\"tcp_stream\":1132,\"url\":\"http://tass.com/js/common/angular-sanitize.min.js?v=1533913284\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":4247,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `before-widescreen.css`; SHA-256 `4e4d1d22150544836181502bf5004097fe8d90b3cb647455a4d601153b39eeb7`; size 4183 bytes\n SHA-1: `dd56564af85bafed797a08c2fdbb50b4a97cb83a`; MD5: `20b78d41d65948215ca2dff879a57db4`; completeness: unknown; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":41034,\"response_frame\":41351,\"server_ip\":\"103.5.149.72\",\"status_code\":\"200\",\"tcp_stream\":1072,\"url\":\"http://tass.com/css/before-widescreen.css\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":4183,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `audioWidget.min.css%3fv=1533913284`; SHA-256 `e6145cbc4aac4c3d685d04d508cee083e4e4a8a727af838ed46de8f0384b6119`; size 4171 bytes\n SHA-1: `544207e98609e616a195bf0a5fd6e1129ce2e295`; MD5: `f37960a0d703422a48a9e7134c01dc30`; completeness: unknown; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":46343,\"response_frame\":46425,\"server_ip\":\"103.5.149.72\",\"status_code\":\"200\",\"tcp_stream\":1130,\"url\":\"http://tass.com/assets/cb2c53b3/audioWidget.min.css?v=1533913284\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":4171,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `widescreen.css`; SHA-256 `6865cb6b98a7a93856092e5a4f0d44d6564e74513f685a1eef824a2f7ea77438`; size 3853 bytes\n SHA-1: `4bece5d3aa08d44687c42d46cca07600b7063b75`; MD5: `053dd961f947430d03c9f5d4a1eb19c8`; completeness: unknown; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":41036,\"response_frame\":41389,\"server_ip\":\"103.5.149.72\",\"status_code\":\"200\",\"tcp_stream\":1074,\"url\":\"http://tass.com/css/widescreen.css\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":3853,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `logo_footer_print_eng.png`; SHA-256 `8f34acb688aeae2e39704c35a59767aa10f9b6b99d81f681b8398b23c2d56f22`; size 3726 bytes\n SHA-1: `43005d8d9d83e417f0e05e9c6b705473ebe517cf`; MD5: `4725763bfe412b390a7d6e489db2cd5b`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":42766,\"response_frame\":43048,\"server_ip\":\"103.5.149.72\",\"status_code\":\"200\",\"tcp_stream\":1073,\"url\":\"http://tass.com/images/newStyle/normal/logo/logo_footer_print_eng.png\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":3726,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `main-slider-widget.min.css%3fv=1533913284`; SHA-256 `38b9ae4c8fe738059ad5faf084677b448bd9333fc6286e3440cfc09be2bb18d5`; size 3544 bytes\n SHA-1: `3a061a3646ba44f1db5ee2d5cdb15cb2a7f5c439`; MD5: `2058f57a9955497ec1278965cf81d43b`; completeness: unknown; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":40171,\"response_frame\":40516,\"server_ip\":\"103.5.149.72\",\"status_code\":\"200\",\"tcp_stream\":1072,\"url\":\"http://tass.com/assets/e2a326a5/main-slider-widget.min.css?v=1533913284\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":3544,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `activeViewService.js%3fv=1533913284`; SHA-256 `ae4f99d83e633923748305e0dd6434264babf605d56deb7d05345710796038fa`; size 3543 bytes\n SHA-1: `df253c78a3fde0a0a68617ddef00a2a2443b0ab3`; MD5: `36376f683c6a19cc2d1a8361200ff2b3`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":42022,\"response_frame\":42485,\"server_ip\":\"103.5.149.72\",\"status_code\":\"200\",\"tcp_stream\":1135,\"url\":\"http://tass.com/js/activeViewService.js?v=1533913284\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":3543,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `doublephoto.js%3fv=1533913284`; SHA-256 `3f7411e6cfd233d77fd01564a545084b986ae36e1c385c5999df93f5f430d65b`; size 3448 bytes\n SHA-1: `cf05ac4fe05b4150babe96159be5f422f06f370d`; MD5: `12c0ef9898c0949b71c8685b4c6d51c3`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":42049,\"response_frame\":42522,\"server_ip\":\"103.5.149.72\",\"status_code\":\"200\",\"tcp_stream\":1130,\"url\":\"http://tass.com/js/doublephoto/doublephoto.js?v=1533913284\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":3448,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `audioWidget.js`; SHA-256 `8ed18faec0943d33882e94cf8e4f01b732ff4e7c84294a9852dbed7cbb07afd7`; size 3364 bytes\n SHA-1: `8522d04bfbc42acd08b2b814268e1603a226d53c`; MD5: `89c10db955b9d40acf8c1274d5ca101a`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":46441,\"response_frame\":46630,\"server_ip\":\"103.5.149.72\",\"status_code\":\"200\",\"tcp_stream\":1071,\"url\":\"http://tass.com/js/audioWidget.js\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":3364,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `jquery.cookie.js%3fv=1533913284`; SHA-256 `b84161c9fbf7520cd14e7019f92120bd87a928a074156e91a992eba9fc9436e8`; size 3121 bytes\n SHA-1: `31e1bcc4cf805a2c2fee21f48ded1e598f64a2a8`; MD5: `d5528dde0006c78be04817327c2f9b6f`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":42248,\"response_frame\":42762,\"server_ip\":\"103.5.149.72\",\"status_code\":\"200\",\"tcp_stream\":1073,\"url\":\"http://tass.com/js/jquery.cookie.js?v=1533913284\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":3121,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `adfox.asyn.code.scroll.js`; SHA-256 `f9496faf384dba29602fe3072688892f2dcf7738eecb77208c51de0eaa12562a`; size 2985 bytes\n SHA-1: `1f84e2cf991fce3e0c9177aede1b443cd8d1ce58`; MD5: `65ae4862a70137a9ea9f1acfd29fb37f`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":42289,\"response_frame\":42849,\"server_ip\":\"103.5.149.72\",\"status_code\":\"200\",\"tcp_stream\":1075,\"url\":\"http://tass.com/js/adfox.asyn.code.scroll.js\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":2985,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `loader_animation.gif`; SHA-256 `2ffb9c700e123b950ec5913c37c94fdd8fbb16d072458bfd5a99b57a43233417`; size 2921 bytes\n SHA-1: `3373273ab2c323e1409c35f20d85e5394c602761`; MD5: `9afe1b785b60fd54082b7dc3a90c05f2`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":42753,\"response_frame\":43007,\"server_ip\":\"103.5.149.72\",\"status_code\":\"200\",\"tcp_stream\":1132,\"url\":\"http://tass.com/i/loader_animation.gif\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":2921,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `container(1).html`; SHA-256 `ced5c873136c4fab4584c0c6d26dcd530c748303d7ed9b7a7966b2fe1d6f5915`; size 2882 bytes\n SHA-1: `44a0865da1d790d7e884061f81a1058eb3002e82`; MD5: `bc79804ec2587a68c3bfca5d4bc83cef`; completeness: unknown; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":44277,\"response_frame\":44415,\"server_ip\":\"216.58.192.1\",\"status_code\":\"200\",\"tcp_stream\":1165,\"url\":\"http://tpc.googlesyndication.com/safeframe/1-0-29/html/container.html\"},{\"client_ip\":\"192.168.1.95\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":44398,\"response_frame\":44696,\"server_ip\":\"216.58.192.1\",\"status_code\":\"200\",\"tcp_stream\":1166,\"url\":\"http://tpc.googlesyndication.com/safeframe/1-0-29/html/container.html\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":2882,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `css(1).css%3fv=1533913284`; SHA-256 `cd649c61b13497605100760e8bf986b569254a716cc2b21612b8b4f09051a732`; size 2670 bytes\n SHA-1: `c1505934462b448fda0b9f0d4430c9b7e0a1621f`; MD5: `cae943c0e96d12c22bff9cf3acb3c2f6`; completeness: unknown; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":40562,\"response_frame\":41048,\"server_ip\":\"103.5.149.72\",\"status_code\":\"200\",\"tcp_stream\":1075,\"url\":\"http://tass.com/assets/8665a252/css.css?v=1533913284\"},{\"client_ip\":\"192.168.1.95\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":46341,\"response_frame\":46418,\"server_ip\":\"103.5.149.72\",\"status_code\":\"200\",\"tcp_stream\":1073,\"url\":\"http://tass.com/css/doublephoto/css.css?v=1533913284\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":2670,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `icon_rybriki_normal.png`; SHA-256 `403f055d841332e37c429d5a4f0699e95a960529853388d36e4ef51e4309ebd0`; size 2269 bytes\n SHA-1: `ed058a2017ceab4266d90bb3ba0f007ebc88fdb9`; MD5: `6262d68808f821fa7d075c9755bb32ad`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":44024,\"response_frame\":44210,\"server_ip\":\"103.5.149.72\",\"status_code\":\"200\",\"tcp_stream\":1130,\"url\":\"http://tass.com/images/newStyle/normal/icon_rybriki_normal.png\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":2269,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `infographics-widget.min.css%3fv=1533913284`; SHA-256 `7a788d144a48f85a8f0ffd046f90c7ae89208a52463f9e5ba27833ab2085a291`; size 2258 bytes\n SHA-1: `f695fe243bbe9e787828626ce5a3e7b0233d0a50`; MD5: `303ab92bf22367aeef7af0db00338020`; completeness: unknown; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":46420,\"response_frame\":46572,\"server_ip\":\"103.5.149.72\",\"status_code\":\"200\",\"tcp_stream\":1073,\"url\":\"http://tass.com/assets/8b982e6a/infographics-widget.min.css?v=1533913284\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":2258,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `logo_futter_web_eng.png`; SHA-256 `c6e69e2ac48274e5650b25984db96e9b8c85f8c92941900207abb3d41b423cf7`; size 2093 bytes\n SHA-1: `6f2e029a494428a3d94c142d9dee796fa5bb0e68`; MD5: `7dd31bddca0173f495a3c776d177dd45`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":44072,\"response_frame\":44237,\"server_ip\":\"103.5.149.72\",\"status_code\":\"200\",\"tcp_stream\":1070,\"url\":\"http://tass.com/images/newStyle/normal/logo/logo_futter_web_eng.png\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":2093,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `up-button.png`; SHA-256 `1b416e5dd993831d9e9f5073f76034d5d1485b7eeec0be5c57c3c408b9ca8f14`; size 1816 bytes\n SHA-1: `52e2dec4b7ab7c459415bb7d01374c12cf2263c6`; MD5: `1cfbc1251d3b3f4385c05bcf196b8a3b`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":43877,\"response_frame\":44070,\"server_ip\":\"103.5.149.72\",\"status_code\":\"200\",\"tcp_stream\":1070,\"url\":\"http://tass.com/i/up-button.png\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":1816,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `zoom.min.css%3fv=1533913284`; SHA-256 `9346b79af539d6aa4f72a0499ca1459c42e1a6e2becf0d015ba2f4237f0a9eab`; size 1705 bytes\n SHA-1: `7da8685ebbde72afc645f5c8bca7812fde07aee7`; MD5: `9d5eaf88f27a1003c8637933daf4c127`; completeness: unknown; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":40510,\"response_frame\":41029,\"server_ip\":\"103.5.149.72\",\"status_code\":\"200\",\"tcp_stream\":1074,\"url\":\"http://tass.com/assets/f64f6e6a/zoom.min.css?v=1533913284\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":1705,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `photoModeController.js%3fv=1533913284`; SHA-256 `25af58ca16a2bfb18ae772716df14b4c656b39ccdcb4b9fae9bca1634e505007`; size 1519 bytes\n SHA-1: `e19e82610c7e7d2f6978fc1e5e4623fbe98d18e9`; MD5: `1afb65947db02362da5584d8de8b5aaa`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":41791,\"response_frame\":42246,\"server_ip\":\"103.5.149.72\",\"status_code\":\"200\",\"tcp_stream\":1073,\"url\":\"http://tass.com/js/common/photoModeController.js?v=1533913284\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":1519,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `ru_en.png`; SHA-256 `a1dbd5350e586eab4363644e8a82826a3032bc4f83694543d50fb6498ea6e82e`; size 1440 bytes\n SHA-1: `a3f1074d3b330e2b4aed181b292a7d44762deedf`; MD5: `06bf4996c9a848232b657a41bf1e5741`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":43710,\"response_frame\":43970,\"server_ip\":\"103.5.149.72\",\"status_code\":\"200\",\"tcp_stream\":1073,\"url\":\"http://tass.com/images/newStyle/normal/ru_en.png\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":1440,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `COMODORSAAddTrustCA(1).crt`; SHA-256 `4f32d5dc00f715250abcc486511e37f501a899deb3bf7ea8adbbd3aef1c412da`; size 1400 bytes\n SHA-1: `f5ad0bcc1ad56cd150725b1c866c30ad92ef21b0`; MD5: `1edaf9ae99ce2920667d0e9a8b3f8c9c`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":11487,\"response_frame\":11594,\"server_ip\":\"104.16.90.188\",\"status_code\":\"200\",\"tcp_stream\":296,\"url\":\"http://crt.comodoca.com/COMODORSAAddTrustCA.crt\"},{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":11488,\"response_frame\":11602,\"server_ip\":\"104.16.90.188\",\"status_code\":\"200\",\"tcp_stream\":297,\"url\":\"http://crt.comodoca.com/COMODORSAAddTrustCA.crt\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":1400,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `mobile-search-header.png`; SHA-256 `44509da8c1e070e58d174497add5449046af4bd1a1b62aa38152d73c9372a394`; size 1303 bytes\n SHA-1: `38984430423e1fdec361fc4d50366f684f2cbcfc`; MD5: `c6daa488f4011314bc7afb896010a999`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":43851,\"response_frame\":44021,\"server_ip\":\"103.5.149.72\",\"status_code\":\"200\",\"tcp_stream\":1130,\"url\":\"http://tass.com/i/mobile-search-header.png\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":1303,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `x(1).cer`; SHA-256 `d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb`; size 1302 bytes\n SHA-1: `363e4734f757bdeb89868efe94907774a327695e`; MD5: `55540a230bdab55187a841cfe1aa1545`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":6267,\"response_frame\":6283,\"server_ip\":\"13.33.78.186\",\"status_code\":\"200\",\"tcp_stream\":158,\"url\":\"http://x.ss2.us/x.cer\"},{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":6271,\"response_frame\":6292,\"server_ip\":\"13.33.78.186\",\"status_code\":\"200\",\"tcp_stream\":159,\"url\":\"http://x.ss2.us/x.cer\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":1302,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `lenta.png`; SHA-256 `67dcf7446d48b5a0cb944a63bd3b69470cc6a48c024223aeff0252cc5b4f11b5`; size 1258 bytes\n SHA-1: `1354734e7286c0b6705883e97908e934ae597763`; MD5: `beaf89c1764833e0d952aa067ae54020`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":43996,\"response_frame\":44181,\"server_ip\":\"103.5.149.72\",\"status_code\":\"200\",\"tcp_stream\":1133,\"url\":\"http://tass.com/images/newStyle/normal/lenta.png\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":1258,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `DigiCertSHA2SecureServerCA(1).crt`; SHA-256 `154c433c491929c5ef686e838e323664a00e6a0d822ccc958fb4dab03e49a08f`; size 1176 bytes\n SHA-1: `1fb86b1168ec743154062e8c9cc5b171a4b7ccb4`; MD5: `345eff15b7a49add451b65a7f4bdc6ae`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":23982,\"response_frame\":24000,\"server_ip\":\"104.16.240.184\",\"status_code\":\"200\",\"tcp_stream\":665,\"url\":\"http://cacerts.digicert.com/DigiCertSHA2SecureServerCA.crt\"},{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":23985,\"response_frame\":24005,\"server_ip\":\"104.16.240.184\",\"status_code\":\"200\",\"tcp_stream\":664,\"url\":\"http://cacerts.digicert.com/DigiCertSHA2SecureServerCA.crt\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":1176,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `STCA(1).crt`; SHA-256 `f1c1b50ae5a20dd8030ec9f6bc24823dd367b5255759b4e71b61fce9f7375d73`; size 956 bytes\n SHA-1: `8782c6c304353bcfd29692d2593e7d44d934ff11`; MD5: `dc32c3a76d2557c768099dea2da9a2d1`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":5383,\"response_frame\":5394,\"server_ip\":\"23.43.176.205\",\"status_code\":\"200\",\"tcp_stream\":127,\"url\":\"http://ssl.trustwave.com/issuers/STCA.crt\"},{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":5387,\"response_frame\":5408,\"server_ip\":\"23.43.176.205\",\"status_code\":\"200\",\"tcp_stream\":128,\"url\":\"http://ssl.trustwave.com/issuers/STCA.crt\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":956,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `cards.min.css%3fv=1533913284`; SHA-256 `d9e7bfb8aeed3257872096e5f7f09eb683adb4541c0fca3446823bea4a7c2168`; size 952 bytes\n SHA-1: `1b9fe56555d38031a4705347e6691bfb4fd18e76`; MD5: `24e12b787ce78800a491cb12490de45f`; completeness: unknown; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":40518,\"response_frame\":41028,\"server_ip\":\"103.5.149.72\",\"status_code\":\"200\",\"tcp_stream\":1072,\"url\":\"http://tass.com/assets/a6d7cd43/cards.min.css?v=1533913284\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":952,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `getCurrencyDynamics%3fcurrency=USD`; SHA-256 `b824ce476646a4ea83e2e7b3ccff9864cb702bf597c05656a470ec609954f9db`; size 932 bytes\n SHA-1: `46dc3150acd7c1544e9a50b1bf16b10f4cd1cab7`; MD5: `e6950e5bd3ba4c82577c3db1769f1005`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":44239,\"response_frame\":44424,\"server_ip\":\"103.5.149.72\",\"status_code\":\"200\",\"tcp_stream\":1070,\"url\":\"http://tass.com/site/getCurrencyDynamics?currency=USD\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":932,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `DF3C24F9BFD666761B268073FE06D1CC8D4F82A4(1).crt`; SHA-256 `cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f`; size 914 bytes\n SHA-1: `df3c24f9bfd666761b268073fe06d1cc8d4f82a4`; MD5: `e4a68ac854ac5242460afd72481b2a44`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":28015,\"response_frame\":28032,\"server_ip\":\"13.107.4.50\",\"status_code\":\"200\",\"tcp_stream\":773,\"url\":\"http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/DF3C24F9BFD666761B268073FE06D1CC8D4F82A4.crt\"},{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":28018,\"response_frame\":28033,\"server_ip\":\"13.107.4.50\",\"status_code\":\"200\",\"tcp_stream\":774,\"url\":\"http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/DF3C24F9BFD666761B268073FE06D1CC8D4F82A4.crt\"},{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":28026,\"response_frame\":28036,\"server_ip\":\"13.107.4.50\",\"status_code\":\"200\",\"tcp_stream\":775,\"url\":\"http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/DF3C24F9BFD666761B268073FE06D1CC8D4F82A4.crt\"},{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":28030,\"response_frame\":28042,\"server_ip\":\"13.107.4.50\",\"status_code\":\"200\",\"tcp_stream\":776,\"url\":\"http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/DF3C24F9BFD666761B268073FE06D1CC8D4F82A4.crt\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":914,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `dstrootcax3(1).p7c`; SHA-256 `a2ce3a0fa7d2a833d1801e01ec48e35b70d84f3467cc9f8fab370386e13879c7`; size 893 bytes\n SHA-1: `b06f409fa14bab33cbaf4a37811b8740b624d9e5`; MD5: `d4ae187b4574036c2d76b6df8a8c1a30`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":8633,\"response_frame\":8679,\"server_ip\":\"192.35.177.64\",\"status_code\":\"200\",\"tcp_stream\":218,\"url\":\"http://apps.identrust.com/roots/dstrootcax3.p7c\"},{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":8637,\"response_frame\":8684,\"server_ip\":\"192.35.177.64\",\"status_code\":\"200\",\"tcp_stream\":217,\"url\":\"http://apps.identrust.com/roots/dstrootcax3.p7c\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":893,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `D69B561148F01C77C54578C10926DF5B856976AD(1).crt`; SHA-256 `cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b`; size 867 bytes\n SHA-1: `d69b561148f01c77c54578c10926df5b856976ad`; MD5: `c5dfb849ca051355ee2dba1ac33eb028`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":4350,\"response_frame\":4385,\"server_ip\":\"198.70.71.144\",\"status_code\":\"200\",\"tcp_stream\":103,\"url\":\"http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/D69B561148F01C77C54578C10926DF5B856976AD.crt\"},{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":4331,\"response_frame\":4388,\"server_ip\":\"198.70.71.144\",\"status_code\":\"200\",\"tcp_stream\":104,\"url\":\"http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/D69B561148F01C77C54578C10926DF5B856976AD.crt\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":867,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `strelka.png`; SHA-256 `09c4d94ef1b017b75ff5e2b9e68bcab620ec852cde6b08b21fb46f6d3ce8c904`; size 559 bytes\n SHA-1: `ab4ea130feaed2f99938a8cc51e1b88bb7daa77a`; MD5: `eaa78e267333ef380ef2941ae076e7dc`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":43853,\"response_frame\":44032,\"server_ip\":\"103.5.149.72\",\"status_code\":\"200\",\"tcp_stream\":1072,\"url\":\"http://tass.com/images/newStyle/normal/strelka.png\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":559,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `rss_futter_norma_1.png`; SHA-256 `f379ea3023b93c6e5d2fe2945774dcf7c85a116326d9eb8f3274de541403811b`; size 470 bytes\n SHA-1: `3fff16ae13e4525718d0211a098fb9049189b778`; MD5: `c46093607b0006277fb918ed6ec7b190`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":44172,\"response_frame\":44283,\"server_ip\":\"103.5.149.72\",\"status_code\":\"200\",\"tcp_stream\":1073,\"url\":\"http://tass.com/images/newStyle/normal/social/rss_futter_norma_1.png\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":470,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `dot(2).php`; SHA-256 `d84fb0e64ee9f712fb6a808e9caa959903068ae7d7805bd0ce5f4782a37422f4`; size 418 bytes\n SHA-1: `a7bd7af18e7b3877b51809ee639c090b59b701cf`; MD5: `7901c7f0ed0c4263b24f4a1743e893ed`; completeness: unknown; transfers: `[]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `g+_top_norma.png`; SHA-256 `f59b3fd3d4f882d5c2154e3b8aa5e535416a696f482996ec2a134e7a6978c333`; size 380 bytes\n SHA-1: `78852bec039936cda1b676acca2cd71e1769cbf6`; MD5: `412c88cc441bae0ac0912e78d1e82eb2`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":43706,\"response_frame\":43875,\"server_ip\":\"103.5.149.72\",\"status_code\":\"200\",\"tcp_stream\":1070,\"url\":\"http://tass.com/images/newStyle/normal/social/g+_top_norma.png\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":380,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `tw_futter_norma_1.png`; SHA-256 `9a3425a07bbde19cc69878e803f30c78d60b61f49049265a20a01841a1028350`; size 370 bytes\n SHA-1: `04ee5cfdf917a0d7501b5d0c58f62e9b64e4091f`; MD5: `b7bef6ac289d3fc503a31804815669bb`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":44226,\"response_frame\":44410,\"server_ip\":\"103.5.149.72\",\"status_code\":\"200\",\"tcp_stream\":1072,\"url\":\"http://tass.com/images/newStyle/normal/social/tw_futter_norma_1.png\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":370,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `RSS.png`; SHA-256 `f2addf74a79c54d648ed7d227042c992f8d500dd95f072528f9e55c168cf97ad`; size 369 bytes\n SHA-1: `ad99166da001425cdecb70b7c8c8eab58c41bbe0`; MD5: `a3e4cfad394aaee75516cba58f9c9ff8`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":43708,\"response_frame\":43990,\"server_ip\":\"103.5.149.72\",\"status_code\":\"200\",\"tcp_stream\":1133,\"url\":\"http://tass.com/images/newStyle/normal/RSS.png\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":369,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `mainSliderWidget.js`; SHA-256 `8bf7a76576baee734a750ad21b0a8a583de9ef4312e41f7043594910e6649eed`; size 350 bytes\n SHA-1: `c3f373af5477d39ce1da8a95b8cc4c4fbf6334c3`; MD5: `a767e92ff5de2afe0eb81337fb9b97fd`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":42488,\"response_frame\":42903,\"server_ip\":\"103.5.149.72\",\"status_code\":\"200\",\"tcp_stream\":1135,\"url\":\"http://tass.com/js/mainSliderWidget.js\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":350,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `tw_top_norma_1.png`; SHA-256 `03a8abd21deffa815518744425ed7da2e391745f22d80ecd2a98ece7e42644e3`; size 325 bytes\n SHA-1: `e1d7fc4842ed78d862411eb31e2974b1f1dd31d9`; MD5: `2554f2eaae1fe4637076850eedd270f5`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":43704,\"response_frame\":43847,\"server_ip\":\"103.5.149.72\",\"status_code\":\"200\",\"tcp_stream\":1130,\"url\":\"http://tass.com/images/newStyle/normal/social/tw_top_norma_1.png\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":325,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `fb_futter_norma_1.png`; SHA-256 `38a2d4f024e57004e2d2324eead0ae08341ea9490151a439d6531132a5d2c2d5`; size 312 bytes\n SHA-1: `c7ac33dbf25180f803a006c8746d43526d0fb95a`; MD5: `7f6c0d0c67ae6fca76e535014b60de8b`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":44220,\"response_frame\":44409,\"server_ip\":\"103.5.149.72\",\"status_code\":\"200\",\"tcp_stream\":1130,\"url\":\"http://tass.com/images/newStyle/normal/social/fb_futter_norma_1.png\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":312,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `fb_top_norma_1.png`; SHA-256 `e56be3ba3f85b78893bce2432a38aad1afda3d3032ee8667589dd44ee9ed0cc1`; size 252 bytes\n SHA-1: `41e5379fa86212bb4c2a1dc6e877fb0e35c51bca`; MD5: `a706c4e5f7653b2f8ddbee153ca18866`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":43702,\"response_frame\":43849,\"server_ip\":\"103.5.149.72\",\"status_code\":\"200\",\"tcp_stream\":1072,\"url\":\"http://tass.com/images/newStyle/normal/social/fb_top_norma_1.png\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":252,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `foto.png`; SHA-256 `025bb8d092d17ec94d16f6a602b61447faf64f3260c93a4650e9b77b9003a3f9`; size 247 bytes\n SHA-1: `b93909fd5d0a6d087430ec105a5c280075cdee8b`; MD5: `905c641583c0979786895ef047f5b12d`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":44034,\"response_frame\":44212,\"server_ip\":\"103.5.149.72\",\"status_code\":\"200\",\"tcp_stream\":1072,\"url\":\"http://tass.com/images/newStyle/normal/foto.png\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":247,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `css%3ffamily=Roboto%3a300`; SHA-256 `8380f10fcacb3780a860531c45384ab3bfdc2ab6a9b8ada7b38551448f69d889`; size 224 bytes\n SHA-1: `a2fc9de59070a66c6071d01d4e51acbcdc147ff3`; MD5: `7e44f257f1a4e4ecb57bbef93c8d28a3`; completeness: unknown; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":44836,\"response_frame\":44998,\"server_ip\":\"216.58.192.10\",\"status_code\":\"200\",\"tcp_stream\":1190,\"url\":\"http://fonts.googleapis.com/css?family=Roboto:300\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":224,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `css%3ffamily=Roboto%3a700`; SHA-256 `96bc02edb88af74dfe132e8341ef9a8694400d86bf0deb6fd93d06591bc5fa8d`; size 222 bytes\n SHA-1: `8e647684ba78be8f043d83adb6bbb0fb144f3391`; MD5: `df93f46c8f3e304a48d8bf67cc9e63e2`; completeness: unknown; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":44840,\"response_frame\":45011,\"server_ip\":\"216.58.192.10\",\"status_code\":\"200\",\"tcp_stream\":1191,\"url\":\"http://fonts.googleapis.com/css?family=Roboto:700\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":222,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `media-widget.min.css%3fv=1533913284`; SHA-256 `f33c27745f2bd87344be790465ef984a972fd539dc83bd4f61d4242c607ef1ee`; size 162 bytes\n SHA-1: `994bc667720c21257500e29038c1a5f61e25da1e`; MD5: `70461da8b94c6ca5d2fda3260c5a8c3b`; completeness: unknown; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":40737,\"response_frame\":41120,\"server_ip\":\"103.5.149.72\",\"status_code\":\"404\",\"tcp_stream\":1071,\"url\":\"http://tass.com/assets/735f4b6e/media-widget.min.css?v=1533913284\"},{\"client_ip\":\"192.168.1.95\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":46347,\"response_frame\":46439,\"server_ip\":\"103.5.149.72\",\"status_code\":\"404\",\"tcp_stream\":1071,\"url\":\"http://tass.com/assets/1d1a4a07/socials.min.css?v=1533913284\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":162,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `rta.js%3fnetId=5895&cookieName=crtg_rta&rnd=74932308510&varName=crtg_content`; SHA-256 `d1b728e19d551b8bc4f3f2d0c12541e7d8950358f95ae31e610b6ab46cb6ec96`; size 144 bytes\n SHA-1: `b475e5fce42033a607bb68dc27581a9751c626c7`; MD5: `5b0e9ae04fbc265788ce295eebdba1c6`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":43682,\"response_frame\":43740,\"server_ip\":\"74.119.117.100\",\"status_code\":\"200\",\"tcp_stream\":1146,\"url\":\"http://rtax.criteo.com/delivery/rta/rta.js?netId=5895&cookieName=crtg_rta&rnd=74932308510&varName=crtg_content\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":144,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `logo;tass.com%3f44.6`; SHA-256 `fa523f248a332cb89ae3ad8cf51d840153e0f96bcc2a4c8db736e02a340dab48`; size 132 bytes\n SHA-1: `f4e06fe8e83c662bb565f175d7de22f51c1e7c9d`; MD5: `0223d80a320a983871bfa82aa6d698ea`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":43748,\"response_frame\":43951,\"server_ip\":\"88.212.196.103\",\"status_code\":\"200\",\"tcp_stream\":1144,\"url\":\"http://counter.yadro.ru/logo;tass.com?44.6\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":132,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `dot(1).php`; SHA-256 `e9d0f873040fb0ee7b073debbc6dfbfdbc80c0c17518d38b04b277a54e5fb275`; size 96 bytes\n SHA-1: `454c44e19a93a7682104c1a200ac3f41c6484244`; MD5: `047e11e670605d6cd66628886f01c062`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":39557,\"response_frame\":39598,\"server_ip\":\"185.68.93.18\",\"status_code\":\"200\",\"tcp_stream\":1036,\"url\":\"http://185.68.93.18/dot.php\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":96,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `dot(10).php`; SHA-256 `aa81dc4dfa58c4040d0e5c08813a963dd3e8a8a16fd1c76ed758e703b62761f2`; size 72 bytes\n SHA-1: `944ec86ead67a2de5ebc96f1f0d6b5faba7352d4`; MD5: `9964273f1fa0123af87efe6c9f67246e`; completeness: unknown; transfers: `[]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `;0.30934944172652073`; SHA-256 `2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363`; size 43 bytes\n SHA-1: `56d45f8a17f5078a20af9962c992ca4678450765`; MD5: `fc94fb0c3ed8a8f909dbc7630a0987ff`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":43744,\"response_frame\":43956,\"server_ip\":\"88.212.196.103\",\"status_code\":\"200\",\"tcp_stream\":1143,\"url\":\"http://counter.yadro.ru/hit;TASS_total?r;s1280*768*24;uhttp%3A//tass.com/;0.30934944172652073\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":43,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `851285090`; SHA-256 `cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda`; size 43 bytes\n SHA-1: `50b30fd5f87c85fe5cba2635cb83316ca71250d7`; MD5: `ad4b0f606e0f8465bc4c4c170b37e1a3`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":43933,\"response_frame\":44151,\"server_ip\":\"194.226.130.228\",\"status_code\":\"200\",\"tcp_stream\":1137,\"url\":\"http://www.tns-counter.ru/V13b***R%3E*itartass_com/ru/UTF-8/tmsec=itartass_total/851285090\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":43,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `dot(3).php`; SHA-256 `e49188fece61523b27d736f94bccb9b04d8a3f018fe0a770fc5cf9b6c734fd0a`; size 24 bytes\n SHA-1: `901e33f73309a93382d459e0931aef38b942870d`; MD5: `0d19bfa42631790bed04cecf0802b114`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":39676,\"response_frame\":39678,\"server_ip\":\"185.68.93.18\",\"status_code\":\"200\",\"tcp_stream\":1046,\"url\":\"http://185.68.93.18/dot.php\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":24,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `authrootseq.txt`; SHA-256 `b3719e3eda456a7457adfe13e6eed36fcef0901b0c31c22cc8ff48629ce8dcee`; size 18 bytes\n SHA-1: `38676d66cea664aad57da9621335fe4e4eba320a`; MD5: `8fbb43e18cec4bd7ce9c695fc9e7d378`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":39486,\"response_frame\":39491,\"server_ip\":\"205.185.216.42\",\"status_code\":\"200\",\"tcp_stream\":1034,\"url\":\"http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":18,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `ncsi.txt`; SHA-256 `6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012`; size 14 bytes\n SHA-1: `33bf88d5b82df3723d5863c7d23445e345828904`; MD5: `cd5a4d3fdd5bffc16bf959ef75cf37bc`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":385,\"response_frame\":387,\"server_ip\":\"198.70.71.161\",\"status_code\":\"200\",\"tcp_stream\":26,\"url\":\"http://www.msftncsi.com/ncsi.txt\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":14,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `dot(11).php`; SHA-256 `1fc3656d141db778f4636a6beb9eb0623e7b2a072ddce6013ed96f44988b78b5`; size 12 bytes\n SHA-1: `755878c2b6007d0684a81907889fbc4b1dc6bcc4`; MD5: `1746e34576d009d1d4f799660eb6de0a`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":39681,\"response_frame\":39683,\"server_ip\":\"185.68.93.18\",\"status_code\":\"200\",\"tcp_stream\":1046,\"url\":\"http://185.68.93.18/dot.php\"},{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":39699,\"response_frame\":39701,\"server_ip\":\"185.68.93.18\",\"status_code\":\"200\",\"tcp_stream\":1047,\"url\":\"http://185.68.93.18/dot.php\"},{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":39712,\"response_frame\":39714,\"server_ip\":\"185.68.93.18\",\"status_code\":\"200\",\"tcp_stream\":1048,\"url\":\"http://185.68.93.18/dot.php\"},{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":39725,\"response_frame\":39727,\"server_ip\":\"185.68.93.18\",\"status_code\":\"200\",\"tcp_stream\":1049,\"url\":\"http://185.68.93.18/dot.php\"},{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":39741,\"response_frame\":39743,\"server_ip\":\"185.68.93.18\",\"status_code\":\"200\",\"tcp_stream\":1050,\"url\":\"http://185.68.93.18/dot.php\"},{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":39754,\"response_frame\":39756,\"server_ip\":\"185.68.93.18\",\"status_code\":\"200\",\"tcp_stream\":1051,\"url\":\"http://185.68.93.18/dot.php\"},{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":39767,\"response_frame\":39769,\"server_ip\":\"185.68.93.18\",\"status_code\":\"200\",\"tcp_stream\":1052,\"url\":\"http://185.68.93.18/dot.php\"},{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":39781,\"response_frame\":39783,\"server_ip\":\"185.68.93.18\",\"status_code\":\"200\",\"tcp_stream\":1053,\"url\":\"http://185.68.93.18/dot.php\"},{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":39796,\"response_frame\":39798,\"server_ip\":\"185.68.93.18\",\"status_code\":\"200\",\"tcp_stream\":1054,\"url\":\"http://185.68.93.18/dot.php\"},{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":39809,\"response_frame\":39811,\"server_ip\":\"185.68.93.18\",\"status_code\":\"200\",\"tcp_stream\":1055,\"url\":\"http://185.68.93.18/dot.php\"},{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":39879,\"response_frame\":39881,\"server_ip\":\"185.68.93.18\",\"status_code\":\"200\",\"tcp_stream\":1057,\"url\":\"http://185.68.93.18/dot.php\"},{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":39895,\"response_frame\":39897,\"server_ip\":\"185.68.93.18\",\"status_code\":\"200\",\"tcp_stream\":1058,\"url\":\"http://185.68.93.18/dot.php\"},{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":39951,\"response_frame\":39959,\"server_ip\":\"185.68.93.18\",\"status_code\":\"200\",\"tcp_stream\":1060,\"url\":\"http://185.68.93.18/dot.php\"},{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":39970,\"response_frame\":39972,\"server_ip\":\"185.68.93.18\",\"status_code\":\"200\",\"tcp_stream\":1061,\"url\":\"http://185.68.93.18/dot.php\"},{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":39983,\"response_frame\":39985,\"server_ip\":\"185.68.93.18\",\"status_code\":\"200\",\"tcp_stream\":1062,\"url\":\"http://185.68.93.18/dot.php\"},{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":39996,\"response_frame\":39998,\"server_ip\":\"185.68.93.18\",\"status_code\":\"200\",\"tcp_stream\":1063,\"url\":\"http://185.68.93.18/dot.php\"},{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":40009,\"response_frame\":40011,\"server_ip\":\"185.68.93.18\",\"status_code\":\"200\",\"tcp_stream\":1064,\"url\":\"http://185.68.93.18/dot.php\"},{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":40022,\"response_frame\":40024,\"server_ip\":\"185.68.93.18\",\"status_code\":\"200\",\"tcp_stream\":1065,\"url\":\"http://185.68.93.18/dot.php\"},{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":40038,\"response_frame\":40040,\"server_ip\":\"185.68.93.18\",\"status_code\":\"200\",\"tcp_stream\":1066,\"url\":\"http://185.68.93.18/dot.php\"},{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":40051,\"response_frame\":40053,\"server_ip\":\"185.68.93.18\",\"status_code\":\"200\",\"tcp_stream\":1067,\"url\":\"http://185.68.93.18/dot.php\"},{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":40064,\"response_frame\":40066,\"server_ip\":\"185.68.93.18\",\"status_code\":\"200\",\"tcp_stream\":1068,\"url\":\"http://185.68.93.18/dot.php\"},{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":40078,\"response_frame\":40080,\"server_ip\":\"185.68.93.18\",\"status_code\":\"200\",\"tcp_stream\":1069,\"url\":\"http://185.68.93.18/dot.php\"},{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":43076,\"response_frame\":43398,\"server_ip\":\"185.68.93.18\",\"status_code\":\"200\",\"tcp_stream\":1136,\"url\":\"http://185.68.93.18/dot.php\"},{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":46895,\"response_frame\":46902,\"server_ip\":\"185.68.93.18\",\"status_code\":\"200\",\"tcp_stream\":1228,\"url\":\"http://185.68.93.18/dot.php\"},{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":46979,\"response_frame\":46981,\"server_ip\":\"185.68.93.18\",\"status_code\":\"200\",\"tcp_stream\":1231,\"url\":\"http://185.68.93.18/dot.php\"},{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":47000,\"response_frame\":47002,\"server_ip\":\"185.68.93.18\",\"status_code\":\"200\",\"tcp_stream\":1232,\"url\":\"http://185.68.93.18/dot.php\"},{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":47020,\"response_frame\":47022,\"server_ip\":\"185.68.93.18\",\"status_code\":\"200\",\"tcp_stream\":1233,\"url\":\"http://185.68.93.18/dot.php\"},{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":47112,\"response_frame\":47115,\"server_ip\":\"185.68.93.18\",\"status_code\":\"200\",\"tcp_stream\":1234,\"url\":\"http://185.68.93.18/dot.php\"},{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":47140,\"response_frame\":47142,\"server_ip\":\"185.68.93.18\",\"status_code\":\"200\",\"tcp_stream\":1235,\"url\":\"http://185.68.93.18/dot.php\"},{\"client_ip\":\"192.168.1.95\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":47152,\"response_frame\":47155,\"server_ip\":\"185.68.93.18\",\"status_code\":\"200\",\"tcp_stream\":1236,\"url\":\"http://185.68.93.18/dot.php\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":12,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `1.rar`; SHA-256 `d4735e3a265e16eee03f59718b9b5d03019c07d8b6c51f90da3a666eec13ab35`; size 1 bytes\n SHA-1: `da4b9237bacccdf19c0760cab7aec4a8359010b0`; MD5: `c81e728d9d4c2f636f067f89cc14862c`; completeness: unknown; transfers: `[]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n\n## Actor similarity leads\n\n- Orangeworm (G0071): 33% TTP overlap. This is an investigation lead, not attribution.\n- Metador (G1013): 22% TTP overlap. This is an investigation lead, not attribution.\n- Rancor (G0075): 22% TTP overlap. This is an investigation lead, not attribution.\n- SilverTerrier (G0083): 20% TTP overlap. This is an investigation lead, not attribution.\n- RedEcho (G1042): 17% TTP overlap. This is an investigation lead, not attribution.\n- APT18 (G0026): 17% TTP overlap. This is an investigation lead, not attribution.\n- Volatile Cedar (G0123): 17% TTP overlap. This is an investigation lead, not attribution.\n- TA551 (G0127): 14% TTP overlap. This is an investigation lead, not attribution.\n- Winnti Group (G0044): 14% TTP overlap. This is an investigation lead, not attribution.\n- Ajax Security Team (G0130): 14% TTP overlap. This is an investigation lead, not attribution.\n\n## Local enrichment and correlations\n\nNo match means unknown in this corpus. Local CTI may postdate the capture. Matches and shared infrastructure require review; no automatic promotion or attribution.\nSnapshot: `1cc9263973d160d702ecb33226cfcf15dda3096212aafa2210225d8a92346c69`; recorded 2026-09-22T16:10:05.666009+00:00; mode: local-only.\nCoverage: `{\"matched_observables\":0,\"no_exact_match\":1459,\"observable_limit\":5000,\"observables_checked\":1459,\"observables_total\":1459,\"prior_case_limit_reached\":true,\"prior_cases_checked\":50,\"truncated\":false}`\n\n- Catalog T1071.001: https://attack.mitre.org/techniques/T1071/001; detection strategies: [{\"attack_id\":\"DET0027\",\"name\":\"Detection of Web Protocol-Based C2 Over HTTP, HTTPS, or WebSockets\",\"stix_id\":\"x-mitre-detection-strategy--e6496b9b-2458-4616-9712-a7c0da7fd3bc\"}]\n- Catalog T1105: https://attack.mitre.org/techniques/T1105; detection strategies: [{\"attack_id\":\"DET0060\",\"name\":\"Detect Ingress Tool Transfers via Behavioral Chain\",\"stix_id\":\"x-mitre-detection-strategy--67677c4c-5778-49eb-ae74-1920645b8554\"}]\n- Prior analysis `0e0621ff-1831-43a5-b884-8ae7b2febaf3` shares 4 observations. This does not establish a common campaign.\n- Prior analysis `403cf219-db40-48ee-8a71-311000d90bfa` shares 9 observations. This does not establish a common campaign.\n- Prior analysis `bf107971-6797-4f93-9ffc-1301c6363bd9` shares 35 observations. This does not establish a common campaign.\n- Prior analysis `0c443755-98f4-45dd-a9c4-e04e0415fe14` shares 140 observations. This does not establish a common campaign.\n- Prior analysis `f4c6d05d-a600-4616-9c66-c96965645a65` shares 7 observations. This does not establish a common campaign.\n- Prior analysis `5bff54cd-16de-44cb-a009-c88818ce138f` shares 20 observations. This does not establish a common campaign.\n- Prior analysis `bd9602ed-341a-4123-aae3-9fafa5731518` shares 6 observations. This does not establish a common campaign.\n- Prior analysis `0bb7a995-231c-4046-95ec-acea419eb7b4` shares 14 observations. This does not establish a common campaign.\n- Prior analysis `d4027bcf-0ef6-4e3c-a68a-68dfe35adb33` shares 5 observations. This does not establish a common campaign.\n- Prior analysis `8879e360-655c-4073-beb9-68018699a4d4` shares 34 observations. This does not establish a common campaign.\n- Prior analysis `961bdc9a-7460-440f-a246-f55748149bcc` shares 13 observations. This does not establish a common campaign.\n- Prior analysis `1c2e6d58-c62a-4009-939b-3aa82de281a2` shares 8 observations. This does not establish a common campaign.\n- Prior analysis `76f521c2-4e4a-41d5-95ad-a44fd9887dd8` shares 64 observations. This does not establish a common campaign.\n- Prior analysis `fa0da8be-03fb-404d-a526-6c99c6b4f000` shares 106 observations. This does not establish a common campaign.\n- Prior analysis `05851801-c224-489b-b9da-9e5d035c60b4` shares 13 observations. This does not establish a common campaign.\n- Prior analysis `d9aa0de8-e06d-40b7-bffc-2e1af3c53ea0` shares 10 observations. This does not establish a common campaign.\n- Prior analysis `246dbce6-c561-4434-bedb-dd496ba758d2` shares 51 observations. This does not establish a common campaign.\n- Prior analysis `c66676ab-7276-4989-8c27-65017a63c2ba` shares 157 observations. This does not establish a common campaign.\n- Prior analysis `476c88cb-8e1a-42e4-a8bd-e2ad2e63b0cd` shares 2 observations. This does not establish a common campaign.\n- Prior analysis `044c22d0-fd65-4c60-8644-c22ff5e1b31c` shares 6 observations. This does not establish a common campaign.\n- Prior analysis `73129515-519f-4544-905f-145c9d2de3d8` shares 3 observations. This does not establish a common campaign.\n- Prior analysis `5ddffc9a-7544-4749-b7bc-17ad98beaadb` shares 6 observations. This does not establish a common campaign.\n- Prior analysis `fc2de8b3-a6ce-4024-9d9b-5602034db53d` shares 6 observations. This does not establish a common campaign.\n- Prior analysis `b12014b8-9e64-4e70-bdb8-90620d23ac22` shares 8 observations. This does not establish a common campaign.\n- Prior analysis `ada03a66-9d3d-4c08-b448-f9758ac8bac5` shares 5 observations. This does not establish a common campaign.\n- Prior analysis `0b13588f-0835-4e15-9f97-8a9411ad7f7f` shares 10 observations. This does not establish a common campaign.\n- Prior analysis `92de15ed-01f0-4a43-8105-a56b60130430` shares 8 observations. This does not establish a common campaign.\n- Prior analysis `fdf1584a-1c2d-4a49-92b2-8dcb98436eb0` shares 5 observations. This does not establish a common campaign.\n- Prior analysis `fab22e38-ca53-4105-924e-f5722b5f53fe` shares 7 observations. This does not establish a common campaign.\n- External provider queries: 0. Not requested; no unknown indicator is classified as benign.\n\n## Coverage and limitations\n\n- Packet and protocol facts are deterministic for the recorded analyzer manifest.\n- Encrypted application payloads are not decrypted; only available metadata is reported.\n- ATT&CK mappings and actor overlaps are candidates until analyst review and promotion.\n- HTTP object inventory: `{\"compact_objects\":0,\"complete\":true,\"detailed_objects\":110,\"export_status\":\"completed\",\"exported_objects\":183,\"hashed_bytes\":2856790,\"hashed_objects\":183,\"omitted_unique_hashes\":0,\"returned_unique_hashes\":110,\"selection\":\"content-classified first, then size descending, SHA256 tie-break; deduplicated by full hash; overflow retains a compact hash index\",\"unhashed_objects\":0,\"unique_hashes\":110}`. Compact overflow hashes are retained in JSON coverage and observables.\n- A directory subject is not necessarily a logged-in user; consult identity bindings in the JSON evidence.\n- Rendered / available: findings 45/45, identities 4/4, observables 500/1459, artifacts 110/110. Full returned inventory is in the JSON result.\n\n## Evidence-backed IOC assessment\n\n1453 typed observations; 3 evidence-backed IOC candidates for review, including 0 with direct malicious provider reports. No automatic confirmation or attribution.\n\nPolicy: `pcap-assessment-v3`; assessment SHA-256: `0e1fea8bce86de870206b4f28ffc2ca67ce29b6547f4ad0bd73880177ea3ff01`.\n\n- ipv4 `185.68.93.18` — suspicious; evidence: `[{\"finding_id\":\"finding-8798192d6b4571d1d4d40028\",\"frame_number\":39557,\"kind\":\"behavior\",\"rule_id\":\"periodic-http-callbacks\"},{\"finding_id\":\"finding-8798192d6b4571d1d4d40028\",\"frame_number\":39676,\"kind\":\"behavior\",\"rule_id\":\"periodic-http-callbacks\"},{\"finding_id\":\"finding-8798192d6b4571d1d4d40028\",\"frame_number\":39681,\"kind\":\"behavior\",\"rule_id\":\"periodic-http-callbacks\"},{\"finding_id\":\"finding-8798192d6b4571d1d4d40028\",\"frame_number\":39699,\"kind\":\"behavior\",\"rule_id\":\"periodic-http-callbacks\"},{\"finding_id\":\"finding-8798192d6b4571d1d4d40028\",\"frame_number\":39712,\"kind\":\"behavior\",\"rule_id\":\"periodic-http-callbacks\"},{\"finding_id\":\"finding-8798192d6b4571d1d4d40028\",\"frame_number\":39725,\"kind\":\"behavior\",\"rule_id\":\"periodic-http-callbacks\"},{\"finding_id\":\"finding-8798192d6b4571d1d4d40028\",\"frame_number\":39741,\"kind\":\"behavior\",\"rule_id\":\"periodic-http-callbacks\"},{\"finding_id\":\"finding-8798192d6b4571d1d4d40028\",\"frame_number\":39754,\"kind\":\"behavior\",\"rule_id\":\"periodic-http-callbacks\"},{\"finding_id\":\"finding-8798192d6b4571d1d4d40028\",\"frame_number\":39767,\"kind\":\"behavior\",\"rule_id\":\"periodic-http-callbacks\"},{\"finding_id\":\"finding-8798192d6b4571d1d4d40028\",\"frame_number\":39781,\"kind\":\"behavior\",\"rule_id\":\"periodic-http-callbacks\"},{\"finding_id\":\"finding-8798192d6b4571d1d4d40028\",\"frame_number\":39796,\"kind\":\"behavior\",\"rule_id\":\"periodic-http-callbacks\"},{\"finding_id\":\"finding-8798192d6b4571d1d4d40028\",\"frame_number\":39809,\"kind\":\"behavior\",\"rule_id\":\"periodic-http-callbacks\"},{\"finding_id\":\"finding-8798192d6b4571d1d4d40028\",\"frame_number\":39879,\"kind\":\"behavior\",\"rule_id\":\"periodic-http-callbacks\"},{\"finding_id\":\"finding-8798192d6b4571d1d4d40028\",\"frame_number\":39895,\"kind\":\"behavior\",\"rule_id\":\"periodic-http-callbacks\"},{\"finding_id\":\"finding-8798192d6b4571d1d4d40028\",\"frame_number\":39951,\"kind\":\"behavior\",\"rule_id\":\"periodic-http-callbacks\"},{\"finding_id\":\"finding-8798192d6b4571d1d4d40028\",\"frame_number\":39970,\"kind\":\"behavior\",\"rule_id\":\"periodic-http-callbacks\"},{\"finding_id\":\"finding-8798192d6b4571d1d4d40028\",\"frame_number\":39983,\"kind\":\"behavior\",\"rule_id\":\"periodic-http-callbacks\"},{\"finding_id\":\"finding-8798192d6b4571d1d4d40028\",\"frame_number\":39996,\"kind\":\"behavior\",\"rule_id\":\"periodic-http-callbacks\"},{\"finding_id\":\"finding-8798192d6b4571d1d4d40028\",\"frame_number\":40009,\"kind\":\"behavior\",\"rule_id\":\"periodic-http-callbacks\"},{\"finding_id\":\"finding-8798192d6b4571d1d4d40028\",\"frame_number\":40022,\"kind\":\"behavior\",\"rule_id\":\"periodic-http-callbacks\"}]`; provider signals: `[{\"actors\":[],\"basis\":\"No verdict: not-applicable\",\"cache_hit\":false,\"context_status\":\"provider-assertion-not-capture-behavior-or-attribution\",\"evidence\":{},\"queried_at\":\"2026-09-22T17:48:52.654243+00:00\",\"relationship_context\":[],\"source\":\"malwarebazaar\",\"status\":\"not-applicable\",\"technique_ids\":[],\"verdict\":\"unknown\"},{\"actors\":[],\"basis\":\"No verdict: not_found\",\"cache_hit\":false,\"context_status\":\"provider-assertion-not-capture-behavior-or-attribution\",\"evidence\":{},\"queried_at\":\"2026-09-22T17:48:52.460656+00:00\",\"relationship_context\":[],\"source\":\"threatfox\",\"status\":\"not_found\",\"technique_ids\":[],\"verdict\":\"unknown\"},{\"actors\":[],\"basis\":\"No verdict: deferred-rate-limit\",\"cache_hit\":false,\"context_status\":\"provider-assertion-not-capture-behavior-or-attribution\",\"cooldown_scope\":\"shared-redis\",\"error_category\":\"rate_limited\",\"evidence\":{},\"queried_at\":\"2026-09-22T17:48:52.458085+00:00\",\"relationship_context\":[],\"retry_at\":\"2026-09-22T17:49:29.781117+00:00\",\"source\":\"virustotal\",\"status\":\"deferred-rate-limit\",\"technique_ids\":[],\"verdict\":\"unknown\"}]`\n- sha256 `b908d9b1001d0a39ba92501c086b1c25b05b171eeda035ae9f3e129d2776a314` — suspicious; evidence: `[{\"artifact_id\":\"artifact-b8c70bac7d2ead3799659b33\",\"features\":[\"dynamic-evaluation\",\"powershell-download\"],\"interpretation\":\"Suspicious static features, not execution or malware proof\",\"kind\":\"static-review\"}]`; provider signals: `[{\"actors\":[],\"basis\":\"No verdict: not_found\",\"cache_hit\":false,\"context_status\":\"provider-assertion-not-capture-behavior-or-attribution\",\"evidence\":{},\"queried_at\":\"2026-09-22T17:48:52.845478+00:00\",\"relationship_context\":[],\"source\":\"malwarebazaar\",\"status\":\"not_found\",\"technique_ids\":[],\"verdict\":\"unknown\"},{\"actors\":[],\"basis\":\"No verdict: not_found\",\"cache_hit\":false,\"context_status\":\"provider-assertion-not-capture-behavior-or-attribution\",\"evidence\":{},\"queried_at\":\"2026-09-22T17:48:52.657913+00:00\",\"relationship_context\":[],\"source\":\"threatfox\",\"status\":\"not_found\",\"technique_ids\":[],\"verdict\":\"unknown\"},{\"actors\":[],\"basis\":\"No verdict: deferred-rate-limit\",\"cache_hit\":false,\"context_status\":\"provider-assertion-not-capture-behavior-or-attribution\",\"cooldown_scope\":\"shared-redis\",\"error_category\":\"rate_limited\",\"evidence\":{},\"queried_at\":\"2026-09-22T17:48:52.656090+00:00\",\"relationship_context\":[],\"retry_at\":\"2026-09-22T17:49:29.781117+00:00\",\"source\":\"virustotal\",\"status\":\"deferred-rate-limit\",\"technique_ids\":[],\"verdict\":\"unknown\"}]`\n- url `http://185.68.93.18/dot.php` — suspicious; evidence: `[{\"finding_id\":\"finding-8798192d6b4571d1d4d40028\",\"frame_number\":39557,\"kind\":\"behavior\",\"rule_id\":\"periodic-http-callbacks\"},{\"finding_id\":\"finding-8798192d6b4571d1d4d40028\",\"frame_number\":39676,\"kind\":\"behavior\",\"rule_id\":\"periodic-http-callbacks\"},{\"finding_id\":\"finding-8798192d6b4571d1d4d40028\",\"frame_number\":39681,\"kind\":\"behavior\",\"rule_id\":\"periodic-http-callbacks\"},{\"finding_id\":\"finding-8798192d6b4571d1d4d40028\",\"frame_number\":39699,\"kind\":\"behavior\",\"rule_id\":\"periodic-http-callbacks\"},{\"finding_id\":\"finding-8798192d6b4571d1d4d40028\",\"frame_number\":39712,\"kind\":\"behavior\",\"rule_id\":\"periodic-http-callbacks\"},{\"finding_id\":\"finding-8798192d6b4571d1d4d40028\",\"frame_number\":39725,\"kind\":\"behavior\",\"rule_id\":\"periodic-http-callbacks\"},{\"finding_id\":\"finding-8798192d6b4571d1d4d40028\",\"frame_number\":39741,\"kind\":\"behavior\",\"rule_id\":\"periodic-http-callbacks\"},{\"finding_id\":\"finding-8798192d6b4571d1d4d40028\",\"frame_number\":39754,\"kind\":\"behavior\",\"rule_id\":\"periodic-http-callbacks\"},{\"finding_id\":\"finding-8798192d6b4571d1d4d40028\",\"frame_number\":39767,\"kind\":\"behavior\",\"rule_id\":\"periodic-http-callbacks\"},{\"finding_id\":\"finding-8798192d6b4571d1d4d40028\",\"frame_number\":39781,\"kind\":\"behavior\",\"rule_id\":\"periodic-http-callbacks\"},{\"finding_id\":\"finding-8798192d6b4571d1d4d40028\",\"frame_number\":39796,\"kind\":\"behavior\",\"rule_id\":\"periodic-http-callbacks\"},{\"finding_id\":\"finding-8798192d6b4571d1d4d40028\",\"frame_number\":39809,\"kind\":\"behavior\",\"rule_id\":\"periodic-http-callbacks\"},{\"finding_id\":\"finding-8798192d6b4571d1d4d40028\",\"frame_number\":39879,\"kind\":\"behavior\",\"rule_id\":\"periodic-http-callbacks\"},{\"finding_id\":\"finding-8798192d6b4571d1d4d40028\",\"frame_number\":39895,\"kind\":\"behavior\",\"rule_id\":\"periodic-http-callbacks\"},{\"finding_id\":\"finding-8798192d6b4571d1d4d40028\",\"frame_number\":39951,\"kind\":\"behavior\",\"rule_id\":\"periodic-http-callbacks\"},{\"finding_id\":\"finding-8798192d6b4571d1d4d40028\",\"frame_number\":39970,\"kind\":\"behavior\",\"rule_id\":\"periodic-http-callbacks\"},{\"finding_id\":\"finding-8798192d6b4571d1d4d40028\",\"frame_number\":39983,\"kind\":\"behavior\",\"rule_id\":\"periodic-http-callbacks\"},{\"finding_id\":\"finding-8798192d6b4571d1d4d40028\",\"frame_number\":39996,\"kind\":\"behavior\",\"rule_id\":\"periodic-http-callbacks\"},{\"finding_id\":\"finding-8798192d6b4571d1d4d40028\",\"frame_number\":40009,\"kind\":\"behavior\",\"rule_id\":\"periodic-http-callbacks\"},{\"finding_id\":\"finding-8798192d6b4571d1d4d40028\",\"frame_number\":40022,\"kind\":\"behavior\",\"rule_id\":\"periodic-http-callbacks\"}]`; provider signals: `[]`\n\nOrdinary observations remain in the capture inventory; they are not declared malicious IOCs.\n\nReputation snapshot: `ba08d4b3c86201e6a731df20d81845d1308d8403dfb9c755caafd7b4f17bb89f`; updated 2026-09-22T17:49:09.577235+00:00. Each target retains its query time. Coverage: `{\"active_scans\":0,\"batch_results\":[{\"observable_id\":\"observable-46e299f63770703c45b1fe13\",\"provider\":\"virustotal\",\"status\":\"deferred-rate-limit\"},{\"observable_id\":\"observable-46e299f63770703c45b1fe13\",\"provider\":\"threatfox\",\"status\":\"not_found\"}],\"batch_targets\":1,\"cache_hits\":0,\"full_urls_disclosed\":0,\"payload_uploads\":0,\"provider_lookups_started\":1,\"retained_targets\":81,\"targets_omitted\":0}`.\n- No detections, no record, missing credentials and provider errors do not mean benign.\n- Current reputation may postdate the capture. Shared hosting, DNS resolution and graph overlap do not transfer maliciousness.\n- A recovered file is not proof of execution; hashes identify exported bytes, including partial objects.\n- Public-looking enterprise domains may still be sensitive: review selected targets before external disclosure.\n", "result": { "flows": [ { "bytes": 375, "stream": 0, "flow_id": "flow-5fa12a2b7d4c5684dfd4f531", "packets": 1, "transport": "udp", "last_frame": 1, "first_frame": 1, "initiator_ip": "0.0.0.0", "responder_ip": "255.255.255.255", "initiator_port": 68, "responder_port": 67, "initiator_bytes": 375, "last_seen_epoch": "1533964508.767375", "responder_bytes": 0, "first_seen_epoch": "1533964508.767375" }, { "bytes": 2421, "stream": 1, "flow_id": "flow-5ed33dd5a36d7e0f01765ed3", "packets": 7, "transport": "udp", "last_frame": 40092, "first_frame": 2, "initiator_ip": "192.168.1.254", "responder_ip": "192.168.1.95", "initiator_port": 67, "responder_port": 68, "initiator_bytes": 2052, "last_seen_epoch": "1533965768.477603", "responder_bytes": 369, "first_seen_epoch": "1533964508.776328" }, { "bytes": 146, "stream": 2, "flow_id": "flow-fbee6e766d1a9d124b91a4e6", "packets": 2, "transport": "udp", "last_frame": 11, "first_frame": 5, "initiator_ip": "192.168.1.95", "responder_ip": "224.0.0.252", "initiator_port": 65015, "responder_port": 5355, "initiator_bytes": 146, "last_seen_epoch": "1533964508.886553", "responder_bytes": 0, "first_seen_epoch": "1533964508.786149" }, { "bytes": 231, "stream": 3, "flow_id": "flow-6ec9625180bcedd6568e6779", "packets": 2, "transport": "udp", "last_frame": 7, "first_frame": 6, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 53526, "responder_port": 53, "initiator_bytes": 78, "last_seen_epoch": "1533964508.834117", "responder_bytes": 153, "first_seen_epoch": "1533964508.8339" }, { "bytes": 6000, "stream": 4, "flow_id": "flow-0923d4fc3ac0ff4c3f5900a3", "packets": 57, "transport": "udp", "last_frame": 47010, "first_frame": 8, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.1", "initiator_port": 137, "responder_port": 137, "initiator_bytes": 6000, "last_seen_epoch": "1533965831.770624", "responder_bytes": 0, "first_seen_epoch": "1533964508.857262" }, { "bytes": 262, "stream": 5, "flow_id": "flow-52d661ff0378f1cc47262733", "packets": 2, "transport": "udp", "last_frame": 14, "first_frame": 13, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 61895, "responder_port": 53, "initiator_bytes": 97, "last_seen_epoch": "1533964509.083115", "responder_bytes": 165, "first_seen_epoch": "1533964509.082897" }, { "bytes": 200, "stream": 6, "flow_id": "flow-499d33deedc48fb0a7189f05", "packets": 2, "transport": "udp", "last_frame": 16, "first_frame": 15, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 53976, "responder_port": 53, "initiator_bytes": 92, "last_seen_epoch": "1533964509.08449", "responder_bytes": 108, "first_seen_epoch": "1533964509.084305" }, { "bytes": 146, "stream": 7, "flow_id": "flow-44f773922788a59139ce9186", "packets": 2, "transport": "udp", "last_frame": 23, "first_frame": 17, "initiator_ip": "192.168.1.95", "responder_ip": "224.0.0.252", "initiator_port": 56106, "responder_port": 5355, "initiator_bytes": 146, "last_seen_epoch": "1533964509.187156", "responder_bytes": 0, "first_seen_epoch": "1533964509.086998" }, { "bytes": 458, "stream": 8, "flow_id": "flow-f0371dd39913ad822c378744", "packets": 2, "transport": "udp", "last_frame": 21, "first_frame": 19, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 56108, "responder_port": 389, "initiator_bytes": 214, "last_seen_epoch": "1533964509.089409", "responder_bytes": 244, "first_seen_epoch": "1533964509.089149" }, { "bytes": 458, "stream": 9, "flow_id": "flow-7b8ff78b5315cf8b7cac4936", "packets": 2, "transport": "udp", "last_frame": 22, "first_frame": 20, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 56109, "responder_port": 389, "initiator_bytes": 214, "last_seen_epoch": "1533964509.089655", "responder_bytes": 244, "first_seen_epoch": "1533964509.089407" }, { "bytes": 304, "stream": 10, "flow_id": "flow-6cfe8b624512ea302e4766c7", "packets": 2, "transport": "udp", "last_frame": 25, "first_frame": 24, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 58563, "responder_port": 53, "initiator_bytes": 118, "last_seen_epoch": "1533964509.19191", "responder_bytes": 186, "first_seen_epoch": "1533964509.19154" }, { "bytes": 458, "stream": 11, "flow_id": "flow-a8513491260cc437b3701c3c", "packets": 2, "transport": "udp", "last_frame": 27, "first_frame": 26, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 58564, "responder_port": 389, "initiator_bytes": 214, "last_seen_epoch": "1533964509.194248", "responder_bytes": 244, "first_seen_epoch": "1533964509.193952" }, { "bytes": 6321, "stream": 0, "flow_id": "flow-73f974680315a0c4b919c205", "packets": 21, "transport": "tcp", "last_frame": 397, "first_frame": 28, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 49156, "responder_port": 445, "initiator_bytes": 4601, "last_seen_epoch": "1533964523.221416", "responder_bytes": 1720, "first_seen_epoch": "1533964509.196379" }, { "bytes": 1026, "stream": 1, "flow_id": "flow-bcc212a64d5b5c6424252324", "packets": 8, "transport": "tcp", "last_frame": 42, "first_frame": 35, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 49157, "responder_port": 88, "initiator_bytes": 486, "last_seen_epoch": "1533964509.201882", "responder_bytes": 540, "first_seen_epoch": "1533964509.200342" }, { "bytes": 2487, "stream": 2, "flow_id": "flow-43325bb0b2abe922a7bdff60", "packets": 9, "transport": "tcp", "last_frame": 51, "first_frame": 43, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 49158, "responder_port": 88, "initiator_bytes": 626, "last_seen_epoch": "1533964509.219516", "responder_bytes": 1861, "first_seen_epoch": "1533964509.217954" }, { "bytes": 3863, "stream": 3, "flow_id": "flow-7b73e752eab753224f982744", "packets": 10, "transport": "tcp", "last_frame": 61, "first_frame": 52, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 49159, "responder_port": 88, "initiator_bytes": 1941, "last_seen_epoch": "1533964509.222417", "responder_bytes": 1922, "first_seen_epoch": "1533964509.220864" }, { "bytes": 3559, "stream": 4, "flow_id": "flow-d5bfc8f24dc71f7032badc4d", "packets": 10, "transport": "tcp", "last_frame": 71, "first_frame": 62, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 49160, "responder_port": 88, "initiator_bytes": 1773, "last_seen_epoch": "1533964509.223669", "responder_bytes": 1786, "first_seen_epoch": "1533964509.222617" }, { "bytes": 5385, "stream": 5, "flow_id": "flow-92a8731b7de0a306f6d8f92e", "packets": 11, "transport": "tcp", "last_frame": 100, "first_frame": 80, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 49161, "responder_port": 389, "initiator_bytes": 2509, "last_seen_epoch": "1533964509.295373", "responder_bytes": 2876, "first_seen_epoch": "1533964509.288025" }, { "bytes": 3897, "stream": 6, "flow_id": "flow-e61df30035475147a59e0896", "packets": 10, "transport": "tcp", "last_frame": 95, "first_frame": 86, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 49162, "responder_port": 88, "initiator_bytes": 1959, "last_seen_epoch": "1533964509.292211", "responder_bytes": 1938, "first_seen_epoch": "1533964509.290499" }, { "bytes": 2368, "stream": 7, "flow_id": "flow-70471809271aa985ac778a77", "packets": 17, "transport": "tcp", "last_frame": 6440, "first_frame": 102, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 49163, "responder_port": 135, "initiator_bytes": 1246, "last_seen_epoch": "1533964565.326422", "responder_bytes": 1122, "first_seen_epoch": "1533964509.451349" }, { "bytes": 4556, "stream": 8, "flow_id": "flow-acf1101afb9f6451950798d0", "packets": 20, "transport": "tcp", "last_frame": 537, "first_frame": 109, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 49164, "responder_port": 49158, "initiator_bytes": 2646, "last_seen_epoch": "1533964535.326819", "responder_bytes": 1910, "first_seen_epoch": "1533964509.454276" }, { "bytes": 440, "stream": 12, "flow_id": "flow-7f6cf45a855cc5a66542084c", "packets": 4, "transport": "udp", "last_frame": 39786, "first_frame": 124, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 123, "responder_port": 123, "initiator_bytes": 220, "last_seen_epoch": "1533965534.78722", "responder_bytes": 220, "first_seen_epoch": "1533964509.460157" }, { "bytes": 10816, "stream": 9, "flow_id": "flow-870dbc2f5a48c859fe5f291c", "packets": 35, "transport": "tcp", "last_frame": 6438, "first_frame": 129, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 49165, "responder_port": 49155, "initiator_bytes": 6960, "last_seen_epoch": "1533964565.326091", "responder_bytes": 3856, "first_seen_epoch": "1533964509.59601" }, { "bytes": 1026, "stream": 10, "flow_id": "flow-29ed993a154899f71e983b41", "packets": 8, "transport": "tcp", "last_frame": 139, "first_frame": 132, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 49166, "responder_port": 88, "initiator_bytes": 486, "last_seen_epoch": "1533964509.598061", "responder_bytes": 540, "first_seen_epoch": "1533964509.596686" }, { "bytes": 2487, "stream": 11, "flow_id": "flow-d38f3e2a9601c6ae9859ab84", "packets": 9, "transport": "tcp", "last_frame": 148, "first_frame": 140, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 49167, "responder_port": 88, "initiator_bytes": 626, "last_seen_epoch": "1533964509.617027", "responder_bytes": 1861, "first_seen_epoch": "1533964509.615504" }, { "bytes": 3951, "stream": 12, "flow_id": "flow-12deb1c64eb022813d4cf6c3", "packets": 11, "transport": "tcp", "last_frame": 159, "first_frame": 149, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 49168, "responder_port": 88, "initiator_bytes": 2013, "last_seen_epoch": "1533964509.619145", "responder_bytes": 1938, "first_seen_epoch": "1533964509.617589" }, { "bytes": 347, "stream": 13, "flow_id": "flow-393acc5ea7f68ae216cd05c5", "packets": 2, "transport": "udp", "last_frame": 180, "first_frame": 179, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 54285, "responder_port": 53, "initiator_bytes": 134, "last_seen_epoch": "1533964510.590731", "responder_bytes": 213, "first_seen_epoch": "1533964510.590427" }, { "bytes": 285, "stream": 14, "flow_id": "flow-97353742b965ab5db4845ad7", "packets": 2, "transport": "udp", "last_frame": 182, "first_frame": 181, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 54513, "responder_port": 53, "initiator_bytes": 103, "last_seen_epoch": "1533964510.591649", "responder_bytes": 182, "first_seen_epoch": "1533964510.591407" }, { "bytes": 8034, "stream": 13, "flow_id": "flow-f64ba726465ce139c6ffe9f8", "packets": 16, "transport": "tcp", "last_frame": 281, "first_frame": 183, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 49169, "responder_port": 389, "initiator_bytes": 3316, "last_seen_epoch": "1533964511.138357", "responder_bytes": 4718, "first_seen_epoch": "1533964510.592799" }, { "bytes": 3789, "stream": 14, "flow_id": "flow-7a523cf12e05c2a53648a2b5", "packets": 10, "transport": "tcp", "last_frame": 201, "first_frame": 192, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 49170, "responder_port": 88, "initiator_bytes": 1917, "last_seen_epoch": "1533964510.6027", "responder_bytes": 1872, "first_seen_epoch": "1533964510.601159" }, { "bytes": 3578, "stream": 15, "flow_id": "flow-70316835285c8facdb97ae1d", "packets": 10, "transport": "tcp", "last_frame": 217, "first_frame": 204, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 49171, "responder_port": 88, "initiator_bytes": 1777, "last_seen_epoch": "1533964510.608248", "responder_bytes": 1801, "first_seen_epoch": "1533964510.606113" }, { "bytes": 3351, "stream": 16, "flow_id": "flow-028d49db91b641fa1cae356b", "packets": 12, "transport": "tcp", "last_frame": 277, "first_frame": 209, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 49172, "responder_port": 389, "initiator_bytes": 2483, "last_seen_epoch": "1533964510.62307", "responder_bytes": 868, "first_seen_epoch": "1533964510.607694" }, { "bytes": 3289, "stream": 17, "flow_id": "flow-cb6b0dae02e7a32b3fb1f34f", "packets": 9, "transport": "tcp", "last_frame": 227, "first_frame": 216, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 49173, "responder_port": 88, "initiator_bytes": 2845, "last_seen_epoch": "1533964510.609812", "responder_bytes": 444, "first_seen_epoch": "1533964510.608247" }, { "bytes": 8729, "stream": 18, "flow_id": "flow-d6883b78787489cc4c42ef81", "packets": 33, "transport": "tcp", "last_frame": 1576, "first_frame": 235, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 49174, "responder_port": 445, "initiator_bytes": 5891, "last_seen_epoch": "1533964547.214908", "responder_bytes": 2838, "first_seen_epoch": "1533964510.614661" }, { "bytes": 3863, "stream": 19, "flow_id": "flow-66366f40ed6562f1e6290e1d", "packets": 10, "transport": "tcp", "last_frame": 249, "first_frame": 240, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 49175, "responder_port": 88, "initiator_bytes": 1941, "last_seen_epoch": "1533964510.617133", "responder_bytes": 1922, "first_seen_epoch": "1533964510.615737" }, { "bytes": 3559, "stream": 20, "flow_id": "flow-2991d22bcced9877bc1cf274", "packets": 10, "transport": "tcp", "last_frame": 259, "first_frame": 250, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 49176, "responder_port": 88, "initiator_bytes": 1773, "last_seen_epoch": "1533964510.618302", "responder_bytes": 1786, "first_seen_epoch": "1533964510.617328" }, { "bytes": 146, "stream": 15, "flow_id": "flow-452d724f2388c10a38fc3efa", "packets": 2, "transport": "udp", "last_frame": 296, "first_frame": 287, "initiator_ip": "192.168.1.95", "responder_ip": "224.0.0.252", "initiator_port": 65353, "responder_port": 5355, "initiator_bytes": 146, "last_seen_epoch": "1533964512.189501", "responder_bytes": 0, "first_seen_epoch": "1533964512.086604" }, { "bytes": 1368, "stream": 16, "flow_id": "flow-bf44b9da79fbedd6c0464dae", "packets": 4, "transport": "udp", "last_frame": 40091, "first_frame": 288, "initiator_ip": "192.168.1.95", "responder_ip": "255.255.255.255", "initiator_port": 68, "responder_port": 67, "initiator_bytes": 1368, "last_seen_epoch": "1533965768.477452", "responder_bytes": 0, "first_seen_epoch": "1533964512.090074" }, { "bytes": 241, "stream": 17, "flow_id": "flow-d0b67af3578fdeb031c283dc", "packets": 2, "transport": "udp", "last_frame": 291, "first_frame": 290, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 56663, "responder_port": 53, "initiator_bytes": 81, "last_seen_epoch": "1533964512.093493", "responder_bytes": 160, "first_seen_epoch": "1533964512.093157" }, { "bytes": 227, "stream": 18, "flow_id": "flow-e48f4b67855e4aa49a076f2a", "packets": 2, "transport": "udp", "last_frame": 293, "first_frame": 292, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 52148, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1533964512.094245", "responder_bytes": 151, "first_seen_epoch": "1533964512.094062" }, { "bytes": 128, "stream": 19, "flow_id": "flow-d0049bddf9b36d252c27b9ba", "packets": 2, "transport": "udp", "last_frame": 295, "first_frame": 294, "initiator_ip": "192.168.1.95", "responder_ip": "224.0.0.252", "initiator_port": 56565, "responder_port": 5355, "initiator_bytes": 128, "last_seen_epoch": "1533964512.189494", "responder_bytes": 0, "first_seen_epoch": "1533964512.094564" }, { "bytes": 2976, "stream": 20, "flow_id": "flow-2a3cd1ed9ae77502e9b6a599", "packets": 30, "transport": "udp", "last_frame": 42886, "first_frame": 299, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.255", "initiator_port": 137, "responder_port": 137, "initiator_bytes": 2976, "last_seen_epoch": "1533965777.36695", "responder_bytes": 0, "first_seen_epoch": "1533964513.421398" }, { "bytes": 7144, "stream": 21, "flow_id": "flow-43293a93ce4b5aca7eea9c28", "packets": 19, "transport": "tcp", "last_frame": 373, "first_frame": 314, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 49178, "responder_port": 389, "initiator_bytes": 3369, "last_seen_epoch": "1533964517.047783", "responder_bytes": 3775, "first_seen_epoch": "1533964517.004082" }, { "bytes": 4136, "stream": 22, "flow_id": "flow-3537005fd00ef10c6e68a472", "packets": 12, "transport": "tcp", "last_frame": 371, "first_frame": 331, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 49179, "responder_port": 389, "initiator_bytes": 3308, "last_seen_epoch": "1533964517.047211", "responder_bytes": 828, "first_seen_epoch": "1533964517.017066" }, { "bytes": 200, "stream": 21, "flow_id": "flow-306b3188d892ae24b81b5bcf", "packets": 2, "transport": "udp", "last_frame": 335, "first_frame": 334, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 54789, "responder_port": 53, "initiator_bytes": 92, "last_seen_epoch": "1533964517.019178", "responder_bytes": 108, "first_seen_epoch": "1533964517.018976" }, { "bytes": 1026, "stream": 23, "flow_id": "flow-6eb2b0d863ea597f938ad4b4", "packets": 8, "transport": "tcp", "last_frame": 348, "first_frame": 341, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 49180, "responder_port": 88, "initiator_bytes": 486, "last_seen_epoch": "1533964517.024802", "responder_bytes": 540, "first_seen_epoch": "1533964517.023671" }, { "bytes": 2487, "stream": 24, "flow_id": "flow-8510566cc710727cd9fc44bf", "packets": 9, "transport": "tcp", "last_frame": 357, "first_frame": 349, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 49181, "responder_port": 88, "initiator_bytes": 626, "last_seen_epoch": "1533964517.041004", "responder_bytes": 1861, "first_seen_epoch": "1533964517.039711" }, { "bytes": 3727, "stream": 25, "flow_id": "flow-e08189c65850dfcc43a56577", "packets": 10, "transport": "tcp", "last_frame": 367, "first_frame": 358, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 49182, "responder_port": 88, "initiator_bytes": 1883, "last_seen_epoch": "1533964517.043297", "responder_bytes": 1844, "first_seen_epoch": "1533964517.041801" }, { "bytes": 259, "stream": 22, "flow_id": "flow-2d5f5256c712b8884006f889", "packets": 2, "transport": "udp", "last_frame": 375, "first_frame": 374, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 49764, "responder_port": 53, "initiator_bytes": 90, "last_seen_epoch": "1533964517.089954", "responder_bytes": 169, "first_seen_epoch": "1533964517.089613" }, { "bytes": 316, "stream": 23, "flow_id": "flow-8938ac869dc8ac7439e9c0d7", "packets": 2, "transport": "udp", "last_frame": 377, "first_frame": 376, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 54515, "responder_port": 53, "initiator_bytes": 158, "last_seen_epoch": "1533964517.092165", "responder_bytes": 158, "first_seen_epoch": "1533964517.090941" }, { "bytes": 258, "stream": 24, "flow_id": "flow-b77cabe3b475c7c9c50b11dc", "packets": 2, "transport": "udp", "last_frame": 381, "first_frame": 380, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 50622, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1533964519.500541", "responder_bytes": 182, "first_seen_epoch": "1533964519.258567" }, { "bytes": 870, "stream": 26, "flow_id": "flow-9c724735410fe2072fd74928", "packets": 10, "transport": "tcp", "last_frame": 391, "first_frame": 382, "initiator_ip": "192.168.1.95", "responder_ip": "198.70.71.161", "initiator_port": 49183, "responder_port": 80, "initiator_bytes": 397, "last_seen_epoch": "1533964519.601928", "responder_bytes": 473, "first_seen_epoch": "1533964519.505521" }, { "bytes": 964, "stream": 27, "flow_id": "flow-93d981cccfea5352427cfe6b", "packets": 8, "transport": "tcp", "last_frame": 407, "first_frame": 400, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 49184, "responder_port": 88, "initiator_bytes": 478, "last_seen_epoch": "1533964528.920084", "responder_bytes": 486, "first_seen_epoch": "1533964528.918748" }, { "bytes": 2491, "stream": 28, "flow_id": "flow-62c50e721d7f6e05554124bc", "packets": 9, "transport": "tcp", "last_frame": 416, "first_frame": 408, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 49185, "responder_port": 88, "initiator_bytes": 618, "last_seen_epoch": "1533964528.935273", "responder_bytes": 1873, "first_seen_epoch": "1533964528.93389" }, { "bytes": 3659, "stream": 29, "flow_id": "flow-4f541dda0b9724ac968da491", "packets": 10, "transport": "tcp", "last_frame": 426, "first_frame": 417, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 49186, "responder_port": 88, "initiator_bytes": 1815, "last_seen_epoch": "1533964528.937008", "responder_bytes": 1844, "first_seen_epoch": "1533964528.935577" }, { "bytes": 3961, "stream": 30, "flow_id": "flow-6a558dc7422d16bec2aefa13", "packets": 10, "transport": "tcp", "last_frame": 438, "first_frame": 429, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 49187, "responder_port": 88, "initiator_bytes": 1991, "last_seen_epoch": "1533964528.983364", "responder_bytes": 1970, "first_seen_epoch": "1533964528.981179" }, { "bytes": 347, "stream": 25, "flow_id": "flow-4cef72434cf576a488e2cf40", "packets": 2, "transport": "udp", "last_frame": 455, "first_frame": 454, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 59009, "responder_port": 53, "initiator_bytes": 134, "last_seen_epoch": "1533964529.514781", "responder_bytes": 213, "first_seen_epoch": "1533964529.514518" }, { "bytes": 285, "stream": 26, "flow_id": "flow-1c74e498a782a85750c99a0c", "packets": 2, "transport": "udp", "last_frame": 457, "first_frame": 456, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 64881, "responder_port": 53, "initiator_bytes": 103, "last_seen_epoch": "1533964529.516362", "responder_bytes": 182, "first_seen_epoch": "1533964529.516117" }, { "bytes": 5302, "stream": 31, "flow_id": "flow-c93628d28f63d3692dc2ffe4", "packets": 15, "transport": "tcp", "last_frame": 531, "first_frame": 458, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 49188, "responder_port": 389, "initiator_bytes": 2950, "last_seen_epoch": "1533964530.061557", "responder_bytes": 2352, "first_seen_epoch": "1533964529.518948" }, { "bytes": 3927, "stream": 32, "flow_id": "flow-8526dffcd83502bfb9c6f094", "packets": 10, "transport": "tcp", "last_frame": 470, "first_frame": 461, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 49189, "responder_port": 88, "initiator_bytes": 1973, "last_seen_epoch": "1533964529.526354", "responder_bytes": 1954, "first_seen_epoch": "1533964529.520589" }, { "bytes": 3467, "stream": 33, "flow_id": "flow-96ac6908517548ff70b2065a", "packets": 13, "transport": "tcp", "last_frame": 525, "first_frame": 476, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 49190, "responder_port": 389, "initiator_bytes": 2599, "last_seen_epoch": "1533964529.55468", "responder_bytes": 868, "first_seen_epoch": "1533964529.540829" }, { "bytes": 6901, "stream": 34, "flow_id": "flow-c1afbb14419e8eaaf8b7b740", "packets": 24, "transport": "tcp", "last_frame": 6432, "first_frame": 488, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 49191, "responder_port": 445, "initiator_bytes": 5093, "last_seen_epoch": "1533964565.217842", "responder_bytes": 1808, "first_seen_epoch": "1533964529.547401" }, { "bytes": 3927, "stream": 35, "flow_id": "flow-c116b164da26d9a7d2bdb29c", "packets": 10, "transport": "tcp", "last_frame": 502, "first_frame": 493, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 49192, "responder_port": 88, "initiator_bytes": 1973, "last_seen_epoch": "1533964529.549966", "responder_bytes": 1954, "first_seen_epoch": "1533964529.548476" }, { "bytes": 3623, "stream": 36, "flow_id": "flow-830102df5f610906d5226aa6", "packets": 10, "transport": "tcp", "last_frame": 512, "first_frame": 503, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 49193, "responder_port": 88, "initiator_bytes": 1805, "last_seen_epoch": "1533964529.551036", "responder_bytes": 1818, "first_seen_epoch": "1533964529.550061" }, { "bytes": 177, "stream": 27, "flow_id": "flow-fed56104ac3b6875a009925b", "packets": 2, "transport": "udp", "last_frame": 543, "first_frame": 539, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 64657, "responder_port": 53, "initiator_bytes": 70, "last_seen_epoch": "1533964544.690931", "responder_bytes": 107, "first_seen_epoch": "1533964544.230776" }, { "bytes": 188, "stream": 28, "flow_id": "flow-296346be6f4caae0e670b3fa", "packets": 2, "transport": "udp", "last_frame": 542, "first_frame": 541, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 55902, "responder_port": 53, "initiator_bytes": 70, "last_seen_epoch": "1533964544.690929", "responder_bytes": 118, "first_seen_epoch": "1533964544.571554" }, { "bytes": 45855, "stream": 37, "flow_id": "flow-b30273d72e172cbb4551ab8b", "packets": 65, "transport": "tcp", "last_frame": 3163, "first_frame": 544, "initiator_ip": "192.168.1.95", "responder_ip": "207.244.80.166", "initiator_port": 49195, "responder_port": 443, "initiator_bytes": 3361, "last_seen_epoch": "1533964552.29246", "responder_bytes": 42494, "first_seen_epoch": "1533964544.69751" }, { "bytes": 241293, "stream": 38, "flow_id": "flow-8312d02819a61112d3a42654", "packets": 284, "transport": "tcp", "last_frame": 3159, "first_frame": 545, "initiator_ip": "192.168.1.95", "responder_ip": "207.244.80.166", "initiator_port": 49194, "responder_port": 443, "initiator_bytes": 9530, "last_seen_epoch": "1533964552.2922", "responder_bytes": 231763, "first_seen_epoch": "1533964544.697512" }, { "bytes": 234, "stream": 29, "flow_id": "flow-3b104ad5f016a09f58e04ed6", "packets": 2, "transport": "udp", "last_frame": 605, "first_frame": 593, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 53897, "responder_port": 53, "initiator_bytes": 69, "last_seen_epoch": "1533964545.630742", "responder_bytes": 165, "first_seen_epoch": "1533964545.560553" }, { "bytes": 272, "stream": 30, "flow_id": "flow-29de847a306ea26e80d83053", "packets": 2, "transport": "udp", "last_frame": 611, "first_frame": 594, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 51271, "responder_port": 53, "initiator_bytes": 79, "last_seen_epoch": "1533964545.651017", "responder_bytes": 193, "first_seen_epoch": "1533964545.561585" }, { "bytes": 172, "stream": 31, "flow_id": "flow-93c734eb84cd25ac9b2be2a5", "packets": 2, "transport": "udp", "last_frame": 617, "first_frame": 595, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 51444, "responder_port": 53, "initiator_bytes": 78, "last_seen_epoch": "1533964545.677779", "responder_bytes": 94, "first_seen_epoch": "1533964545.575227" }, { "bytes": 192, "stream": 32, "flow_id": "flow-692675bd24fb97fe457cd8c9", "packets": 2, "transport": "udp", "last_frame": 608, "first_frame": 596, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 61736, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1533964545.638096", "responder_bytes": 120, "first_seen_epoch": "1533964545.576638" }, { "bytes": 215, "stream": 33, "flow_id": "flow-4a366633715b84968e0b2750", "packets": 2, "transport": "udp", "last_frame": 649, "first_frame": 599, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 59730, "responder_port": 53, "initiator_bytes": 71, "last_seen_epoch": "1533964545.745951", "responder_bytes": 144, "first_seen_epoch": "1533964545.580055" }, { "bytes": 6401, "stream": 39, "flow_id": "flow-2e8391bad894fcb5d7114fef", "packets": 22, "transport": "tcp", "last_frame": 3161, "first_frame": 600, "initiator_ip": "192.168.1.95", "responder_ip": "207.244.80.166", "initiator_port": 49196, "responder_port": 443, "initiator_bytes": 1307, "last_seen_epoch": "1533964552.292202", "responder_bytes": 5094, "first_seen_epoch": "1533964545.587151" }, { "bytes": 14795, "stream": 40, "flow_id": "flow-ff01b5c2eab7ae6a1fdfb00d", "packets": 40, "transport": "tcp", "last_frame": 4347, "first_frame": 601, "initiator_ip": "192.168.1.95", "responder_ip": "207.244.80.166", "initiator_port": 49197, "responder_port": 443, "initiator_bytes": 3651, "last_seen_epoch": "1533964554.235704", "responder_bytes": 11144, "first_seen_epoch": "1533964545.58809" }, { "bytes": 51326, "stream": 41, "flow_id": "flow-8678be5aed379abf37982cdd", "packets": 74, "transport": "tcp", "last_frame": 3157, "first_frame": 602, "initiator_ip": "192.168.1.95", "responder_ip": "207.244.80.166", "initiator_port": 49198, "responder_port": 443, "initiator_bytes": 2851, "last_seen_epoch": "1533964552.291794", "responder_bytes": 48475, "first_seen_epoch": "1533964545.588353" }, { "bytes": 196, "stream": 34, "flow_id": "flow-e2a3bc551704e32aea647ab0", "packets": 2, "transport": "udp", "last_frame": 614, "first_frame": 603, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 52723, "responder_port": 53, "initiator_bytes": 66, "last_seen_epoch": "1533964545.653915", "responder_bytes": 130, "first_seen_epoch": "1533964545.589318" }, { "bytes": 122866, "stream": 42, "flow_id": "flow-33a86cd344f00cbf4b3cbc9b", "packets": 135, "transport": "tcp", "last_frame": 3155, "first_frame": 604, "initiator_ip": "192.168.1.95", "responder_ip": "207.244.80.166", "initiator_port": 49199, "responder_port": 443, "initiator_bytes": 4591, "last_seen_epoch": "1533964552.291445", "responder_bytes": 118275, "first_seen_epoch": "1533964545.59037" }, { "bytes": 25654, "stream": 43, "flow_id": "flow-1ea5abc8e1f05860838a20f6", "packets": 41, "transport": "tcp", "last_frame": 3144, "first_frame": 606, "initiator_ip": "192.168.1.95", "responder_ip": "136.243.25.70", "initiator_port": 49200, "responder_port": 443, "initiator_bytes": 2641, "last_seen_epoch": "1533964552.243935", "responder_bytes": 23013, "first_seen_epoch": "1533964545.63126" }, { "bytes": 8192, "stream": 44, "flow_id": "flow-bb260817bbe448c7fe46243c", "packets": 28, "transport": "tcp", "last_frame": 5838, "first_frame": 607, "initiator_ip": "192.168.1.95", "responder_ip": "136.243.25.70", "initiator_port": 49201, "responder_port": 443, "initiator_bytes": 1914, "last_seen_epoch": "1533964559.324354", "responder_bytes": 6278, "first_seen_epoch": "1533964545.631432" }, { "bytes": 5977, "stream": 45, "flow_id": "flow-2dfa454d30f0ccfe9878d80f", "packets": 20, "transport": "tcp", "last_frame": 6956, "first_frame": 609, "initiator_ip": "192.168.1.95", "responder_ip": "178.154.131.215", "initiator_port": 49202, "responder_port": 443, "initiator_bytes": 934, "last_seen_epoch": "1533964664.449397", "responder_bytes": 5043, "first_seen_epoch": "1533964545.638724" }, { "bytes": 42890, "stream": 46, "flow_id": "flow-aba8856d1221704ec7450cc4", "packets": 52, "transport": "tcp", "last_frame": 6953, "first_frame": 610, "initiator_ip": "192.168.1.95", "responder_ip": "178.154.131.215", "initiator_port": 49203, "responder_port": 443, "initiator_bytes": 2211, "last_seen_epoch": "1533964664.4491", "responder_bytes": 40679, "first_seen_epoch": "1533964545.638725" }, { "bytes": 3730, "stream": 47, "flow_id": "flow-bce136b37053ab783cb81192", "packets": 16, "transport": "tcp", "last_frame": 7049, "first_frame": 612, "initiator_ip": "192.168.1.95", "responder_ip": "172.217.0.42", "initiator_port": 49204, "responder_port": 443, "initiator_bytes": 761, "last_seen_epoch": "1533964664.504502", "responder_bytes": 2969, "first_seen_epoch": "1533964545.652189" }, { "bytes": 41841, "stream": 48, "flow_id": "flow-8a01066529a72b5e53909cdc", "packets": 68, "transport": "tcp", "last_frame": 7050, "first_frame": 613, "initiator_ip": "192.168.1.95", "responder_ip": "172.217.0.42", "initiator_port": 49205, "responder_port": 443, "initiator_bytes": 2661, "last_seen_epoch": "1533964664.5046", "responder_bytes": 39180, "first_seen_epoch": "1533964545.652641" }, { "bytes": 35867, "stream": 49, "flow_id": "flow-702b7ea0936fdcf9db148ec2", "packets": 47, "transport": "tcp", "last_frame": 7083, "first_frame": 615, "initiator_ip": "192.168.1.95", "responder_ip": "87.240.129.133", "initiator_port": 49206, "responder_port": 443, "initiator_bytes": 2019, "last_seen_epoch": "1533964664.674761", "responder_bytes": 33848, "first_seen_epoch": "1533964545.654493" }, { "bytes": 5353, "stream": 50, "flow_id": "flow-6d1e8b74e69ab3f77b8c823f", "packets": 22, "transport": "tcp", "last_frame": 6932, "first_frame": 616, "initiator_ip": "192.168.1.95", "responder_ip": "87.240.129.133", "initiator_port": 49207, "responder_port": 443, "initiator_bytes": 988, "last_seen_epoch": "1533964664.446569", "responder_bytes": 4365, "first_seen_epoch": "1533964545.654496" }, { "bytes": 4198, "stream": 51, "flow_id": "flow-5088f25bbb47ec9e4b03c1dd", "packets": 20, "transport": "tcp", "last_frame": 4543, "first_frame": 618, "initiator_ip": "192.168.1.95", "responder_ip": "173.241.250.220", "initiator_port": 49209, "responder_port": 443, "initiator_bytes": 940, "last_seen_epoch": "1533964554.784606", "responder_bytes": 3258, "first_seen_epoch": "1533964545.679168" }, { "bytes": 66366, "stream": 52, "flow_id": "flow-d2959686dd8e18c0877f72dd", "packets": 87, "transport": "tcp", "last_frame": 4540, "first_frame": 619, "initiator_ip": "192.168.1.95", "responder_ip": "173.241.250.220", "initiator_port": 49208, "responder_port": 443, "initiator_bytes": 3249, "last_seen_epoch": "1533964554.783947", "responder_bytes": 63117, "first_seen_epoch": "1533964545.67917" }, { "bytes": 128987, "stream": 53, "flow_id": "flow-088661085e90046ea8c613e8", "packets": 160, "transport": "tcp", "last_frame": 2461, "first_frame": 655, "initiator_ip": "192.168.1.95", "responder_ip": "185.28.71.53", "initiator_port": 49210, "responder_port": 443, "initiator_bytes": 6186, "last_seen_epoch": "1533964549.913203", "responder_bytes": 122801, "first_seen_epoch": "1533964545.747155" }, { "bytes": 85273, "stream": 54, "flow_id": "flow-f35104e409ff073363087911", "packets": 124, "transport": "tcp", "last_frame": 6941, "first_frame": 656, "initiator_ip": "192.168.1.95", "responder_ip": "185.28.71.53", "initiator_port": 49211, "responder_port": 443, "initiator_bytes": 4783, "last_seen_epoch": "1533964664.447648", "responder_bytes": 80490, "first_seen_epoch": "1533964545.74745" }, { "bytes": 115455, "stream": 55, "flow_id": "flow-d8d70eab131f4811276ed4c0", "packets": 142, "transport": "tcp", "last_frame": 6944, "first_frame": 657, "initiator_ip": "192.168.1.95", "responder_ip": "185.28.71.53", "initiator_port": 49212, "responder_port": 443, "initiator_bytes": 5706, "last_seen_epoch": "1533964664.447969", "responder_bytes": 109749, "first_seen_epoch": "1533964545.747452" }, { "bytes": 228250, "stream": 56, "flow_id": "flow-78f8eade88d3e89aa622b590", "packets": 197, "transport": "tcp", "last_frame": 6935, "first_frame": 658, "initiator_ip": "192.168.1.95", "responder_ip": "185.28.71.53", "initiator_port": 49213, "responder_port": 443, "initiator_bytes": 6560, "last_seen_epoch": "1533964664.447043", "responder_bytes": 221690, "first_seen_epoch": "1533964545.747817" }, { "bytes": 567807, "stream": 57, "flow_id": "flow-2ada2302ba409277e06c84a0", "packets": 634, "transport": "tcp", "last_frame": 6947, "first_frame": 660, "initiator_ip": "192.168.1.95", "responder_ip": "185.28.71.53", "initiator_port": 49214, "responder_port": 443, "initiator_bytes": 19723, "last_seen_epoch": "1533964664.448423", "responder_bytes": 548084, "first_seen_epoch": "1533964545.748151" }, { "bytes": 111254, "stream": 58, "flow_id": "flow-cb05e1bd1eb0c9ff1649002c", "packets": 133, "transport": "tcp", "last_frame": 2962, "first_frame": 662, "initiator_ip": "192.168.1.95", "responder_ip": "185.28.71.53", "initiator_port": 49215, "responder_port": 443, "initiator_bytes": 5406, "last_seen_epoch": "1533964551.659433", "responder_bytes": 105848, "first_seen_epoch": "1533964545.748422" }, { "bytes": 117728, "stream": 59, "flow_id": "flow-c73a4f92fc6eb2ba58a40446", "packets": 101, "transport": "tcp", "last_frame": 6938, "first_frame": 1012, "initiator_ip": "192.168.1.95", "responder_ip": "185.28.71.53", "initiator_port": 49216, "responder_port": 443, "initiator_bytes": 3757, "last_seen_epoch": "1533964664.447325", "responder_bytes": 113971, "first_seen_epoch": "1533964546.138831" }, { "bytes": 40233, "stream": 60, "flow_id": "flow-76e510e86903ad4b9371e4bd", "packets": 61, "transport": "tcp", "last_frame": 2522, "first_frame": 1013, "initiator_ip": "192.168.1.95", "responder_ip": "185.28.71.53", "initiator_port": 49217, "responder_port": 443, "initiator_bytes": 2497, "last_seen_epoch": "1533964550.142247", "responder_bytes": 37736, "first_seen_epoch": "1533964546.139113" }, { "bytes": 32562, "stream": 61, "flow_id": "flow-615cf3c210e207a9d21b5f47", "packets": 54, "transport": "tcp", "last_frame": 2971, "first_frame": 1999, "initiator_ip": "192.168.1.95", "responder_ip": "185.28.71.53", "initiator_port": 49218, "responder_port": 443, "initiator_bytes": 2257, "last_seen_epoch": "1533964551.660213", "responder_bytes": 30305, "first_seen_epoch": "1533964548.28848" }, { "bytes": 48007, "stream": 62, "flow_id": "flow-a14bc817a5812732633cbe34", "packets": 76, "transport": "tcp", "last_frame": 3108, "first_frame": 2000, "initiator_ip": "192.168.1.95", "responder_ip": "185.28.71.53", "initiator_port": 49219, "responder_port": 443, "initiator_bytes": 2857, "last_seen_epoch": "1533964552.110883", "responder_bytes": 45150, "first_seen_epoch": "1533964548.288649" }, { "bytes": 220, "stream": 35, "flow_id": "flow-60d29702a4b4a34199ed96ad", "packets": 2, "transport": "udp", "last_frame": 2030, "first_frame": 2028, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 49984, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1533964548.338547", "responder_bytes": 148, "first_seen_epoch": "1533964548.338132" }, { "bytes": 220, "stream": 36, "flow_id": "flow-34710aef4addf80208460ae4", "packets": 2, "transport": "udp", "last_frame": 2032, "first_frame": 2029, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 57214, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1533964548.338743", "responder_bytes": 148, "first_seen_epoch": "1533964548.338135" }, { "bytes": 236, "stream": 37, "flow_id": "flow-583ec95199f30462281d833e", "packets": 2, "transport": "udp", "last_frame": 2268, "first_frame": 2031, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 51198, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1533964549.230297", "responder_bytes": 164, "first_seen_epoch": "1533964548.338549" }, { "bytes": 247, "stream": 38, "flow_id": "flow-dc1c496667a708e9728ff7bb", "packets": 2, "transport": "udp", "last_frame": 2263, "first_frame": 2033, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 60952, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1533964549.230108", "responder_bytes": 175, "first_seen_epoch": "1533964548.338744" }, { "bytes": 247, "stream": 39, "flow_id": "flow-08b2a56fa9c3a5f6f0e72f74", "packets": 2, "transport": "udp", "last_frame": 2265, "first_frame": 2034, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 52953, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1533964549.230112", "responder_bytes": 175, "first_seen_epoch": "1533964548.339435" }, { "bytes": 247, "stream": 40, "flow_id": "flow-ee2b6d3e4e84212bc40c4ed8", "packets": 2, "transport": "udp", "last_frame": 2266, "first_frame": 2035, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 49582, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1533964549.230247", "responder_bytes": 175, "first_seen_epoch": "1533964548.339533" }, { "bytes": 65659, "stream": 63, "flow_id": "flow-ed0858545bd306c0a91f20c9", "packets": 91, "transport": "tcp", "last_frame": 6950, "first_frame": 2231, "initiator_ip": "192.168.1.95", "responder_ip": "185.28.71.53", "initiator_port": 49220, "responder_port": 443, "initiator_bytes": 3337, "last_seen_epoch": "1533964664.448733", "responder_bytes": 62322, "first_seen_epoch": "1533964549.007046" }, { "bytes": 212, "stream": 41, "flow_id": "flow-f293eae922135f88ac727cca", "packets": 2, "transport": "udp", "last_frame": 2425, "first_frame": 2269, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 64364, "responder_port": 53, "initiator_bytes": 80, "last_seen_epoch": "1533964549.757857", "responder_bytes": 132, "first_seen_epoch": "1533964549.231268" }, { "bytes": 3791, "stream": 64, "flow_id": "flow-d8cf1929c5c22f46d86f45b0", "packets": 17, "transport": "tcp", "last_frame": 7046, "first_frame": 2430, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.192.10", "initiator_port": 49221, "responder_port": 443, "initiator_bytes": 822, "last_seen_epoch": "1533964664.504313", "responder_bytes": 2969, "first_seen_epoch": "1533964549.759899" }, { "bytes": 5206, "stream": 65, "flow_id": "flow-8cc41648e918ebd33b3a1749", "packets": 21, "transport": "tcp", "last_frame": 7036, "first_frame": 2433, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.192.10", "initiator_port": 49222, "responder_port": 443, "initiator_bytes": 1256, "last_seen_epoch": "1533964664.504008", "responder_bytes": 3950, "first_seen_epoch": "1533964549.760165" }, { "bytes": 196, "stream": 42, "flow_id": "flow-2dbcae8bbc702df8b332fd26", "packets": 2, "transport": "udp", "last_frame": 3180, "first_frame": 3056, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 53239, "responder_port": 53, "initiator_bytes": 82, "last_seen_epoch": "1533964552.350754", "responder_bytes": 114, "first_seen_epoch": "1533964551.845979" }, { "bytes": 226, "stream": 43, "flow_id": "flow-1cb39908ae3b13accc763397", "packets": 2, "transport": "udp", "last_frame": 3185, "first_frame": 3061, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 52188, "responder_port": 53, "initiator_bytes": 85, "last_seen_epoch": "1533964552.35401", "responder_bytes": 141, "first_seen_epoch": "1533964551.909128" }, { "bytes": 224, "stream": 44, "flow_id": "flow-90a5e233efd343fc4f1dd59b", "packets": 2, "transport": "udp", "last_frame": 3197, "first_frame": 3129, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 50621, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1533964552.405569", "responder_bytes": 152, "first_seen_epoch": "1533964552.232112" }, { "bytes": 206, "stream": 45, "flow_id": "flow-83b50ad50aecffaaa7e6825b", "packets": 2, "transport": "udp", "last_frame": 3196, "first_frame": 3134, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 58068, "responder_port": 53, "initiator_bytes": 77, "last_seen_epoch": "1533964552.405445", "responder_bytes": 129, "first_seen_epoch": "1533964552.236123" }, { "bytes": 248, "stream": 46, "flow_id": "flow-a70b0d9a3fdd296da9995c61", "packets": 2, "transport": "udp", "last_frame": 3212, "first_frame": 3147, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 58083, "responder_port": 53, "initiator_bytes": 75, "last_seen_epoch": "1533964552.430269", "responder_bytes": 173, "first_seen_epoch": "1533964552.24481" }, { "bytes": 4397, "stream": 66, "flow_id": "flow-fb0dc9ae0ab7975196fea6a8", "packets": 16, "transport": "tcp", "last_frame": 6923, "first_frame": 3181, "initiator_ip": "192.168.1.95", "responder_ip": "104.20.21.239", "initiator_port": 49224, "responder_port": 443, "initiator_bytes": 848, "last_seen_epoch": "1533964664.445608", "responder_bytes": 3549, "first_seen_epoch": "1533964552.352132" }, { "bytes": 8654, "stream": 67, "flow_id": "flow-3cb9515868006458b39eac02", "packets": 23, "transport": "tcp", "last_frame": 7048, "first_frame": 3182, "initiator_ip": "192.168.1.95", "responder_ip": "104.20.21.239", "initiator_port": 49223, "responder_port": 443, "initiator_bytes": 1363, "last_seen_epoch": "1533964664.504502", "responder_bytes": 7291, "first_seen_epoch": "1533964552.352133" }, { "bytes": 13688, "stream": 68, "flow_id": "flow-76cd48a32cba032b10f8cde1", "packets": 31, "transport": "tcp", "last_frame": 7058, "first_frame": 3186, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.194.162", "initiator_port": 49225, "responder_port": 443, "initiator_bytes": 1569, "last_seen_epoch": "1533964664.504977", "responder_bytes": 12119, "first_seen_epoch": "1533964552.354455" }, { "bytes": 3914, "stream": 69, "flow_id": "flow-ffa94431e818d2f663470d99", "packets": 17, "transport": "tcp", "last_frame": 7061, "first_frame": 3187, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.194.162", "initiator_port": 49226, "responder_port": 443, "initiator_bytes": 827, "last_seen_epoch": "1533964664.505161", "responder_bytes": 3087, "first_seen_epoch": "1533964552.354636" }, { "bytes": 16657, "stream": 70, "flow_id": "flow-315ee5130e8f8464d7ca531b", "packets": 40, "transport": "tcp", "last_frame": 6980, "first_frame": 3198, "initiator_ip": "192.168.1.95", "responder_ip": "207.244.80.166", "initiator_port": 49227, "responder_port": 443, "initiator_bytes": 3460, "last_seen_epoch": "1533964664.452451", "responder_bytes": 13197, "first_seen_epoch": "1533964552.405801" }, { "bytes": 8523, "stream": 71, "flow_id": "flow-004ff5c11fbb9cd051918a77", "packets": 30, "transport": "tcp", "last_frame": 6911, "first_frame": 3199, "initiator_ip": "192.168.1.95", "responder_ip": "213.180.193.90", "initiator_port": 49228, "responder_port": 443, "initiator_bytes": 1943, "last_seen_epoch": "1533964664.444451", "responder_bytes": 6580, "first_seen_epoch": "1533964552.406064" }, { "bytes": 6159, "stream": 72, "flow_id": "flow-85c9564c8256f87bf1067aaf", "packets": 22, "transport": "tcp", "last_frame": 6914, "first_frame": 3200, "initiator_ip": "192.168.1.95", "responder_ip": "213.180.193.90", "initiator_port": 49229, "responder_port": 443, "initiator_bytes": 994, "last_seen_epoch": "1533964664.444718", "responder_bytes": 5165, "first_seen_epoch": "1533964552.406159" }, { "bytes": 54054, "stream": 73, "flow_id": "flow-20ba90e1428df6c9778a82ab", "packets": 77, "transport": "tcp", "last_frame": 7062, "first_frame": 3201, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.192.3", "initiator_port": 49230, "responder_port": 443, "initiator_bytes": 3329, "last_seen_epoch": "1533964664.505162", "responder_bytes": 50725, "first_seen_epoch": "1533964552.406364" }, { "bytes": 76986, "stream": 74, "flow_id": "flow-441a8ca50775dceff04f37f6", "packets": 117, "transport": "tcp", "last_frame": 7026, "first_frame": 3202, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.192.3", "initiator_port": 49231, "responder_port": 443, "initiator_bytes": 4893, "last_seen_epoch": "1533964664.502881", "responder_bytes": 72093, "first_seen_epoch": "1533964552.406365" }, { "bytes": 52478, "stream": 75, "flow_id": "flow-0bf09d6340940917c45a620a", "packets": 81, "transport": "tcp", "last_frame": 7047, "first_frame": 3203, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.192.3", "initiator_port": 49232, "responder_port": 443, "initiator_bytes": 3450, "last_seen_epoch": "1533964664.504398", "responder_bytes": 49028, "first_seen_epoch": "1533964552.40663" }, { "bytes": 7551, "stream": 76, "flow_id": "flow-adfe777abd716489e0a92975", "packets": 26, "transport": "tcp", "last_frame": 4268, "first_frame": 3204, "initiator_ip": "192.168.1.95", "responder_ip": "207.244.80.166", "initiator_port": 49233, "responder_port": 443, "initiator_bytes": 1922, "last_seen_epoch": "1533964554.074612", "responder_bytes": 5629, "first_seen_epoch": "1533964552.407185" }, { "bytes": 17873, "stream": 77, "flow_id": "flow-80628862dbea9dc76854401e", "packets": 40, "transport": "tcp", "last_frame": 6984, "first_frame": 3205, "initiator_ip": "192.168.1.95", "responder_ip": "207.244.80.166", "initiator_port": 49234, "responder_port": 443, "initiator_bytes": 3444, "last_seen_epoch": "1533964664.452873", "responder_bytes": 14429, "first_seen_epoch": "1533964552.407368" }, { "bytes": 8740, "stream": 78, "flow_id": "flow-2ee573387000ace8beb33f14", "packets": 27, "transport": "tcp", "last_frame": 6976, "first_frame": 3206, "initiator_ip": "192.168.1.95", "responder_ip": "207.244.80.166", "initiator_port": 49235, "responder_port": 443, "initiator_bytes": 2685, "last_seen_epoch": "1533964664.451884", "responder_bytes": 6055, "first_seen_epoch": "1533964552.407591" }, { "bytes": 11913, "stream": 79, "flow_id": "flow-d955abda9a8ab26c7cb5618e", "packets": 33, "transport": "tcp", "last_frame": 6982, "first_frame": 3207, "initiator_ip": "192.168.1.95", "responder_ip": "207.244.80.166", "initiator_port": 49236, "responder_port": 443, "initiator_bytes": 3264, "last_seen_epoch": "1533964664.452654", "responder_bytes": 8649, "first_seen_epoch": "1533964552.407756" }, { "bytes": 268, "stream": 47, "flow_id": "flow-43523651725e0f8e74b49748", "packets": 2, "transport": "udp", "last_frame": 3334, "first_frame": 3208, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 63566, "responder_port": 53, "initiator_bytes": 84, "last_seen_epoch": "1533964552.716941", "responder_bytes": 184, "first_seen_epoch": "1533964552.424918" }, { "bytes": 228, "stream": 48, "flow_id": "flow-55352e534f88215e225c20a9", "packets": 2, "transport": "udp", "last_frame": 3327, "first_frame": 3209, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 63099, "responder_port": 53, "initiator_bytes": 84, "last_seen_epoch": "1533964552.700183", "responder_bytes": 144, "first_seen_epoch": "1533964552.427007" }, { "bytes": 504, "stream": 49, "flow_id": "flow-b8adb6854970022a03ae93d5", "packets": 2, "transport": "udp", "last_frame": 3296, "first_frame": 3210, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 61662, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1533964552.626454", "responder_bytes": 428, "first_seen_epoch": "1533964552.428838" }, { "bytes": 220, "stream": 50, "flow_id": "flow-40c59eafe94a42c2af21ab67", "packets": 2, "transport": "udp", "last_frame": 3303, "first_frame": 3211, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 52084, "responder_port": 53, "initiator_bytes": 78, "last_seen_epoch": "1533964552.639522", "responder_bytes": 142, "first_seen_epoch": "1533964552.429958" }, { "bytes": 70844, "stream": 80, "flow_id": "flow-e4332a6e4d2e8214ea77745c", "packets": 108, "transport": "tcp", "last_frame": 7055, "first_frame": 3213, "initiator_ip": "192.168.1.95", "responder_ip": "172.217.6.78", "initiator_port": 49237, "responder_port": 443, "initiator_bytes": 6614, "last_seen_epoch": "1533964664.504772", "responder_bytes": 64230, "first_seen_epoch": "1533964552.430758" }, { "bytes": 84933, "stream": 81, "flow_id": "flow-f993fff367f751f757862809", "packets": 121, "transport": "tcp", "last_frame": 7057, "first_frame": 3214, "initiator_ip": "192.168.1.95", "responder_ip": "172.217.6.78", "initiator_port": 49238, "responder_port": 443, "initiator_bytes": 7088, "last_seen_epoch": "1533964664.504868", "responder_bytes": 77845, "first_seen_epoch": "1533964552.430906" }, { "bytes": 164, "stream": 51, "flow_id": "flow-debc69e5a195c38434847fb3", "packets": 2, "transport": "udp", "last_frame": 3335, "first_frame": 3215, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 56031, "responder_port": 53, "initiator_bytes": 66, "last_seen_epoch": "1533964552.717075", "responder_bytes": 98, "first_seen_epoch": "1533964552.43139" }, { "bytes": 208, "stream": 52, "flow_id": "flow-f792fe46ac6d8c6397af32ea", "packets": 2, "transport": "udp", "last_frame": 3310, "first_frame": 3216, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 54363, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1533964552.683616", "responder_bytes": 136, "first_seen_epoch": "1533964552.43263" }, { "bytes": 4767, "stream": 82, "flow_id": "flow-051865f9fe9e7f5361cc339b", "packets": 15, "transport": "tcp", "last_frame": 6881, "first_frame": 3299, "initiator_ip": "192.168.1.95", "responder_ip": "88.212.196.123", "initiator_port": 49239, "responder_port": 443, "initiator_bytes": 758, "last_seen_epoch": "1533964664.440855", "responder_bytes": 4009, "first_seen_epoch": "1533964552.62779" }, { "bytes": 7112, "stream": 83, "flow_id": "flow-100419dcac83879aa9b04d8f", "packets": 24, "transport": "tcp", "last_frame": 6505, "first_frame": 3300, "initiator_ip": "192.168.1.95", "responder_ip": "88.212.196.123", "initiator_port": 49240, "responder_port": 443, "initiator_bytes": 1793, "last_seen_epoch": "1533964573.066979", "responder_bytes": 5319, "first_seen_epoch": "1533964552.627985" }, { "bytes": 6663, "stream": 84, "flow_id": "flow-47492afa3dc397c08486d7a2", "packets": 26, "transport": "tcp", "last_frame": 6876, "first_frame": 3306, "initiator_ip": "192.168.1.95", "responder_ip": "194.226.130.229", "initiator_port": 49241, "responder_port": 443, "initiator_bytes": 2134, "last_seen_epoch": "1533964664.440031", "responder_bytes": 4529, "first_seen_epoch": "1533964552.640245" }, { "bytes": 4299, "stream": 85, "flow_id": "flow-f14879372b488cea1fa8c109", "packets": 18, "transport": "tcp", "last_frame": 6879, "first_frame": 3307, "initiator_ip": "192.168.1.95", "responder_ip": "194.226.130.229", "initiator_port": 49242, "responder_port": 443, "initiator_bytes": 1096, "last_seen_epoch": "1533964664.440385", "responder_bytes": 3203, "first_seen_epoch": "1533964552.640512" }, { "bytes": 60315, "stream": 86, "flow_id": "flow-8d64f5a350012ec2503cd048", "packets": 80, "transport": "tcp", "last_frame": 6865, "first_frame": 3311, "initiator_ip": "192.168.1.95", "responder_ip": "93.158.134.119", "initiator_port": 49244, "responder_port": 443, "initiator_bytes": 6821, "last_seen_epoch": "1533964664.438084", "responder_bytes": 53494, "first_seen_epoch": "1533964552.684399" }, { "bytes": 7065, "stream": 87, "flow_id": "flow-3aa0d7219cfaac3715ff112e", "packets": 23, "transport": "tcp", "last_frame": 6868, "first_frame": 3312, "initiator_ip": "192.168.1.95", "responder_ip": "93.158.134.119", "initiator_port": 49243, "responder_port": 443, "initiator_bytes": 1364, "last_seen_epoch": "1533964664.439004", "responder_bytes": 5701, "first_seen_epoch": "1533964552.684425" }, { "bytes": 4430, "stream": 88, "flow_id": "flow-93b956fcf22482229f757fed", "packets": 19, "transport": "tcp", "last_frame": 7015, "first_frame": 3328, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.192.14", "initiator_port": 49245, "responder_port": 443, "initiator_bytes": 910, "last_seen_epoch": "1533964664.501212", "responder_bytes": 3520, "first_seen_epoch": "1533964552.700698" }, { "bytes": 23525, "stream": 89, "flow_id": "flow-b53300dae08d418c5f55a531", "packets": 47, "transport": "tcp", "last_frame": 7052, "first_frame": 3329, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.192.14", "initiator_port": 49246, "responder_port": 443, "initiator_bytes": 2708, "last_seen_epoch": "1533964664.504669", "responder_bytes": 20817, "first_seen_epoch": "1533964552.700868" }, { "bytes": 10886, "stream": 90, "flow_id": "flow-77457cc6d8e3900b9728d67d", "packets": 33, "transport": "tcp", "last_frame": 7064, "first_frame": 3337, "initiator_ip": "192.168.1.95", "responder_ip": "23.55.50.209", "initiator_port": 49247, "responder_port": 443, "initiator_bytes": 2623, "last_seen_epoch": "1533964664.508079", "responder_bytes": 8263, "first_seen_epoch": "1533964552.717515" }, { "bytes": 6784, "stream": 91, "flow_id": "flow-78986cd2b43bc9ff1cb585ad", "packets": 24, "transport": "tcp", "last_frame": 6890, "first_frame": 3341, "initiator_ip": "192.168.1.95", "responder_ip": "23.55.50.209", "initiator_port": 49248, "responder_port": 443, "initiator_bytes": 1090, "last_seen_epoch": "1533964664.441652", "responder_bytes": 5694, "first_seen_epoch": "1533964552.718092" }, { "bytes": 22330, "stream": 92, "flow_id": "flow-b44320b887ca6c59b3db5e80", "packets": 43, "transport": "tcp", "last_frame": 7010, "first_frame": 3342, "initiator_ip": "192.168.1.95", "responder_ip": "104.25.163.34", "initiator_port": 49249, "responder_port": 443, "initiator_bytes": 1906, "last_seen_epoch": "1533964664.500017", "responder_bytes": 20424, "first_seen_epoch": "1533964552.718626" }, { "bytes": 5458, "stream": 93, "flow_id": "flow-32716849b5bc92bf0fefa253", "packets": 20, "transport": "tcp", "last_frame": 6873, "first_frame": 3343, "initiator_ip": "192.168.1.95", "responder_ip": "104.25.163.34", "initiator_port": 49250, "responder_port": 443, "initiator_bytes": 928, "last_seen_epoch": "1533964664.4397", "responder_bytes": 4530, "first_seen_epoch": "1533964552.718771" }, { "bytes": 8111, "stream": 94, "flow_id": "flow-3e40aafb62c81355d9238060", "packets": 26, "transport": "tcp", "last_frame": 6978, "first_frame": 3551, "initiator_ip": "192.168.1.95", "responder_ip": "207.244.80.166", "initiator_port": 49252, "responder_port": 443, "initiator_bytes": 2178, "last_seen_epoch": "1533964664.452205", "responder_bytes": 5933, "first_seen_epoch": "1533964552.965294" }, { "bytes": 11638, "stream": 95, "flow_id": "flow-2d347e7aedc8feb23856df87", "packets": 35, "transport": "tcp", "last_frame": 6974, "first_frame": 3552, "initiator_ip": "192.168.1.95", "responder_ip": "207.244.80.166", "initiator_port": 49251, "responder_port": 443, "initiator_bytes": 3676, "last_seen_epoch": "1533964664.451675", "responder_bytes": 7962, "first_seen_epoch": "1533964552.965393" }, { "bytes": 216, "stream": 53, "flow_id": "flow-2b86405115d69700433fb974", "packets": 2, "transport": "udp", "last_frame": 3925, "first_frame": 3792, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 51943, "responder_port": 53, "initiator_bytes": 80, "last_seen_epoch": "1533964553.575811", "responder_bytes": 136, "first_seen_epoch": "1533964553.383949" }, { "bytes": 222, "stream": 54, "flow_id": "flow-5aef8cb4e5673ba917c8c180", "packets": 2, "transport": "udp", "last_frame": 3927, "first_frame": 3793, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 62657, "responder_port": 53, "initiator_bytes": 90, "last_seen_epoch": "1533964553.57584", "responder_bytes": 132, "first_seen_epoch": "1533964553.386066" }, { "bytes": 3749, "stream": 96, "flow_id": "flow-58c1f98032e313bb059dc83c", "packets": 21, "transport": "tcp", "last_frame": 7059, "first_frame": 3861, "initiator_ip": "192.168.1.95", "responder_ip": "172.217.6.78", "initiator_port": 49253, "responder_port": 443, "initiator_bytes": 2287, "last_seen_epoch": "1533964664.504978", "responder_bytes": 1462, "first_seen_epoch": "1533964553.445238" }, { "bytes": 1151, "stream": 97, "flow_id": "flow-bf4723f61a37efb285a58571", "packets": 13, "transport": "tcp", "last_frame": 7053, "first_frame": 3862, "initiator_ip": "192.168.1.95", "responder_ip": "172.217.6.78", "initiator_port": 49254, "responder_port": 443, "initiator_bytes": 654, "last_seen_epoch": "1533964664.50477", "responder_bytes": 497, "first_seen_epoch": "1533964553.445751" }, { "bytes": 520145, "stream": 98, "flow_id": "flow-ab52b6cc51c11808325fcac3", "packets": 586, "transport": "tcp", "last_frame": 7060, "first_frame": 3863, "initiator_ip": "192.168.1.95", "responder_ip": "172.217.6.78", "initiator_port": 49255, "responder_port": 443, "initiator_bytes": 21920, "last_seen_epoch": "1533964664.505075", "responder_bytes": 498225, "first_seen_epoch": "1533964553.446364" }, { "bytes": 6373, "stream": 99, "flow_id": "flow-243b2dc3a4478fb8a165e30b", "packets": 23, "transport": "tcp", "last_frame": 7051, "first_frame": 3936, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.194.162", "initiator_port": 49257, "responder_port": 443, "initiator_bytes": 1343, "last_seen_epoch": "1533964664.504626", "responder_bytes": 5030, "first_seen_epoch": "1533964553.577043" }, { "bytes": 4801, "stream": 100, "flow_id": "flow-d134055f52630a4cbc95940a", "packets": 19, "transport": "tcp", "last_frame": 7004, "first_frame": 3939, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.194.162", "initiator_port": 49258, "responder_port": 443, "initiator_bytes": 882, "last_seen_epoch": "1533964664.499452", "responder_bytes": 3919, "first_seen_epoch": "1533964553.57732" }, { "bytes": 78805, "stream": 101, "flow_id": "flow-9cb5ee4f4ca53a83450118e6", "packets": 93, "transport": "tcp", "last_frame": 7008, "first_frame": 3940, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.192.2", "initiator_port": 49256, "responder_port": 443, "initiator_bytes": 4808, "last_seen_epoch": "1533964664.499929", "responder_bytes": 73997, "first_seen_epoch": "1533964553.577535" }, { "bytes": 23025, "stream": 102, "flow_id": "flow-e913150a64f5b623762afc84", "packets": 40, "transport": "tcp", "last_frame": 7003, "first_frame": 3942, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.192.2", "initiator_port": 49259, "responder_port": 443, "initiator_bytes": 1838, "last_seen_epoch": "1533964664.499451", "responder_bytes": 21187, "first_seen_epoch": "1533964553.577538" }, { "bytes": 340, "stream": 55, "flow_id": "flow-636a537ea84703657468d2be", "packets": 2, "transport": "udp", "last_frame": 4257, "first_frame": 4150, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 49920, "responder_port": 53, "initiator_bytes": 90, "last_seen_epoch": "1533964554.071727", "responder_bytes": 250, "first_seen_epoch": "1533964553.828629" }, { "bytes": 351, "stream": 56, "flow_id": "flow-0951b119bc3ee08ef8bd9749", "packets": 2, "transport": "udp", "last_frame": 4256, "first_frame": 4172, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 52951, "responder_port": 53, "initiator_bytes": 90, "last_seen_epoch": "1533964554.071566", "responder_bytes": 261, "first_seen_epoch": "1533964553.83238" }, { "bytes": 252, "stream": 57, "flow_id": "flow-747fe906cc3fecb36dde1ed3", "packets": 2, "transport": "udp", "last_frame": 4326, "first_frame": 4243, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 62668, "responder_port": 53, "initiator_bytes": 83, "last_seen_epoch": "1533964554.232211", "responder_bytes": 169, "first_seen_epoch": "1533964554.012005" }, { "bytes": 1901, "stream": 103, "flow_id": "flow-80bbe7386ee967af45fa933f", "packets": 8, "transport": "tcp", "last_frame": 6664, "first_frame": 4277, "initiator_ip": "192.168.1.95", "responder_ip": "198.70.71.144", "initiator_port": 49260, "responder_port": 80, "initiator_bytes": 514, "last_seen_epoch": "1533964620.356606", "responder_bytes": 1387, "first_seen_epoch": "1533964554.078325" }, { "bytes": 1901, "stream": 104, "flow_id": "flow-88483cfbdc23ab53e0d565a5", "packets": 8, "transport": "tcp", "last_frame": 6665, "first_frame": 4285, "initiator_ip": "192.168.1.95", "responder_ip": "198.70.71.144", "initiator_port": 49261, "responder_port": 80, "initiator_bytes": 514, "last_seen_epoch": "1533964620.356851", "responder_bytes": 1387, "first_seen_epoch": "1533964554.080732" }, { "bytes": 3912, "stream": 105, "flow_id": "flow-4e1ee0ee404ed916ab9bcf60", "packets": 17, "transport": "tcp", "last_frame": 7074, "first_frame": 4328, "initiator_ip": "192.168.1.95", "responder_ip": "74.125.195.156", "initiator_port": 49262, "responder_port": 443, "initiator_bytes": 825, "last_seen_epoch": "1533964664.519803", "responder_bytes": 3087, "first_seen_epoch": "1533964554.233669" }, { "bytes": 5493, "stream": 106, "flow_id": "flow-05356e059207ca9306fc7c7a", "packets": 19, "transport": "tcp", "last_frame": 7076, "first_frame": 4329, "initiator_ip": "192.168.1.95", "responder_ip": "74.125.195.156", "initiator_port": 49263, "responder_port": 443, "initiator_bytes": 1357, "last_seen_epoch": "1533964664.520268", "responder_bytes": 4136, "first_seen_epoch": "1533964554.233898" }, { "bytes": 4003, "stream": 107, "flow_id": "flow-ba534fb122a8aafec2250e1b", "packets": 16, "transport": "tcp", "last_frame": 6962, "first_frame": 4544, "initiator_ip": "192.168.1.95", "responder_ip": "173.241.250.220", "initiator_port": 49264, "responder_port": 443, "initiator_bytes": 852, "last_seen_epoch": "1533964664.450086", "responder_bytes": 3151, "first_seen_epoch": "1533964554.785158" }, { "bytes": 7567, "stream": 108, "flow_id": "flow-6dbd92834433e27e94554603", "packets": 28, "transport": "tcp", "last_frame": 6959, "first_frame": 4545, "initiator_ip": "192.168.1.95", "responder_ip": "173.241.250.220", "initiator_port": 49265, "responder_port": 443, "initiator_bytes": 2606, "last_seen_epoch": "1533964664.449749", "responder_bytes": 4961, "first_seen_epoch": "1533964554.785359" }, { "bytes": 164, "stream": 58, "flow_id": "flow-673da1cd568b4b7979c31003", "packets": 2, "transport": "udp", "last_frame": 4750, "first_frame": 4677, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 50766, "responder_port": 53, "initiator_bytes": 74, "last_seen_epoch": "1533964555.307152", "responder_bytes": 90, "first_seen_epoch": "1533964555.194756" }, { "bytes": 14684, "stream": 109, "flow_id": "flow-c3f96ee6dc072f8f4d5bfddd", "packets": 33, "transport": "tcp", "last_frame": 7045, "first_frame": 4753, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.192.4", "initiator_port": 49266, "responder_port": 443, "initiator_bytes": 2096, "last_seen_epoch": "1533964664.504312", "responder_bytes": 12588, "first_seen_epoch": "1533964555.308004" }, { "bytes": 3692, "stream": 110, "flow_id": "flow-39bc33cd22fdaed1829fe14c", "packets": 17, "transport": "tcp", "last_frame": 6850, "first_frame": 4754, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.192.4", "initiator_port": 49267, "responder_port": 443, "initiator_bytes": 816, "last_seen_epoch": "1533964664.436392", "responder_bytes": 2876, "first_seen_epoch": "1533964555.308158" }, { "bytes": 164, "stream": 59, "flow_id": "flow-0f2cf1d3498810f965c3dd9d", "packets": 2, "transport": "udp", "last_frame": 4896, "first_frame": 4853, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 54043, "responder_port": 53, "initiator_bytes": 74, "last_seen_epoch": "1533964555.6508", "responder_bytes": 90, "first_seen_epoch": "1533964555.557011" }, { "bytes": 229, "stream": 60, "flow_id": "flow-da2c03bcdd7016504a3888b9", "packets": 2, "transport": "udp", "last_frame": 4936, "first_frame": 4895, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 57996, "responder_port": 53, "initiator_bytes": 85, "last_seen_epoch": "1533964555.714019", "responder_bytes": 144, "first_seen_epoch": "1533964555.650027" }, { "bytes": 8957, "stream": 111, "flow_id": "flow-7a4c6291a46c237edd229902", "packets": 36, "transport": "tcp", "last_frame": 6846, "first_frame": 4899, "initiator_ip": "192.168.1.95", "responder_ip": "173.241.250.143", "initiator_port": 49268, "responder_port": 443, "initiator_bytes": 3425, "last_seen_epoch": "1533964664.43563", "responder_bytes": 5532, "first_seen_epoch": "1533964555.653264" }, { "bytes": 12835, "stream": 112, "flow_id": "flow-d82aa056d0d08ee96111d0f1", "packets": 56, "transport": "tcp", "last_frame": 6843, "first_frame": 4900, "initiator_ip": "192.168.1.95", "responder_ip": "173.241.250.143", "initiator_port": 49269, "responder_port": 443, "initiator_bytes": 5734, "last_seen_epoch": "1533964664.435315", "responder_bytes": 7101, "first_seen_epoch": "1533964555.653929" }, { "bytes": 7000, "stream": 113, "flow_id": "flow-f5519f88f234cf2fbfceb27a", "packets": 25, "transport": "tcp", "last_frame": 7001, "first_frame": 4937, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.192.1", "initiator_port": 49270, "responder_port": 443, "initiator_bytes": 1426, "last_seen_epoch": "1533964664.499357", "responder_bytes": 5574, "first_seen_epoch": "1533964555.714588" }, { "bytes": 4145, "stream": 114, "flow_id": "flow-008e55e7ef08ae08e7743e81", "packets": 17, "transport": "tcp", "last_frame": 7024, "first_frame": 4938, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.192.1", "initiator_port": 49271, "responder_port": 443, "initiator_bytes": 851, "last_seen_epoch": "1533964664.501984", "responder_bytes": 3294, "first_seen_epoch": "1533964555.71459" }, { "bytes": 243, "stream": 61, "flow_id": "flow-16d8468c4edf2efe611c0bdb", "packets": 2, "transport": "udp", "last_frame": 5120, "first_frame": 5075, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 60662, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1533964555.984165", "responder_bytes": 167, "first_seen_epoch": "1533964555.919335" }, { "bytes": 194, "stream": 62, "flow_id": "flow-8ebeddc7495dede7abe056c8", "packets": 2, "transport": "udp", "last_frame": 5145, "first_frame": 5077, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 64627, "responder_port": 53, "initiator_bytes": 71, "last_seen_epoch": "1533964556.026779", "responder_bytes": 123, "first_seen_epoch": "1533964555.920423" }, { "bytes": 320, "stream": 63, "flow_id": "flow-63513b92feb40d73dab0db95", "packets": 2, "transport": "udp", "last_frame": 5155, "first_frame": 5078, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 51646, "responder_port": 53, "initiator_bytes": 83, "last_seen_epoch": "1533964556.031163", "responder_bytes": 237, "first_seen_epoch": "1533964555.920668" }, { "bytes": 215, "stream": 64, "flow_id": "flow-cf02b3b4b9da03b938593751", "packets": 2, "transport": "udp", "last_frame": 5121, "first_frame": 5079, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 49504, "responder_port": 53, "initiator_bytes": 79, "last_seen_epoch": "1533964555.984478", "responder_bytes": 136, "first_seen_epoch": "1533964555.921841" }, { "bytes": 337, "stream": 65, "flow_id": "flow-61b02a1766f89ec14ec741e0", "packets": 2, "transport": "udp", "last_frame": 5141, "first_frame": 5080, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 60137, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1533964556.025527", "responder_bytes": 261, "first_seen_epoch": "1533964555.922018" }, { "bytes": 199, "stream": 66, "flow_id": "flow-b45fd49cea79e2e0dbc97928", "packets": 2, "transport": "udp", "last_frame": 5140, "first_frame": 5083, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 49555, "responder_port": 53, "initiator_bytes": 80, "last_seen_epoch": "1533964556.025417", "responder_bytes": 119, "first_seen_epoch": "1533964555.92382" }, { "bytes": 7289, "stream": 115, "flow_id": "flow-f779fcccc90b82d09534f24d", "packets": 25, "transport": "tcp", "last_frame": 7078, "first_frame": 5124, "initiator_ip": "192.168.1.95", "responder_ip": "216.200.232.221", "initiator_port": 49272, "responder_port": 443, "initiator_bytes": 2168, "last_seen_epoch": "1533964664.54084", "responder_bytes": 5121, "first_seen_epoch": "1533964555.986776" }, { "bytes": 4440, "stream": 116, "flow_id": "flow-40fd808de34a00ebfca80972", "packets": 18, "transport": "tcp", "last_frame": 6836, "first_frame": 5128, "initiator_ip": "192.168.1.95", "responder_ip": "216.200.232.221", "initiator_port": 49273, "responder_port": 443, "initiator_bytes": 902, "last_seen_epoch": "1533964664.43453", "responder_bytes": 3538, "first_seen_epoch": "1533964555.987888" }, { "bytes": 4728, "stream": 117, "flow_id": "flow-685ff7ccac28a57e1ef1c9b4", "packets": 17, "transport": "tcp", "last_frame": 7073, "first_frame": 5134, "initiator_ip": "192.168.1.95", "responder_ip": "74.6.34.27", "initiator_port": 49274, "responder_port": 443, "initiator_bytes": 861, "last_seen_epoch": "1533964664.519802", "responder_bytes": 3867, "first_seen_epoch": "1533964555.990036" }, { "bytes": 7472, "stream": 118, "flow_id": "flow-60924e425d1bcc91d00e78b8", "packets": 26, "transport": "tcp", "last_frame": 6821, "first_frame": 5135, "initiator_ip": "192.168.1.95", "responder_ip": "74.6.34.27", "initiator_port": 49275, "responder_port": 443, "initiator_bytes": 1624, "last_seen_epoch": "1533964664.432687", "responder_bytes": 5848, "first_seen_epoch": "1533964555.990168" }, { "bytes": 4760, "stream": 119, "flow_id": "flow-0f7e83e3e795aaba612912af", "packets": 20, "transport": "tcp", "last_frame": 6818, "first_frame": 5144, "initiator_ip": "192.168.1.95", "responder_ip": "54.186.116.83", "initiator_port": 49276, "responder_port": 443, "initiator_bytes": 978, "last_seen_epoch": "1533964664.432376", "responder_bytes": 3782, "first_seen_epoch": "1533964556.026569" }, { "bytes": 7994, "stream": 120, "flow_id": "flow-7b8710a6aaa430dde0ebe0db", "packets": 24, "transport": "tcp", "last_frame": 6815, "first_frame": 5146, "initiator_ip": "192.168.1.95", "responder_ip": "54.186.116.83", "initiator_port": 49277, "responder_port": 443, "initiator_bytes": 2136, "last_seen_epoch": "1533964664.432021", "responder_bytes": 5858, "first_seen_epoch": "1533964556.026946" }, { "bytes": 9304, "stream": 121, "flow_id": "flow-efa2814f2cbfaa4dd85216e1", "packets": 29, "transport": "tcp", "last_frame": 7023, "first_frame": 5147, "initiator_ip": "192.168.1.95", "responder_ip": "172.217.6.66", "initiator_port": 49278, "responder_port": 443, "initiator_bytes": 2616, "last_seen_epoch": "1533964664.501869", "responder_bytes": 6688, "first_seen_epoch": "1533964556.027652" }, { "bytes": 5206, "stream": 122, "flow_id": "flow-fd4cf23fcc9bc6d63b8034c3", "packets": 20, "transport": "tcp", "last_frame": 6828, "first_frame": 5148, "initiator_ip": "192.168.1.95", "responder_ip": "69.194.244.11", "initiator_port": 49279, "responder_port": 443, "initiator_bytes": 1511, "last_seen_epoch": "1533964664.433675", "responder_bytes": 3695, "first_seen_epoch": "1533964556.027653" }, { "bytes": 4487, "stream": 123, "flow_id": "flow-7243d10e38a7d43ca04b445a", "packets": 19, "transport": "tcp", "last_frame": 6831, "first_frame": 5149, "initiator_ip": "192.168.1.95", "responder_ip": "69.194.244.11", "initiator_port": 49280, "responder_port": 443, "initiator_bytes": 1061, "last_seen_epoch": "1533964664.433983", "responder_bytes": 3426, "first_seen_epoch": "1533964556.027876" }, { "bytes": 3794, "stream": 124, "flow_id": "flow-c63bb1cade864cc227956bfc", "packets": 15, "transport": "tcp", "last_frame": 6989, "first_frame": 5150, "initiator_ip": "192.168.1.95", "responder_ip": "172.217.6.66", "initiator_port": 49281, "responder_port": 443, "initiator_bytes": 762, "last_seen_epoch": "1533964664.498796", "responder_bytes": 3032, "first_seen_epoch": "1533964556.028096" }, { "bytes": 10079, "stream": 125, "flow_id": "flow-3dcfbc4a6748df023f758e06", "packets": 27, "transport": "tcp", "last_frame": 5401, "first_frame": 5156, "initiator_ip": "192.168.1.95", "responder_ip": "151.101.2.49", "initiator_port": 49282, "responder_port": 443, "initiator_bytes": 2299, "last_seen_epoch": "1533964556.545211", "responder_bytes": 7780, "first_seen_epoch": "1533964556.031731" }, { "bytes": 7099, "stream": 126, "flow_id": "flow-3d102661d3224fd5ba969ebc", "packets": 17, "transport": "tcp", "last_frame": 7018, "first_frame": 5157, "initiator_ip": "192.168.1.95", "responder_ip": "151.101.2.49", "initiator_port": 49283, "responder_port": 443, "initiator_bytes": 865, "last_seen_epoch": "1533964664.501428", "responder_bytes": 6234, "first_seen_epoch": "1533964556.031733" }, { "bytes": 248, "stream": 67, "flow_id": "flow-e9cea0f3aab65281f3fc6ffb", "packets": 2, "transport": "udp", "last_frame": 5372, "first_frame": 5349, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 63281, "responder_port": 53, "initiator_bytes": 77, "last_seen_epoch": "1533964556.45502", "responder_bytes": 171, "first_seen_epoch": "1533964556.352409" }, { "bytes": 259, "stream": 68, "flow_id": "flow-55e627ee829f4a0451d843e8", "packets": 2, "transport": "udp", "last_frame": 5371, "first_frame": 5350, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 55405, "responder_port": 53, "initiator_bytes": 77, "last_seen_epoch": "1533964556.454915", "responder_bytes": 182, "first_seen_epoch": "1533964556.353582" }, { "bytes": 2044, "stream": 127, "flow_id": "flow-ed27d414a382e79d59ade9c0", "packets": 9, "transport": "tcp", "last_frame": 6666, "first_frame": 5373, "initiator_ip": "192.168.1.95", "responder_ip": "23.43.176.205", "initiator_port": 49284, "responder_port": 80, "initiator_bytes": 433, "last_seen_epoch": "1533964620.356854", "responder_bytes": 1611, "first_seen_epoch": "1533964556.455784" }, { "bytes": 1990, "stream": 128, "flow_id": "flow-beb11a3a3c02531087025d02", "packets": 8, "transport": "tcp", "last_frame": 6667, "first_frame": 5374, "initiator_ip": "192.168.1.95", "responder_ip": "23.43.176.205", "initiator_port": 49285, "responder_port": 80, "initiator_bytes": 433, "last_seen_epoch": "1533964620.356855", "responder_bytes": 1557, "first_seen_epoch": "1533964556.456237" }, { "bytes": 215, "stream": 69, "flow_id": "flow-2b2f1acc39c39391b876f279", "packets": 2, "transport": "udp", "last_frame": 5441, "first_frame": 5430, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 57467, "responder_port": 53, "initiator_bytes": 87, "last_seen_epoch": "1533964556.880955", "responder_bytes": 128, "first_seen_epoch": "1533964556.819517" }, { "bytes": 229, "stream": 70, "flow_id": "flow-e58508757056b42341b1b39e", "packets": 2, "transport": "udp", "last_frame": 5456, "first_frame": 5433, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 62836, "responder_port": 53, "initiator_bytes": 82, "last_seen_epoch": "1533964556.909758", "responder_bytes": 147, "first_seen_epoch": "1533964556.83961" }, { "bytes": 1153, "stream": 129, "flow_id": "flow-9fb4238a9a20d9c35c80e964", "packets": 13, "transport": "tcp", "last_frame": 7044, "first_frame": 5440, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.192.3", "initiator_port": 49286, "responder_port": 443, "initiator_bytes": 656, "last_seen_epoch": "1533964664.504159", "responder_bytes": 497, "first_seen_epoch": "1533964556.872263" }, { "bytes": 5512, "stream": 130, "flow_id": "flow-9c5b2adf52297b6808a16c06", "packets": 19, "transport": "tcp", "last_frame": 7022, "first_frame": 5442, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.194.162", "initiator_port": 49287, "responder_port": 443, "initiator_bytes": 1331, "last_seen_epoch": "1533964664.501868", "responder_bytes": 4181, "first_seen_epoch": "1533964556.881467" }, { "bytes": 5845, "stream": 131, "flow_id": "flow-8575bc82f819486310737600", "packets": 23, "transport": "tcp", "last_frame": 7002, "first_frame": 5443, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.194.162", "initiator_port": 49288, "responder_port": 443, "initiator_bytes": 1451, "last_seen_epoch": "1533964664.499357", "responder_bytes": 4394, "first_seen_epoch": "1533964556.881645" }, { "bytes": 5465, "stream": 132, "flow_id": "flow-d86d4a7a36ac7b186af46121", "packets": 19, "transport": "tcp", "last_frame": 7009, "first_frame": 5457, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.192.6", "initiator_port": 49289, "responder_port": 443, "initiator_bytes": 1355, "last_seen_epoch": "1533964664.500016", "responder_bytes": 4110, "first_seen_epoch": "1533964556.91027" }, { "bytes": 4365, "stream": 133, "flow_id": "flow-b88d3e38b2a7c8d3d6670653", "packets": 17, "transport": "tcp", "last_frame": 7017, "first_frame": 5458, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.192.6", "initiator_port": 49290, "responder_port": 443, "initiator_bytes": 848, "last_seen_epoch": "1533964664.501214", "responder_bytes": 3517, "first_seen_epoch": "1533964556.91042" }, { "bytes": 247, "stream": 71, "flow_id": "flow-2bb4e75352b19d1262c7ad39", "packets": 2, "transport": "udp", "last_frame": 5698, "first_frame": 5681, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 50566, "responder_port": 53, "initiator_bytes": 71, "last_seen_epoch": "1533964558.771373", "responder_bytes": 176, "first_seen_epoch": "1533964558.62059" }, { "bytes": 25478, "stream": 134, "flow_id": "flow-553a18ecafec4b35e13cd795", "packets": 47, "transport": "tcp", "last_frame": 7000, "first_frame": 5699, "initiator_ip": "192.168.1.95", "responder_ip": "172.217.0.54", "initiator_port": 49291, "responder_port": 443, "initiator_bytes": 2120, "last_seen_epoch": "1533964664.499355", "responder_bytes": 23358, "first_seen_epoch": "1533964558.771978" }, { "bytes": 38737, "stream": 135, "flow_id": "flow-9b3532729e1b001a9a801fe1", "packets": 61, "transport": "tcp", "last_frame": 6993, "first_frame": 5700, "initiator_ip": "192.168.1.95", "responder_ip": "172.217.0.54", "initiator_port": 49292, "responder_port": 443, "initiator_bytes": 2540, "last_seen_epoch": "1533964664.499089", "responder_bytes": 36197, "first_seen_epoch": "1533964558.77198" }, { "bytes": 3250, "stream": 136, "flow_id": "flow-5dae24a1ab55dcf25a9038b1", "packets": 24, "transport": "tcp", "last_frame": 6680, "first_frame": 5839, "initiator_ip": "192.168.1.95", "responder_ip": "136.243.25.70", "initiator_port": 49293, "responder_port": 443, "initiator_bytes": 2038, "last_seen_epoch": "1533964621.919174", "responder_bytes": 1212, "first_seen_epoch": "1533964559.324482" }, { "bytes": 1733, "stream": 137, "flow_id": "flow-3e7c8e9ceb465ec7bf642a6a", "packets": 16, "transport": "tcp", "last_frame": 6683, "first_frame": 5840, "initiator_ip": "192.168.1.95", "responder_ip": "136.243.25.70", "initiator_port": 49294, "responder_port": 443, "initiator_bytes": 808, "last_seen_epoch": "1533964621.919726", "responder_bytes": 925, "first_seen_epoch": "1533964559.3246" }, { "bytes": 218, "stream": 72, "flow_id": "flow-caf850d5becd2687aa8a4aa4", "packets": 2, "transport": "udp", "last_frame": 5857, "first_frame": 5845, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 59851, "responder_port": 53, "initiator_bytes": 80, "last_seen_epoch": "1533964559.422782", "responder_bytes": 138, "first_seen_epoch": "1533964559.338775" }, { "bytes": 296, "stream": 73, "flow_id": "flow-79acfd42b5efa90adea0bbc7", "packets": 2, "transport": "udp", "last_frame": 5860, "first_frame": 5846, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 53455, "responder_port": 53, "initiator_bytes": 87, "last_seen_epoch": "1533964559.445991", "responder_bytes": 209, "first_seen_epoch": "1533964559.371843" }, { "bytes": 202, "stream": 74, "flow_id": "flow-c0629deb26513e77c0e912ed", "packets": 2, "transport": "udp", "last_frame": 5863, "first_frame": 5847, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 62597, "responder_port": 53, "initiator_bytes": 85, "last_seen_epoch": "1533964559.449101", "responder_bytes": 117, "first_seen_epoch": "1533964559.373718" }, { "bytes": 192, "stream": 75, "flow_id": "flow-dec63fb9d68adfa0ecf43d33", "packets": 2, "transport": "udp", "last_frame": 5872, "first_frame": 5852, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 49575, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1533964559.485716", "responder_bytes": 120, "first_seen_epoch": "1533964559.407246" }, { "bytes": 162, "stream": 76, "flow_id": "flow-9c3252b4d513a3d826a280b1", "packets": 2, "transport": "udp", "last_frame": 5871, "first_frame": 5853, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 60720, "responder_port": 53, "initiator_bytes": 73, "last_seen_epoch": "1533964559.485487", "responder_bytes": 89, "first_seen_epoch": "1533964559.40727" }, { "bytes": 206, "stream": 77, "flow_id": "flow-f520b0c0edafdd4e787db36a", "packets": 2, "transport": "udp", "last_frame": 5866, "first_frame": 5854, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 64530, "responder_port": 53, "initiator_bytes": 84, "last_seen_epoch": "1533964559.46458", "responder_bytes": 122, "first_seen_epoch": "1533964559.40975" }, { "bytes": 309, "stream": 78, "flow_id": "flow-7be7dd8a2c2042043342360d", "packets": 3, "transport": "udp", "last_frame": 6313, "first_frame": 5855, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 51004, "responder_port": 53, "initiator_bytes": 144, "last_seen_epoch": "1533964560.553014", "responder_bytes": 165, "first_seen_epoch": "1533964559.411454" }, { "bytes": 272, "stream": 79, "flow_id": "flow-be52b34eda1d997437429c08", "packets": 2, "transport": "udp", "last_frame": 5893, "first_frame": 5856, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 58587, "responder_port": 53, "initiator_bytes": 86, "last_seen_epoch": "1533964559.525559", "responder_bytes": 186, "first_seen_epoch": "1533964559.411813" }, { "bytes": 6673, "stream": 138, "flow_id": "flow-10df604ffee0ba2680f58aff", "packets": 22, "transport": "tcp", "last_frame": 6796, "first_frame": 5858, "initiator_ip": "192.168.1.95", "responder_ip": "13.33.106.254", "initiator_port": 49295, "responder_port": 443, "initiator_bytes": 1042, "last_seen_epoch": "1533964664.429227", "responder_bytes": 5631, "first_seen_epoch": "1533964559.423429" }, { "bytes": 22385, "stream": 139, "flow_id": "flow-2bf0983c0900837e7361855b", "packets": 39, "transport": "tcp", "last_frame": 7068, "first_frame": 5859, "initiator_ip": "192.168.1.95", "responder_ip": "13.33.106.254", "initiator_port": 49296, "responder_port": 443, "initiator_bytes": 1873, "last_seen_epoch": "1533964664.51531", "responder_bytes": 20512, "first_seen_epoch": "1533964559.423701" }, { "bytes": 7304, "stream": 140, "flow_id": "flow-3cce1007d03ebfa65ca628f7", "packets": 26, "transport": "tcp", "last_frame": 6791, "first_frame": 5861, "initiator_ip": "192.168.1.95", "responder_ip": "34.246.244.104", "initiator_port": 49297, "responder_port": 443, "initiator_bytes": 1169, "last_seen_epoch": "1533964664.428373", "responder_bytes": 6135, "first_seen_epoch": "1533964559.446933" }, { "bytes": 8506, "stream": 141, "flow_id": "flow-ce28a166e4cd7539ec4dfd04", "packets": 29, "transport": "tcp", "last_frame": 6788, "first_frame": 5862, "initiator_ip": "192.168.1.95", "responder_ip": "34.246.244.104", "initiator_port": 49298, "responder_port": 443, "initiator_bytes": 1948, "last_seen_epoch": "1533964664.427749", "responder_bytes": 6558, "first_seen_epoch": "1533964559.446935" }, { "bytes": 5946, "stream": 142, "flow_id": "flow-21eedd31883da072cf23919e", "packets": 21, "transport": "tcp", "last_frame": 6986, "first_frame": 5864, "initiator_ip": "192.168.1.95", "responder_ip": "104.20.21.239", "initiator_port": 49299, "responder_port": 443, "initiator_bytes": 1674, "last_seen_epoch": "1533964664.498013", "responder_bytes": 4272, "first_seen_epoch": "1533964559.449893" }, { "bytes": 4634, "stream": 143, "flow_id": "flow-04ccbe9ac1f67fcbe5ef70f2", "packets": 20, "transport": "tcp", "last_frame": 6786, "first_frame": 5865, "initiator_ip": "192.168.1.95", "responder_ip": "104.20.21.239", "initiator_port": 49300, "responder_port": 443, "initiator_bytes": 971, "last_seen_epoch": "1533964664.427283", "responder_bytes": 3663, "first_seen_epoch": "1533964559.449895" }, { "bytes": 5007, "stream": 144, "flow_id": "flow-dcc131d10f8a8b5406befe2f", "packets": 20, "transport": "tcp", "last_frame": 6770, "first_frame": 5867, "initiator_ip": "192.168.1.95", "responder_ip": "69.174.248.228", "initiator_port": 49301, "responder_port": 443, "initiator_bytes": 970, "last_seen_epoch": "1533964664.425559", "responder_bytes": 4037, "first_seen_epoch": "1533964559.465366" }, { "bytes": 5494, "stream": 145, "flow_id": "flow-79c52f98ea3e18ad09d2ffbd", "packets": 22, "transport": "tcp", "last_frame": 6056, "first_frame": 5868, "initiator_ip": "192.168.1.95", "responder_ip": "69.174.248.228", "initiator_port": 49302, "responder_port": 443, "initiator_bytes": 1461, "last_seen_epoch": "1533964559.745829", "responder_bytes": 4033, "first_seen_epoch": "1533964559.465367" }, { "bytes": 5949, "stream": 146, "flow_id": "flow-1973c37543602ee4373c6597", "packets": 26, "transport": "tcp", "last_frame": 6781, "first_frame": 5873, "initiator_ip": "192.168.1.95", "responder_ip": "173.241.250.104", "initiator_port": 49303, "responder_port": 443, "initiator_bytes": 1666, "last_seen_epoch": "1533964664.426766", "responder_bytes": 4283, "first_seen_epoch": "1533964559.48631" }, { "bytes": 5987, "stream": 147, "flow_id": "flow-1705efd899adb88a3d8ec4b9", "packets": 21, "transport": "tcp", "last_frame": 6992, "first_frame": 5874, "initiator_ip": "192.168.1.95", "responder_ip": "198.23.90.60", "initiator_port": 49304, "responder_port": 443, "initiator_bytes": 1389, "last_seen_epoch": "1533964664.498946", "responder_bytes": 4598, "first_seen_epoch": "1533964559.486403" }, { "bytes": 7041, "stream": 148, "flow_id": "flow-7b549fb27ec7780c4a48faa0", "packets": 26, "transport": "tcp", "last_frame": 6778, "first_frame": 5875, "initiator_ip": "192.168.1.95", "responder_ip": "173.241.250.104", "initiator_port": 49305, "responder_port": 443, "initiator_bytes": 2225, "last_seen_epoch": "1533964664.426476", "responder_bytes": 4816, "first_seen_epoch": "1533964559.486483" }, { "bytes": 4616, "stream": 149, "flow_id": "flow-abefb3fd535effbb29275ce3", "packets": 20, "transport": "tcp", "last_frame": 6775, "first_frame": 5876, "initiator_ip": "192.168.1.95", "responder_ip": "198.23.90.60", "initiator_port": 49306, "responder_port": 443, "initiator_bytes": 990, "last_seen_epoch": "1533964664.426086", "responder_bytes": 3626, "first_seen_epoch": "1533964559.486502" }, { "bytes": 8107, "stream": 150, "flow_id": "flow-f50c6b481fc9042c34bfc2be", "packets": 27, "transport": "tcp", "last_frame": 6995, "first_frame": 5894, "initiator_ip": "192.168.1.95", "responder_ip": "149.174.66.131", "initiator_port": 49307, "responder_port": 443, "initiator_bytes": 2334, "last_seen_epoch": "1533964664.499092", "responder_bytes": 5773, "first_seen_epoch": "1533964559.52613" }, { "bytes": 4781, "stream": 151, "flow_id": "flow-cf83640cd4d79bc34c9c3416", "packets": 17, "transport": "tcp", "last_frame": 7014, "first_frame": 5895, "initiator_ip": "192.168.1.95", "responder_ip": "149.174.66.131", "initiator_port": 49308, "responder_port": 443, "initiator_bytes": 1044, "last_seen_epoch": "1533964664.501023", "responder_bytes": 3737, "first_seen_epoch": "1533964559.526285" }, { "bytes": 174, "stream": 80, "flow_id": "flow-4dd1095d9c16df162c5f8320", "packets": 2, "transport": "udp", "last_frame": 6137, "first_frame": 6060, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 52791, "responder_port": 53, "initiator_bytes": 79, "last_seen_epoch": "1533964559.872487", "responder_bytes": 95, "first_seen_epoch": "1533964559.747861" }, { "bytes": 229, "stream": 81, "flow_id": "flow-29c707884ea293fa5e250c1b", "packets": 2, "transport": "udp", "last_frame": 6113, "first_frame": 6084, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 58828, "responder_port": 53, "initiator_bytes": 73, "last_seen_epoch": "1533964559.840586", "responder_bytes": 156, "first_seen_epoch": "1533964559.791256" }, { "bytes": 5013, "stream": 152, "flow_id": "flow-ddc32c0e5a304c6a59c76314", "packets": 19, "transport": "tcp", "last_frame": 7069, "first_frame": 6114, "initiator_ip": "192.168.1.95", "responder_ip": "98.136.101.121", "initiator_port": 49309, "responder_port": 443, "initiator_bytes": 915, "last_seen_epoch": "1533964664.515313", "responder_bytes": 4098, "first_seen_epoch": "1533964559.84168" }, { "bytes": 7830, "stream": 153, "flow_id": "flow-c0f2bcf4be8785d192e5a440", "packets": 26, "transport": "tcp", "last_frame": 6755, "first_frame": 6125, "initiator_ip": "192.168.1.95", "responder_ip": "98.136.101.121", "initiator_port": 49310, "responder_port": 443, "initiator_bytes": 1682, "last_seen_epoch": "1533964664.42273", "responder_bytes": 6148, "first_seen_epoch": "1533964559.85948" }, { "bytes": 284, "stream": 82, "flow_id": "flow-8fc76226026f16e0371478e1", "packets": 2, "transport": "udp", "last_frame": 6148, "first_frame": 6127, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 62628, "responder_port": 53, "initiator_bytes": 78, "last_seen_epoch": "1533964559.90611", "responder_bytes": 206, "first_seen_epoch": "1533964559.866175" }, { "bytes": 4948, "stream": 154, "flow_id": "flow-4f4a7e46c3fd32751edc974a", "packets": 19, "transport": "tcp", "last_frame": 6763, "first_frame": 6138, "initiator_ip": "192.168.1.95", "responder_ip": "69.174.248.228", "initiator_port": 49311, "responder_port": 443, "initiator_bytes": 965, "last_seen_epoch": "1533964664.424463", "responder_bytes": 3983, "first_seen_epoch": "1533964559.872987" }, { "bytes": 6035, "stream": 155, "flow_id": "flow-6e4e07bcd8b0a918e534f8cf", "packets": 24, "transport": "tcp", "last_frame": 6760, "first_frame": 6139, "initiator_ip": "192.168.1.95", "responder_ip": "69.174.248.228", "initiator_port": 49312, "responder_port": 443, "initiator_bytes": 1516, "last_seen_epoch": "1533964664.423827", "responder_bytes": 4519, "first_seen_epoch": "1533964559.873119" }, { "bytes": 9626, "stream": 156, "flow_id": "flow-5279035b72bcb0b3b4c440c9", "packets": 35, "transport": "tcp", "last_frame": 7178, "first_frame": 6155, "initiator_ip": "192.168.1.95", "responder_ip": "50.16.201.198", "initiator_port": 49313, "responder_port": 443, "initiator_bytes": 4291, "last_seen_epoch": "1533964739.961369", "responder_bytes": 5335, "first_seen_epoch": "1533964559.91108" }, { "bytes": 4468, "stream": 157, "flow_id": "flow-a240a14bc6a225c7b0dc9edb", "packets": 20, "transport": "tcp", "last_frame": 7081, "first_frame": 6156, "initiator_ip": "192.168.1.95", "responder_ip": "50.16.201.198", "initiator_port": 49314, "responder_port": 443, "initiator_bytes": 920, "last_seen_epoch": "1533964664.565008", "responder_bytes": 3548, "first_seen_epoch": "1533964559.912337" }, { "bytes": 200, "stream": 83, "flow_id": "flow-196df9e14d18ffe92572fc3b", "packets": 2, "transport": "udp", "last_frame": 6239, "first_frame": 6226, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 59619, "responder_port": 53, "initiator_bytes": 68, "last_seen_epoch": "1533964560.172942", "responder_bytes": 132, "first_seen_epoch": "1533964560.09489" }, { "bytes": 211, "stream": 84, "flow_id": "flow-3389423cb60e80b40c743438", "packets": 2, "transport": "udp", "last_frame": 6238, "first_frame": 6227, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 51262, "responder_port": 53, "initiator_bytes": 68, "last_seen_epoch": "1533964560.172654", "responder_bytes": 143, "first_seen_epoch": "1533964560.102934" }, { "bytes": 2438, "stream": 158, "flow_id": "flow-88eb40bdffd3d63f36e78660", "packets": 9, "transport": "tcp", "last_frame": 6668, "first_frame": 6240, "initiator_ip": "192.168.1.95", "responder_ip": "13.33.78.186", "initiator_port": 49315, "responder_port": 80, "initiator_bytes": 413, "last_seen_epoch": "1533964620.357075", "responder_bytes": 2025, "first_seen_epoch": "1533964560.174007" }, { "bytes": 2438, "stream": 159, "flow_id": "flow-70825c93682e04818fe31f8d", "packets": 9, "transport": "tcp", "last_frame": 6669, "first_frame": 6241, "initiator_ip": "192.168.1.95", "responder_ip": "13.33.78.186", "initiator_port": 49316, "responder_port": 80, "initiator_bytes": 413, "last_seen_epoch": "1533964620.357227", "responder_bytes": 2025, "first_seen_epoch": "1533964560.174166" }, { "bytes": 245, "stream": 85, "flow_id": "flow-4af4c456c4d595b0f044a32c", "packets": 2, "transport": "udp", "last_frame": 6273, "first_frame": 6262, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 59909, "responder_port": 53, "initiator_bytes": 81, "last_seen_epoch": "1533964560.304978", "responder_bytes": 164, "first_seen_epoch": "1533964560.225311" }, { "bytes": 7656, "stream": 160, "flow_id": "flow-5a60e59c4612cb610a147760", "packets": 26, "transport": "tcp", "last_frame": 6748, "first_frame": 6274, "initiator_ip": "192.168.1.95", "responder_ip": "67.195.229.45", "initiator_port": 49317, "responder_port": 443, "initiator_bytes": 1626, "last_seen_epoch": "1533964664.420995", "responder_bytes": 6030, "first_seen_epoch": "1533964560.30575" }, { "bytes": 5021, "stream": 161, "flow_id": "flow-72f1ce1662d276477906067d", "packets": 19, "transport": "tcp", "last_frame": 7070, "first_frame": 6275, "initiator_ip": "192.168.1.95", "responder_ip": "67.195.229.45", "initiator_port": 49318, "responder_port": 443, "initiator_bytes": 923, "last_seen_epoch": "1533964664.515313", "responder_bytes": 4098, "first_seen_epoch": "1533964560.305875" }, { "bytes": 5789, "stream": 162, "flow_id": "flow-ecc66efd8354f55678780082", "packets": 24, "transport": "tcp", "last_frame": 6506, "first_frame": 6314, "initiator_ip": "192.168.1.95", "responder_ip": "199.38.167.128", "initiator_port": 49319, "responder_port": 443, "initiator_bytes": 1641, "last_seen_epoch": "1533964571.778108", "responder_bytes": 4148, "first_seen_epoch": "1533964560.554068" }, { "bytes": 4285, "stream": 163, "flow_id": "flow-e99642d218628d08d08c8a85", "packets": 18, "transport": "tcp", "last_frame": 6507, "first_frame": 6315, "initiator_ip": "192.168.1.95", "responder_ip": "199.38.167.128", "initiator_port": 49320, "responder_port": 443, "initiator_bytes": 1046, "last_seen_epoch": "1533964571.813614", "responder_bytes": 3239, "first_seen_epoch": "1533964560.554096" }, { "bytes": 246, "stream": 86, "flow_id": "flow-3bb3096011b6848afa2dc02a", "packets": 2, "transport": "udp", "last_frame": 6513, "first_frame": 6512, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 56563, "responder_port": 53, "initiator_bytes": 82, "last_seen_epoch": "1533964574.365861", "responder_bytes": 164, "first_seen_epoch": "1533964574.365606" }, { "bytes": 9899, "stream": 164, "flow_id": "flow-68b91b8dc0336d0bacbf349b", "packets": 24, "transport": "tcp", "last_frame": 6745, "first_frame": 6514, "initiator_ip": "192.168.1.95", "responder_ip": "72.21.81.200", "initiator_port": 49321, "responder_port": 443, "initiator_bytes": 1651, "last_seen_epoch": "1533964664.36989", "responder_bytes": 8248, "first_seen_epoch": "1533964574.366978" }, { "bytes": 8583, "stream": 165, "flow_id": "flow-75666ce692e989ea2bcfe4ff", "packets": 19, "transport": "tcp", "last_frame": 6743, "first_frame": 6515, "initiator_ip": "192.168.1.95", "responder_ip": "72.21.81.200", "initiator_port": 49322, "responder_port": 443, "initiator_bytes": 924, "last_seen_epoch": "1533964664.301086", "responder_bytes": 7659, "first_seen_epoch": "1533964574.366979" }, { "bytes": 223, "stream": 87, "flow_id": "flow-6cc02a0662cdef9e7bd12b66", "packets": 2, "transport": "udp", "last_frame": 6567, "first_frame": 6566, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 51272, "responder_port": 53, "initiator_bytes": 74, "last_seen_epoch": "1533964577.20366", "responder_bytes": 149, "first_seen_epoch": "1533964577.036284" }, { "bytes": 7413, "stream": 166, "flow_id": "flow-758f2a677e779e0d741b389f", "packets": 30, "transport": "tcp", "last_frame": 6600, "first_frame": 6568, "initiator_ip": "192.168.1.95", "responder_ip": "87.250.251.37", "initiator_port": 49323, "responder_port": 995, "initiator_bytes": 1405, "last_seen_epoch": "1533964580.93601", "responder_bytes": 6008, "first_seen_epoch": "1533964577.228352" }, { "bytes": 660, "stream": 167, "flow_id": "flow-10df0f637ef00683b68d9820", "packets": 11, "transport": "tcp", "last_frame": 6722, "first_frame": 6621, "initiator_ip": "192.168.1.6", "responder_ip": "192.168.1.95", "initiator_port": 445, "responder_port": 49206, "initiator_bytes": 660, "last_seen_epoch": "1533964627.664911", "responder_bytes": 0, "first_seen_epoch": "1533964607.585132" }, { "bytes": 1316, "stream": 168, "flow_id": "flow-c8440e18ef6f3593c7c92c66", "packets": 12, "transport": "tcp", "last_frame": 6721, "first_frame": 6638, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 49324, "responder_port": 135, "initiator_bytes": 742, "last_seen_epoch": "1533964627.256695", "responder_bytes": 574, "first_seen_epoch": "1533964617.248501" }, { "bytes": 1504, "stream": 169, "flow_id": "flow-a6d49dfcc371d0f10f783d6e", "packets": 12, "transport": "tcp", "last_frame": 6719, "first_frame": 6645, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 49325, "responder_port": 49155, "initiator_bytes": 898, "last_seen_epoch": "1533964627.256497", "responder_bytes": 606, "first_seen_epoch": "1533964617.250328" }, { "bytes": 1733, "stream": 170, "flow_id": "flow-88423ca6cd3ee0ef863fa27c", "packets": 16, "transport": "tcp", "last_frame": 6972, "first_frame": 6684, "initiator_ip": "192.168.1.95", "responder_ip": "136.243.25.70", "initiator_port": 49326, "responder_port": 443, "initiator_bytes": 808, "last_seen_epoch": "1533964664.451277", "responder_bytes": 925, "first_seen_epoch": "1533964621.920463" }, { "bytes": 2340, "stream": 171, "flow_id": "flow-f11227d3b8befc91d1eced7f", "packets": 20, "transport": "tcp", "last_frame": 6969, "first_frame": 6685, "initiator_ip": "192.168.1.95", "responder_ip": "136.243.25.70", "initiator_port": 49327, "responder_port": 443, "initiator_bytes": 1423, "last_seen_epoch": "1533964664.450914", "responder_bytes": 917, "first_seen_epoch": "1533964621.920465" }, { "bytes": 258, "stream": 88, "flow_id": "flow-fa0f7d9c60e5d9615406fe16", "packets": 2, "transport": "udp", "last_frame": 7089, "first_frame": 7088, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 50628, "responder_port": 53, "initiator_bytes": 75, "last_seen_epoch": "1533964677.42117", "responder_bytes": 183, "first_seen_epoch": "1533964677.171851" }, { "bytes": 11971, "stream": 172, "flow_id": "flow-d1967d8343d1458285d06e33", "packets": 51, "transport": "tcp", "last_frame": 7162, "first_frame": 7090, "initiator_ip": "192.168.1.95", "responder_ip": "77.88.21.38", "initiator_port": 49328, "responder_port": 465, "initiator_bytes": 4701, "last_seen_epoch": "1533964686.038026", "responder_bytes": 7270, "first_seen_epoch": "1533964677.422353" }, { "bytes": 1673, "stream": 173, "flow_id": "flow-223891f1b72d3536839d3bbb", "packets": 15, "transport": "tcp", "last_frame": 7254, "first_frame": 7132, "initiator_ip": "192.168.1.95", "responder_ip": "136.243.25.70", "initiator_port": 49330, "responder_port": 443, "initiator_bytes": 748, "last_seen_epoch": "1533964770.075797", "responder_bytes": 925, "first_seen_epoch": "1533964681.935607" }, { "bytes": 2252, "stream": 174, "flow_id": "flow-14b600d9cc6bd844d09ce02c", "packets": 18, "transport": "tcp", "last_frame": 7251, "first_frame": 7133, "initiator_ip": "192.168.1.95", "responder_ip": "136.243.25.70", "initiator_port": 49329, "responder_port": 443, "initiator_bytes": 1363, "last_seen_epoch": "1533964770.075364", "responder_bytes": 889, "first_seen_epoch": "1533964681.93561" }, { "bytes": 1359, "stream": 175, "flow_id": "flow-6de9abbbcbfa0baf71b45610", "packets": 14, "transport": "tcp", "last_frame": 7342, "first_frame": 7170, "initiator_ip": "192.168.1.95", "responder_ip": "50.16.201.198", "initiator_port": 49331, "responder_port": 443, "initiator_bytes": 697, "last_seen_epoch": "1533964875.332204", "responder_bytes": 662, "first_seen_epoch": "1533964739.824665" }, { "bytes": 2401, "stream": 176, "flow_id": "flow-8dbeee79bfcc82b0a6397d0b", "packets": 17, "transport": "tcp", "last_frame": 7340, "first_frame": 7171, "initiator_ip": "192.168.1.95", "responder_ip": "50.16.201.198", "initiator_port": 49332, "responder_port": 443, "initiator_bytes": 1408, "last_seen_epoch": "1533964875.332195", "responder_bytes": 993, "first_seen_epoch": "1533964739.824666" }, { "bytes": 13887, "stream": 177, "flow_id": "flow-3b3cbb0b3fa39f85e09891e7", "packets": 52, "transport": "tcp", "last_frame": 7248, "first_frame": 7197, "initiator_ip": "192.168.1.95", "responder_ip": "87.250.251.37", "initiator_port": 49333, "responder_port": 995, "initiator_bytes": 2101, "last_seen_epoch": "1533964768.678272", "responder_bytes": 11786, "first_seen_epoch": "1533964760.61047" }, { "bytes": 152, "stream": 89, "flow_id": "flow-a4b345f86ccc275bd7361f23", "packets": 2, "transport": "udp", "last_frame": 7259, "first_frame": 7256, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 64943, "responder_port": 53, "initiator_bytes": 68, "last_seen_epoch": "1533964850.053278", "responder_bytes": 84, "first_seen_epoch": "1533964849.660908" }, { "bytes": 1387, "stream": 178, "flow_id": "flow-9044b194074e93d9e5b76295", "packets": 10, "transport": "tcp", "last_frame": 17018, "first_frame": 7260, "initiator_ip": "192.168.1.95", "responder_ip": "149.129.222.112", "initiator_port": 49334, "responder_port": 80, "initiator_bytes": 758, "last_seen_epoch": "1533964916.18851", "responder_bytes": 629, "first_seen_epoch": "1533964850.057854" }, { "bytes": 108042, "stream": 179, "flow_id": "flow-1ade26af091c21f6e3e5559a", "packets": 55, "transport": "tcp", "last_frame": 7328, "first_frame": 7274, "initiator_ip": "192.168.1.95", "responder_ip": "149.129.222.112", "initiator_port": 49335, "responder_port": 80, "initiator_bytes": 1477, "last_seen_epoch": "1533964860.812624", "responder_bytes": 106565, "first_seen_epoch": "1533964857.212049" }, { "bytes": 4440, "stream": 180, "flow_id": "flow-1427332b86f9f5ac5664f1b3", "packets": 19, "transport": "tcp", "last_frame": 22852, "first_frame": 7336, "initiator_ip": "192.168.1.95", "responder_ip": "50.16.201.198", "initiator_port": 49337, "responder_port": 443, "initiator_bytes": 952, "last_seen_epoch": "1533964990.542224", "responder_bytes": 3488, "first_seen_epoch": "1533964874.804584" }, { "bytes": 6744, "stream": 181, "flow_id": "flow-1aabeb4cc0cbc2bf038252c1", "packets": 26, "transport": "tcp", "last_frame": 22850, "first_frame": 7337, "initiator_ip": "192.168.1.95", "responder_ip": "50.16.201.198", "initiator_port": 49336, "responder_port": 443, "initiator_bytes": 2474, "last_seen_epoch": "1533964990.528485", "responder_bytes": 4270, "first_seen_epoch": "1533964874.804585" }, { "bytes": 3410, "stream": 182, "flow_id": "flow-288350836539421d272170e1", "packets": 24, "transport": "tcp", "last_frame": 22693, "first_frame": 7374, "initiator_ip": "192.168.1.95", "responder_ip": "136.243.25.70", "initiator_port": 49338, "responder_port": 443, "initiator_bytes": 2230, "last_seen_epoch": "1533964990.313406", "responder_bytes": 1180, "first_seen_epoch": "1533964893.935688" }, { "bytes": 4792, "stream": 183, "flow_id": "flow-544fd54a978f877345e5f346", "packets": 26, "transport": "tcp", "last_frame": 14301, "first_frame": 7375, "initiator_ip": "192.168.1.95", "responder_ip": "136.243.25.70", "initiator_port": 49339, "responder_port": 443, "initiator_bytes": 3313, "last_seen_epoch": "1533964904.227763", "responder_bytes": 1479, "first_seen_epoch": "1533964893.93569" }, { "bytes": 7760, "stream": 184, "flow_id": "flow-0d364bb1c190f9cda4eb9c5f", "packets": 24, "transport": "tcp", "last_frame": 22692, "first_frame": 7398, "initiator_ip": "192.168.1.95", "responder_ip": "93.158.134.119", "initiator_port": 49340, "responder_port": 443, "initiator_bytes": 1875, "last_seen_epoch": "1533964990.313177", "responder_bytes": 5885, "first_seen_epoch": "1533964896.5487" }, { "bytes": 12488, "stream": 185, "flow_id": "flow-5a12d3fe039c139a86e6faab", "packets": 37, "transport": "tcp", "last_frame": 22689, "first_frame": 7399, "initiator_ip": "192.168.1.95", "responder_ip": "93.158.134.119", "initiator_port": 49341, "responder_port": 443, "initiator_bytes": 4998, "last_seen_epoch": "1533964990.312532", "responder_bytes": 7490, "first_seen_epoch": "1533964896.54884" }, { "bytes": 22209, "stream": 186, "flow_id": "flow-14427f74a0e5cd49c0fbf800", "packets": 40, "transport": "tcp", "last_frame": 22687, "first_frame": 7402, "initiator_ip": "192.168.1.95", "responder_ip": "207.244.80.166", "initiator_port": 49342, "responder_port": 443, "initiator_bytes": 3574, "last_seen_epoch": "1533964990.312094", "responder_bytes": 18635, "first_seen_epoch": "1533964896.568702" }, { "bytes": 4334, "stream": 187, "flow_id": "flow-da236206d69ffadb5e0af38f", "packets": 19, "transport": "tcp", "last_frame": 22688, "first_frame": 7403, "initiator_ip": "192.168.1.95", "responder_ip": "207.244.80.166", "initiator_port": 49343, "responder_port": 443, "initiator_bytes": 896, "last_seen_epoch": "1533964990.312322", "responder_bytes": 3438, "first_seen_epoch": "1533964896.568705" }, { "bytes": 107797, "stream": 188, "flow_id": "flow-bb9644944ee217750f375952", "packets": 137, "transport": "tcp", "last_frame": 22676, "first_frame": 7478, "initiator_ip": "192.168.1.95", "responder_ip": "185.28.71.53", "initiator_port": 49344, "responder_port": 443, "initiator_bytes": 5811, "last_seen_epoch": "1533964990.308433", "responder_bytes": 101986, "first_seen_epoch": "1533964897.201997" }, { "bytes": 115582, "stream": 189, "flow_id": "flow-51b08aafcdc657adf6283486", "packets": 150, "transport": "tcp", "last_frame": 22678, "first_frame": 7479, "initiator_ip": "192.168.1.95", "responder_ip": "185.28.71.53", "initiator_port": 49345, "responder_port": 443, "initiator_bytes": 5544, "last_seen_epoch": "1533964990.309136", "responder_bytes": 110038, "first_seen_epoch": "1533964897.202116" }, { "bytes": 160372, "stream": 190, "flow_id": "flow-37b397e9ff5feb8a0675836a", "packets": 184, "transport": "tcp", "last_frame": 22677, "first_frame": 7480, "initiator_ip": "192.168.1.95", "responder_ip": "185.28.71.53", "initiator_port": 49346, "responder_port": 443, "initiator_bytes": 6520, "last_seen_epoch": "1533964990.308805", "responder_bytes": 153852, "first_seen_epoch": "1533964897.20304" }, { "bytes": 59190, "stream": 191, "flow_id": "flow-4786192f512cd2f59dba8c8f", "packets": 73, "transport": "tcp", "last_frame": 22680, "first_frame": 7481, "initiator_ip": "192.168.1.95", "responder_ip": "185.28.71.53", "initiator_port": 49347, "responder_port": 443, "initiator_bytes": 3891, "last_seen_epoch": "1533964990.309888", "responder_bytes": 55299, "first_seen_epoch": "1533964897.203649" }, { "bytes": 101673, "stream": 192, "flow_id": "flow-8a7d1be3123d024ffb1589d0", "packets": 125, "transport": "tcp", "last_frame": 22672, "first_frame": 7482, "initiator_ip": "192.168.1.95", "responder_ip": "185.28.71.53", "initiator_port": 49348, "responder_port": 443, "initiator_bytes": 5451, "last_seen_epoch": "1533964990.308017", "responder_bytes": 96222, "first_seen_epoch": "1533964897.213788" }, { "bytes": 31035, "stream": 193, "flow_id": "flow-2e7330407cf53e2855fccd4f", "packets": 45, "transport": "tcp", "last_frame": 22679, "first_frame": 7483, "initiator_ip": "192.168.1.95", "responder_ip": "185.28.71.53", "initiator_port": 49349, "responder_port": 443, "initiator_bytes": 2380, "last_seen_epoch": "1533964990.309522", "responder_bytes": 28655, "first_seen_epoch": "1533964897.216364" }, { "bytes": 220, "stream": 90, "flow_id": "flow-314172505005ec0fa880b1fb", "packets": 2, "transport": "udp", "last_frame": 7515, "first_frame": 7484, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 49524, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1533964897.312123", "responder_bytes": 144, "first_seen_epoch": "1533964897.219566" }, { "bytes": 6298, "stream": 194, "flow_id": "flow-970778b077570cf18fc59b5a", "packets": 18, "transport": "tcp", "last_frame": 22665, "first_frame": 7516, "initiator_ip": "192.168.1.95", "responder_ip": "205.185.216.42", "initiator_port": 49350, "responder_port": 443, "initiator_bytes": 918, "last_seen_epoch": "1533964990.307595", "responder_bytes": 5380, "first_seen_epoch": "1533964897.325081" }, { "bytes": 98276, "stream": 195, "flow_id": "flow-bba3447c5466594d52fe9121", "packets": 116, "transport": "tcp", "last_frame": 22664, "first_frame": 7517, "initiator_ip": "192.168.1.95", "responder_ip": "205.185.216.42", "initiator_port": 49351, "responder_port": 443, "initiator_bytes": 4257, "last_seen_epoch": "1533964990.307231", "responder_bytes": 94019, "first_seen_epoch": "1533964897.325247" }, { "bytes": 27615, "stream": 196, "flow_id": "flow-21bd195675171486a7369541", "packets": 92, "transport": "tcp", "last_frame": 39395, "first_frame": 7629, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.194.162", "initiator_port": 49352, "responder_port": 443, "initiator_bytes": 9646, "last_seen_epoch": "1533965249.300396", "responder_bytes": 17969, "first_seen_epoch": "1533964897.565911" }, { "bytes": 28985, "stream": 197, "flow_id": "flow-15404cf6d0b695fb83d0ac44", "packets": 100, "transport": "tcp", "last_frame": 39396, "first_frame": 7630, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.194.162", "initiator_port": 49353, "responder_port": 443, "initiator_bytes": 10217, "last_seen_epoch": "1533965249.300543", "responder_bytes": 18768, "first_seen_epoch": "1533964897.566178" }, { "bytes": 22643, "stream": 198, "flow_id": "flow-16f97b3664239811412b7004", "packets": 48, "transport": "tcp", "last_frame": 22683, "first_frame": 7722, "initiator_ip": "192.168.1.95", "responder_ip": "173.241.250.220", "initiator_port": 49354, "responder_port": 443, "initiator_bytes": 5099, "last_seen_epoch": "1533964990.310976", "responder_bytes": 17544, "first_seen_epoch": "1533964897.616329" }, { "bytes": 5521, "stream": 199, "flow_id": "flow-86e9799de79548fd5953686c", "packets": 20, "transport": "tcp", "last_frame": 22684, "first_frame": 7723, "initiator_ip": "192.168.1.95", "responder_ip": "173.241.250.220", "initiator_port": 49355, "responder_port": 443, "initiator_bytes": 2163, "last_seen_epoch": "1533964990.311301", "responder_bytes": 3358, "first_seen_epoch": "1533964897.616429" }, { "bytes": 258052, "stream": 200, "flow_id": "flow-fa8dba89a88806258ccff2aa", "packets": 268, "transport": "tcp", "last_frame": 22658, "first_frame": 7726, "initiator_ip": "192.168.1.95", "responder_ip": "213.180.193.90", "initiator_port": 49356, "responder_port": 443, "initiator_bytes": 11864, "last_seen_epoch": "1533964990.306491", "responder_bytes": 246188, "first_seen_epoch": "1533964897.630034" }, { "bytes": 12538, "stream": 201, "flow_id": "flow-b7585ccc40e56cc4d70b814d", "packets": 37, "transport": "tcp", "last_frame": 22657, "first_frame": 7727, "initiator_ip": "192.168.1.95", "responder_ip": "213.180.193.90", "initiator_port": 49357, "responder_port": 443, "initiator_bytes": 4850, "last_seen_epoch": "1533964990.306111", "responder_bytes": 7688, "first_seen_epoch": "1533964897.630202" }, { "bytes": 65394, "stream": 202, "flow_id": "flow-ff8dfc3c565157e0a8df27ba", "packets": 90, "transport": "tcp", "last_frame": 22838, "first_frame": 7764, "initiator_ip": "192.168.1.95", "responder_ip": "172.217.6.78", "initiator_port": 49358, "responder_port": 443, "initiator_bytes": 5202, "last_seen_epoch": "1533964990.457943", "responder_bytes": 60192, "first_seen_epoch": "1533964897.648166" }, { "bytes": 56477, "stream": 203, "flow_id": "flow-a09e4612fc90cb9bff005de2", "packets": 65, "transport": "tcp", "last_frame": 22844, "first_frame": 7765, "initiator_ip": "192.168.1.95", "responder_ip": "172.217.6.78", "initiator_port": 49359, "responder_port": 443, "initiator_bytes": 2554, "last_seen_epoch": "1533964990.507853", "responder_bytes": 53923, "first_seen_epoch": "1533964897.64832" }, { "bytes": 156, "stream": 91, "flow_id": "flow-64d865059c1c7db21966f541", "packets": 2, "transport": "udp", "last_frame": 8116, "first_frame": 7800, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 51374, "responder_port": 53, "initiator_bytes": 70, "last_seen_epoch": "1533964897.941119", "responder_bytes": 86, "first_seen_epoch": "1533964897.662014" }, { "bytes": 252, "stream": 92, "flow_id": "flow-e2e4b01dca88dc5cbebc9963", "packets": 2, "transport": "udp", "last_frame": 8147, "first_frame": 7801, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 64152, "responder_port": 53, "initiator_bytes": 79, "last_seen_epoch": "1533964897.948811", "responder_bytes": 173, "first_seen_epoch": "1533964897.663527" }, { "bytes": 7613, "stream": 204, "flow_id": "flow-9c29b43632d98ba6edaa11a7", "packets": 20, "transport": "tcp", "last_frame": 22652, "first_frame": 8127, "initiator_ip": "192.168.1.95", "responder_ip": "173.0.153.44", "initiator_port": 49360, "responder_port": 443, "initiator_bytes": 1339, "last_seen_epoch": "1533964990.304881", "responder_bytes": 6274, "first_seen_epoch": "1533964897.942562" }, { "bytes": 12029, "stream": 205, "flow_id": "flow-c50a3331bc2dbe27b2ad2907", "packets": 32, "transport": "tcp", "last_frame": 22651, "first_frame": 8128, "initiator_ip": "192.168.1.95", "responder_ip": "173.0.153.44", "initiator_port": 49361, "responder_port": 443, "initiator_bytes": 2721, "last_seen_epoch": "1533964990.304487", "responder_bytes": 9308, "first_seen_epoch": "1533964897.942563" }, { "bytes": 13739, "stream": 206, "flow_id": "flow-488ae870e7a15f4bfb66997f", "packets": 29, "transport": "tcp", "last_frame": 22836, "first_frame": 8149, "initiator_ip": "192.168.1.95", "responder_ip": "23.220.174.162", "initiator_port": 49362, "responder_port": 443, "initiator_bytes": 2450, "last_seen_epoch": "1533964990.448796", "responder_bytes": 11289, "first_seen_epoch": "1533964897.94955" }, { "bytes": 54799, "stream": 207, "flow_id": "flow-5fc82cef02b3728a31d0cbc0", "packets": 71, "transport": "tcp", "last_frame": 22835, "first_frame": 8151, "initiator_ip": "192.168.1.95", "responder_ip": "23.220.174.162", "initiator_port": 49363, "responder_port": 443, "initiator_bytes": 3694, "last_seen_epoch": "1533964990.448795", "responder_bytes": 51105, "first_seen_epoch": "1533964897.949748" }, { "bytes": 1146, "stream": 208, "flow_id": "flow-3e461dff99923f04072d6849", "packets": 13, "transport": "tcp", "last_frame": 22644, "first_frame": 8288, "initiator_ip": "192.168.1.95", "responder_ip": "88.212.196.123", "initiator_port": 49364, "responder_port": 443, "initiator_bytes": 655, "last_seen_epoch": "1533964990.302766", "responder_bytes": 491, "first_seen_epoch": "1533964898.08511" }, { "bytes": 3443, "stream": 209, "flow_id": "flow-eecbf0c667ffb2a78cb31fde", "packets": 18, "transport": "tcp", "last_frame": 17020, "first_frame": 8289, "initiator_ip": "192.168.1.95", "responder_ip": "88.212.196.123", "initiator_port": 49365, "responder_port": 443, "initiator_bytes": 1880, "last_seen_epoch": "1533964916.56805", "responder_bytes": 1563, "first_seen_epoch": "1533964898.085267" }, { "bytes": 4217, "stream": 210, "flow_id": "flow-d98b31c4aaedc0fcd0fb5728", "packets": 16, "transport": "tcp", "last_frame": 22643, "first_frame": 8290, "initiator_ip": "192.168.1.95", "responder_ip": "194.226.130.229", "initiator_port": 49366, "responder_port": 443, "initiator_bytes": 1068, "last_seen_epoch": "1533964990.302407", "responder_bytes": 3149, "first_seen_epoch": "1533964898.085976" }, { "bytes": 6861, "stream": 211, "flow_id": "flow-c301168578ff61a54bad72e4", "packets": 26, "transport": "tcp", "last_frame": 22642, "first_frame": 8291, "initiator_ip": "192.168.1.95", "responder_ip": "194.226.130.229", "initiator_port": 49367, "responder_port": 443, "initiator_bytes": 2294, "last_seen_epoch": "1533964990.301985", "responder_bytes": 4567, "first_seen_epoch": "1533964898.086216" }, { "bytes": 6642, "stream": 212, "flow_id": "flow-bdc2133c099458b8fcc8deaa", "packets": 21, "transport": "tcp", "last_frame": 22648, "first_frame": 8346, "initiator_ip": "192.168.1.95", "responder_ip": "23.55.50.209", "initiator_port": 49368, "responder_port": 443, "initiator_bytes": 1002, "last_seen_epoch": "1533964990.303603", "responder_bytes": 5640, "first_seen_epoch": "1533964898.157818" }, { "bytes": 7908, "stream": 213, "flow_id": "flow-b99d68c7be69cf02842d80ab", "packets": 24, "transport": "tcp", "last_frame": 22832, "first_frame": 8347, "initiator_ip": "192.168.1.95", "responder_ip": "23.55.50.209", "initiator_port": 49369, "responder_port": 443, "initiator_bytes": 1861, "last_seen_epoch": "1533964990.438057", "responder_bytes": 6047, "first_seen_epoch": "1533964898.158054" }, { "bytes": 3430, "stream": 214, "flow_id": "flow-39ff27ccfc6dbd413c4b96a4", "packets": 17, "transport": "tcp", "last_frame": 22814, "first_frame": 8348, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.192.14", "initiator_port": 49370, "responder_port": 443, "initiator_bytes": 1766, "last_seen_epoch": "1533964990.414248", "responder_bytes": 1664, "first_seen_epoch": "1533964898.183483" }, { "bytes": 1208, "stream": 215, "flow_id": "flow-94dba52fa477b760b5b3618a", "packets": 13, "transport": "tcp", "last_frame": 22819, "first_frame": 8349, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.192.14", "initiator_port": 49371, "responder_port": 443, "initiator_bytes": 687, "last_seen_epoch": "1533964990.41501", "responder_bytes": 521, "first_seen_epoch": "1533964898.183652" }, { "bytes": 178, "stream": 93, "flow_id": "flow-9443c2ebf8c83233dde31abf", "packets": 2, "transport": "udp", "last_frame": 8506, "first_frame": 8439, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 60978, "responder_port": 53, "initiator_bytes": 73, "last_seen_epoch": "1533964898.378728", "responder_bytes": 105, "first_seen_epoch": "1533964898.292183" }, { "bytes": 7224, "stream": 216, "flow_id": "flow-5f9ca2e7bc1125599eeec92e", "packets": 25, "transport": "tcp", "last_frame": 22811, "first_frame": 8508, "initiator_ip": "192.168.1.95", "responder_ip": "104.25.163.34", "initiator_port": 49372, "responder_port": 443, "initiator_bytes": 1921, "last_seen_epoch": "1533964990.413593", "responder_bytes": 5303, "first_seen_epoch": "1533964898.37941" }, { "bytes": 203, "stream": 94, "flow_id": "flow-ef5e2e4f7611d6a764432670", "packets": 2, "transport": "udp", "last_frame": 8583, "first_frame": 8557, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 58610, "responder_port": 53, "initiator_bytes": 78, "last_seen_epoch": "1533964898.485161", "responder_bytes": 125, "first_seen_epoch": "1533964898.439074" }, { "bytes": 214, "stream": 95, "flow_id": "flow-88909555be5a16ab8ebeead6", "packets": 2, "transport": "udp", "last_frame": 8582, "first_frame": 8558, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 51723, "responder_port": 53, "initiator_bytes": 78, "last_seen_epoch": "1533964898.48516", "responder_bytes": 136, "first_seen_epoch": "1533964898.441696" }, { "bytes": 170, "stream": 96, "flow_id": "flow-1af6feebeed685505d4a2770", "packets": 2, "transport": "udp", "last_frame": 8628, "first_frame": 8579, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 51524, "responder_port": 53, "initiator_bytes": 77, "last_seen_epoch": "1533964898.548203", "responder_bytes": 93, "first_seen_epoch": "1533964898.482071" }, { "bytes": 1799, "stream": 217, "flow_id": "flow-2d7a23e60de148a459d98441", "packets": 8, "transport": "tcp", "last_frame": 19238, "first_frame": 8584, "initiator_ip": "192.168.1.95", "responder_ip": "192.35.177.64", "initiator_port": 49373, "responder_port": 80, "initiator_bytes": 439, "last_seen_epoch": "1533964961.521069", "responder_bytes": 1360, "first_seen_epoch": "1533964898.485786" }, { "bytes": 1799, "stream": 218, "flow_id": "flow-9bbdf3ec4f71d3cd137beecc", "packets": 8, "transport": "tcp", "last_frame": 19237, "first_frame": 8587, "initiator_ip": "192.168.1.95", "responder_ip": "192.35.177.64", "initiator_port": 49374, "responder_port": 80, "initiator_bytes": 439, "last_seen_epoch": "1533964961.520976", "responder_bytes": 1360, "first_seen_epoch": "1533964898.486362" }, { "bytes": 1159, "stream": 219, "flow_id": "flow-c7ab2324493ea6cc0410f2d2", "packets": 13, "transport": "tcp", "last_frame": 22827, "first_frame": 8596, "initiator_ip": "192.168.1.95", "responder_ip": "74.125.195.156", "initiator_port": 49375, "responder_port": 443, "initiator_bytes": 662, "last_seen_epoch": "1533964990.433007", "responder_bytes": 497, "first_seen_epoch": "1533964898.497184" }, { "bytes": 2977, "stream": 220, "flow_id": "flow-721d6993ac2d64a6aff8d94f", "packets": 17, "transport": "tcp", "last_frame": 22829, "first_frame": 8597, "initiator_ip": "192.168.1.95", "responder_ip": "74.125.195.156", "initiator_port": 49376, "responder_port": 443, "initiator_bytes": 1376, "last_seen_epoch": "1533964990.433219", "responder_bytes": 1601, "first_seen_epoch": "1533964898.497185" }, { "bytes": 11276, "stream": 221, "flow_id": "flow-0bbbcab2f40da34a6ae71e99", "packets": 42, "transport": "tcp", "last_frame": 22634, "first_frame": 8614, "initiator_ip": "192.168.1.95", "responder_ip": "173.241.250.143", "initiator_port": 49377, "responder_port": 443, "initiator_bytes": 4568, "last_seen_epoch": "1533964990.299374", "responder_bytes": 6708, "first_seen_epoch": "1533964898.53384" }, { "bytes": 4226, "stream": 222, "flow_id": "flow-afe0d829ae7a20b6875f79aa", "packets": 20, "transport": "tcp", "last_frame": 14308, "first_frame": 8615, "initiator_ip": "192.168.1.95", "responder_ip": "173.241.250.143", "initiator_port": 49378, "responder_port": 443, "initiator_bytes": 968, "last_seen_epoch": "1533964904.230887", "responder_bytes": 3258, "first_seen_epoch": "1533964898.534261" }, { "bytes": 7134, "stream": 223, "flow_id": "flow-500f8a2f05aa24192f80e225", "packets": 20, "transport": "tcp", "last_frame": 22640, "first_frame": 8629, "initiator_ip": "192.168.1.95", "responder_ip": "95.142.20.17", "initiator_port": 49379, "responder_port": 443, "initiator_bytes": 979, "last_seen_epoch": "1533964990.301359", "responder_bytes": 6155, "first_seen_epoch": "1533964898.548718" }, { "bytes": 27210, "stream": 224, "flow_id": "flow-ac04cd815372cbcded265c71", "packets": 43, "transport": "tcp", "last_frame": 22639, "first_frame": 8630, "initiator_ip": "192.168.1.95", "responder_ip": "95.142.20.17", "initiator_port": 49380, "responder_port": 443, "initiator_bytes": 2514, "last_seen_epoch": "1533964990.300971", "responder_bytes": 24696, "first_seen_epoch": "1533964898.548885" }, { "bytes": 11938, "stream": 225, "flow_id": "flow-d4b6e95f344f45e74c79b411", "packets": 32, "transport": "tcp", "last_frame": 22845, "first_frame": 8659, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.192.2", "initiator_port": 49381, "responder_port": 443, "initiator_bytes": 4901, "last_seen_epoch": "1533964990.508038", "responder_bytes": 7037, "first_seen_epoch": "1533964898.607866" }, { "bytes": 4414, "stream": 226, "flow_id": "flow-2d8dc21ab4e7a30e358c50f8", "packets": 21, "transport": "tcp", "last_frame": 22846, "first_frame": 8660, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.192.2", "initiator_port": 49382, "responder_port": 443, "initiator_bytes": 2711, "last_seen_epoch": "1533964990.50804", "responder_bytes": 1703, "first_seen_epoch": "1533964898.608003" }, { "bytes": 4117, "stream": 227, "flow_id": "flow-62a1c637d0b320df83542599", "packets": 18, "transport": "tcp", "last_frame": 22686, "first_frame": 8665, "initiator_ip": "192.168.1.95", "responder_ip": "173.241.250.220", "initiator_port": 49383, "responder_port": 443, "initiator_bytes": 912, "last_seen_epoch": "1533964990.311717", "responder_bytes": 3205, "first_seen_epoch": "1533964898.616851" }, { "bytes": 511673, "stream": 228, "flow_id": "flow-20c7efcf45d0721b33c1401c", "packets": 487, "transport": "tcp", "last_frame": 22847, "first_frame": 8670, "initiator_ip": "192.168.1.95", "responder_ip": "172.217.6.78", "initiator_port": 49384, "responder_port": 443, "initiator_bytes": 16764, "last_seen_epoch": "1533964990.50829", "responder_bytes": 494909, "first_seen_epoch": "1533964898.627343" }, { "bytes": 4700, "stream": 229, "flow_id": "flow-35ed2e3cd7746e14e97bc3b0", "packets": 22, "transport": "tcp", "last_frame": 22848, "first_frame": 8671, "initiator_ip": "192.168.1.95", "responder_ip": "172.217.6.78", "initiator_port": 49385, "responder_port": 443, "initiator_bytes": 3230, "last_seen_epoch": "1533964990.508293", "responder_bytes": 1470, "first_seen_epoch": "1533964898.627707" }, { "bytes": 238, "stream": 97, "flow_id": "flow-f7c884ddb6f419498ad82b69", "packets": 2, "transport": "udp", "last_frame": 8972, "first_frame": 8909, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 56692, "responder_port": 53, "initiator_bytes": 73, "last_seen_epoch": "1533964898.93721", "responder_bytes": 165, "first_seen_epoch": "1533964898.852948" }, { "bytes": 443, "stream": 98, "flow_id": "flow-c83bdf5f7f72404adbb207f7", "packets": 2, "transport": "udp", "last_frame": 8958, "first_frame": 8910, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 65328, "responder_port": 53, "initiator_bytes": 80, "last_seen_epoch": "1533964898.930359", "responder_bytes": 363, "first_seen_epoch": "1533964898.85377" }, { "bytes": 310, "stream": 99, "flow_id": "flow-a80aba84e2f7dbab90f5752d", "packets": 2, "transport": "udp", "last_frame": 8979, "first_frame": 8911, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 50552, "responder_port": 53, "initiator_bytes": 75, "last_seen_epoch": "1533964898.946941", "responder_bytes": 235, "first_seen_epoch": "1533964898.854136" }, { "bytes": 321, "stream": 100, "flow_id": "flow-630d8095fe1ed2b24c83ed22", "packets": 2, "transport": "udp", "last_frame": 8956, "first_frame": 8912, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 53829, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1533964898.930148", "responder_bytes": 249, "first_seen_epoch": "1533964898.855179" }, { "bytes": 178, "stream": 101, "flow_id": "flow-b38ca58277bdd7c202786d39", "packets": 2, "transport": "udp", "last_frame": 8957, "first_frame": 8913, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 63652, "responder_port": 53, "initiator_bytes": 81, "last_seen_epoch": "1533964898.930358", "responder_bytes": 97, "first_seen_epoch": "1533964898.856145" }, { "bytes": 334, "stream": 102, "flow_id": "flow-a808239d322407a6ec7b2bf3", "packets": 2, "transport": "udp", "last_frame": 8976, "first_frame": 8916, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 52861, "responder_port": 53, "initiator_bytes": 81, "last_seen_epoch": "1533964898.938935", "responder_bytes": 253, "first_seen_epoch": "1533964898.857493" }, { "bytes": 8759, "stream": 230, "flow_id": "flow-74e6d1e60bd5b590c680909f", "packets": 30, "transport": "tcp", "last_frame": 22628, "first_frame": 8959, "initiator_ip": "192.168.1.95", "responder_ip": "52.89.90.109", "initiator_port": 49386, "responder_port": 443, "initiator_bytes": 2240, "last_seen_epoch": "1533964990.297512", "responder_bytes": 6519, "first_seen_epoch": "1533964898.931066" }, { "bytes": 7755, "stream": 231, "flow_id": "flow-8946bd7ea919cdff12135a12", "packets": 28, "transport": "tcp", "last_frame": 22627, "first_frame": 8960, "initiator_ip": "192.168.1.95", "responder_ip": "52.89.90.109", "initiator_port": 49387, "responder_port": 443, "initiator_bytes": 1717, "last_seen_epoch": "1533964990.297114", "responder_bytes": 6038, "first_seen_epoch": "1533964898.931415" }, { "bytes": 11021, "stream": 232, "flow_id": "flow-c5d6ca6525e705e31b65c94b", "packets": 36, "transport": "tcp", "last_frame": 18470, "first_frame": 8961, "initiator_ip": "192.168.1.95", "responder_ip": "104.254.150.77", "initiator_port": 49388, "responder_port": 443, "initiator_bytes": 3680, "last_seen_epoch": "1533964959.053498", "responder_bytes": 7341, "first_seen_epoch": "1533964898.931602" }, { "bytes": 6847, "stream": 233, "flow_id": "flow-2d4de01efaf6198bc9342dad", "packets": 22, "transport": "tcp", "last_frame": 19034, "first_frame": 8962, "initiator_ip": "192.168.1.95", "responder_ip": "52.94.232.32", "initiator_port": 49389, "responder_port": 443, "initiator_bytes": 1043, "last_seen_epoch": "1533964960.499578", "responder_bytes": 5804, "first_seen_epoch": "1533964898.931932" }, { "bytes": 9680, "stream": 234, "flow_id": "flow-451c9e7d0e9d2783a5f849ad", "packets": 29, "transport": "tcp", "last_frame": 19093, "first_frame": 8963, "initiator_ip": "192.168.1.95", "responder_ip": "52.94.232.32", "initiator_port": 49390, "responder_port": 443, "initiator_bytes": 2165, "last_seen_epoch": "1533964960.616719", "responder_bytes": 7515, "first_seen_epoch": "1533964898.932241" }, { "bytes": 4344, "stream": 235, "flow_id": "flow-f22b0702bf75f3fb63c97fa6", "packets": 17, "transport": "tcp", "last_frame": 18515, "first_frame": 8964, "initiator_ip": "192.168.1.95", "responder_ip": "104.254.150.77", "initiator_port": 49391, "responder_port": 443, "initiator_bytes": 1379, "last_seen_epoch": "1533964959.154569", "responder_bytes": 2965, "first_seen_epoch": "1533964898.9325" }, { "bytes": 2405, "stream": 236, "flow_id": "flow-5cfc90d71aacbc89de256b73", "packets": 17, "transport": "tcp", "last_frame": 22808, "first_frame": 8971, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.192.4", "initiator_port": 49392, "responder_port": 443, "initiator_bytes": 1251, "last_seen_epoch": "1533964990.407518", "responder_bytes": 1154, "first_seen_epoch": "1533964898.937093" }, { "bytes": 1150, "stream": 237, "flow_id": "flow-d845603dce243d489cfbbd6a", "packets": 13, "transport": "tcp", "last_frame": 22623, "first_frame": 8973, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.192.4", "initiator_port": 49393, "responder_port": 443, "initiator_bytes": 653, "last_seen_epoch": "1533964990.295734", "responder_bytes": 497, "first_seen_epoch": "1533964898.937303" }, { "bytes": 6341, "stream": 238, "flow_id": "flow-c8b026c9f7aa1749c7a49c55", "packets": 21, "transport": "tcp", "last_frame": 18454, "first_frame": 8974, "initiator_ip": "192.168.1.95", "responder_ip": "185.167.164.37", "initiator_port": 49394, "responder_port": 443, "initiator_bytes": 959, "last_seen_epoch": "1533964959.046753", "responder_bytes": 5382, "first_seen_epoch": "1533964898.937702" }, { "bytes": 8447, "stream": 239, "flow_id": "flow-d7902edb912444a62b6f0951", "packets": 32, "transport": "tcp", "last_frame": 18450, "first_frame": 8975, "initiator_ip": "192.168.1.95", "responder_ip": "185.167.164.37", "initiator_port": 49395, "responder_port": 443, "initiator_bytes": 2181, "last_seen_epoch": "1533964959.046194", "responder_bytes": 6266, "first_seen_epoch": "1533964898.937857" }, { "bytes": 17443, "stream": 240, "flow_id": "flow-092a7be771133df4ba3dc6ff", "packets": 50, "transport": "tcp", "last_frame": 29737, "first_frame": 8977, "initiator_ip": "192.168.1.95", "responder_ip": "54.183.95.126", "initiator_port": 49396, "responder_port": 443, "initiator_bytes": 6883, "last_seen_epoch": "1533965097.471923", "responder_bytes": 10560, "first_seen_epoch": "1533964898.939323" }, { "bytes": 7613, "stream": 241, "flow_id": "flow-d0b34cd3b69ca116c2250320", "packets": 24, "transport": "tcp", "last_frame": 22624, "first_frame": 8978, "initiator_ip": "192.168.1.95", "responder_ip": "54.183.95.126", "initiator_port": 49397, "responder_port": 443, "initiator_bytes": 1806, "last_seen_epoch": "1533964990.295993", "responder_bytes": 5807, "first_seen_epoch": "1533964898.939484" }, { "bytes": 7574, "stream": 242, "flow_id": "flow-410beff681e80408f795113a", "packets": 21, "transport": "tcp", "last_frame": 22626, "first_frame": 8980, "initiator_ip": "192.168.1.95", "responder_ip": "35.185.244.37", "initiator_port": 49398, "responder_port": 443, "initiator_bytes": 977, "last_seen_epoch": "1533964990.296737", "responder_bytes": 6597, "first_seen_epoch": "1533964898.947613" }, { "bytes": 11764, "stream": 243, "flow_id": "flow-0058c103eb8f6d368733d165", "packets": 32, "transport": "tcp", "last_frame": 22625, "first_frame": 8981, "initiator_ip": "192.168.1.95", "responder_ip": "35.185.244.37", "initiator_port": 49399, "responder_port": 443, "initiator_bytes": 2918, "last_seen_epoch": "1533964990.29638", "responder_bytes": 8846, "first_seen_epoch": "1533964898.947777" }, { "bytes": 205, "stream": 103, "flow_id": "flow-c609f6d1cd728042afa5150a", "packets": 2, "transport": "udp", "last_frame": 9470, "first_frame": 9215, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 60204, "responder_port": 53, "initiator_bytes": 77, "last_seen_epoch": "1533964899.377567", "responder_bytes": 128, "first_seen_epoch": "1533964899.117813" }, { "bytes": 205, "stream": 104, "flow_id": "flow-1ab0a2180e205c2f249663cd", "packets": 2, "transport": "udp", "last_frame": 9471, "first_frame": 9220, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 58234, "responder_port": 53, "initiator_bytes": 77, "last_seen_epoch": "1533964899.377655", "responder_bytes": 128, "first_seen_epoch": "1533964899.12445" }, { "bytes": 236, "stream": 105, "flow_id": "flow-f0ec76ec4a7a7e2b2d9b1cb4", "packets": 2, "transport": "udp", "last_frame": 9340, "first_frame": 9226, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 59918, "responder_port": 53, "initiator_bytes": 70, "last_seen_epoch": "1533964899.269568", "responder_bytes": 166, "first_seen_epoch": "1533964899.129114" }, { "bytes": 4690, "stream": 244, "flow_id": "flow-8ad33492c3451a1a12e6612a", "packets": 18, "transport": "tcp", "last_frame": 22617, "first_frame": 9341, "initiator_ip": "192.168.1.95", "responder_ip": "136.243.42.249", "initiator_port": 49400, "responder_port": 443, "initiator_bytes": 1044, "last_seen_epoch": "1533964990.293469", "responder_bytes": 3646, "first_seen_epoch": "1533964899.270164" }, { "bytes": 36945, "stream": 245, "flow_id": "flow-7b49db2312c463c8f963e6fa", "packets": 57, "transport": "tcp", "last_frame": 22616, "first_frame": 9342, "initiator_ip": "192.168.1.95", "responder_ip": "136.243.42.249", "initiator_port": 49401, "responder_port": 443, "initiator_bytes": 6542, "last_seen_epoch": "1533964990.29309", "responder_bytes": 30403, "first_seen_epoch": "1533964899.270403" }, { "bytes": 234, "stream": 106, "flow_id": "flow-999dfbdfc6f1a895b888861e", "packets": 2, "transport": "udp", "last_frame": 9637, "first_frame": 9409, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 53869, "responder_port": 53, "initiator_bytes": 89, "last_seen_epoch": "1533964899.569932", "responder_bytes": 145, "first_seen_epoch": "1533964899.32547" }, { "bytes": 221, "stream": 107, "flow_id": "flow-0f926124e574d3eca67194e5", "packets": 2, "transport": "udp", "last_frame": 9794, "first_frame": 9410, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 51484, "responder_port": 53, "initiator_bytes": 77, "last_seen_epoch": "1533964899.640925", "responder_bytes": 144, "first_seen_epoch": "1533964899.326173" }, { "bytes": 26646, "stream": 246, "flow_id": "flow-e885042a11023814d18feaf5", "packets": 44, "transport": "tcp", "last_frame": 22801, "first_frame": 9421, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.194.162", "initiator_port": 49402, "responder_port": 443, "initiator_bytes": 5751, "last_seen_epoch": "1533964990.398448", "responder_bytes": 20895, "first_seen_epoch": "1533964899.336802" }, { "bytes": 2980, "stream": 247, "flow_id": "flow-5cc01a6eb98e13f2797a902f", "packets": 19, "transport": "tcp", "last_frame": 22794, "first_frame": 9422, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.194.162", "initiator_port": 49403, "responder_port": 443, "initiator_bytes": 1417, "last_seen_epoch": "1533964990.396556", "responder_bytes": 1563, "first_seen_epoch": "1533964899.336949" }, { "bytes": 58949, "stream": 248, "flow_id": "flow-9daeac0bf151f793fd3f3691", "packets": 87, "transport": "tcp", "last_frame": 22815, "first_frame": 9425, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.192.1", "initiator_port": 49404, "responder_port": 443, "initiator_bytes": 4137, "last_seen_epoch": "1533964990.41439", "responder_bytes": 54812, "first_seen_epoch": "1533964899.340401" }, { "bytes": 59177, "stream": 249, "flow_id": "flow-ed82070bdad08c60653de12f", "packets": 91, "transport": "tcp", "last_frame": 22820, "first_frame": 9426, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.192.1", "initiator_port": 49405, "responder_port": 443, "initiator_bytes": 4257, "last_seen_epoch": "1533964990.4151", "responder_bytes": 54920, "first_seen_epoch": "1533964899.3406" }, { "bytes": 68806, "stream": 250, "flow_id": "flow-eab35833b33b6c76da635a97", "packets": 80, "transport": "tcp", "last_frame": 29539, "first_frame": 9443, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.192.2", "initiator_port": 49406, "responder_port": 443, "initiator_bytes": 3943, "last_seen_epoch": "1533965095.52221", "responder_bytes": 64863, "first_seen_epoch": "1533964899.350284" }, { "bytes": 2912, "stream": 251, "flow_id": "flow-c62bd0ab6ff70686c9d3ed81", "packets": 19, "transport": "tcp", "last_frame": 22799, "first_frame": 9463, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.194.162", "initiator_port": 49407, "responder_port": 443, "initiator_bytes": 1417, "last_seen_epoch": "1533964990.39769", "responder_bytes": 1495, "first_seen_epoch": "1533964899.367727" }, { "bytes": 28468, "stream": 252, "flow_id": "flow-f17aabecb18a8a794a347c8f", "packets": 48, "transport": "tcp", "last_frame": 22795, "first_frame": 9464, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.194.162", "initiator_port": 49408, "responder_port": 443, "initiator_bytes": 6314, "last_seen_epoch": "1533964990.396663", "responder_bytes": 22154, "first_seen_epoch": "1533964899.368719" }, { "bytes": 2786, "stream": 253, "flow_id": "flow-858275e60b4d5f71c67b63dc", "packets": 17, "transport": "tcp", "last_frame": 29543, "first_frame": 9469, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.192.2", "initiator_port": 49409, "responder_port": 443, "initiator_bytes": 1686, "last_seen_epoch": "1533965095.522348", "responder_bytes": 1100, "first_seen_epoch": "1533964899.376889" }, { "bytes": 7013, "stream": 254, "flow_id": "flow-409795e77a965df131d8937c", "packets": 24, "transport": "tcp", "last_frame": 22618, "first_frame": 9472, "initiator_ip": "192.168.1.95", "responder_ip": "173.0.153.44", "initiator_port": 49411, "responder_port": 443, "initiator_bytes": 1562, "last_seen_epoch": "1533964990.293949", "responder_bytes": 5451, "first_seen_epoch": "1533964899.378011" }, { "bytes": 4955, "stream": 255, "flow_id": "flow-2935dd9cdba5eb7407c7c43b", "packets": 20, "transport": "tcp", "last_frame": 22621, "first_frame": 9473, "initiator_ip": "192.168.1.95", "responder_ip": "173.0.153.44", "initiator_port": 49410, "responder_port": 443, "initiator_bytes": 963, "last_seen_epoch": "1533964990.295101", "responder_bytes": 3992, "first_seen_epoch": "1533964899.378045" }, { "bytes": 4791, "stream": 256, "flow_id": "flow-fd217db2f7ae88f7da6e9e76", "packets": 20, "transport": "tcp", "last_frame": 22619, "first_frame": 9474, "initiator_ip": "192.168.1.95", "responder_ip": "173.0.153.44", "initiator_port": 49412, "responder_port": 443, "initiator_bytes": 963, "last_seen_epoch": "1533964990.294294", "responder_bytes": 3828, "first_seen_epoch": "1533964899.378215" }, { "bytes": 46327, "stream": 257, "flow_id": "flow-a88d0036e925c1f1d66c64bb", "packets": 60, "transport": "tcp", "last_frame": 22620, "first_frame": 9475, "initiator_ip": "192.168.1.95", "responder_ip": "173.0.153.44", "initiator_port": 49413, "responder_port": 443, "initiator_bytes": 2562, "last_seen_epoch": "1533964990.29468", "responder_bytes": 43765, "first_seen_epoch": "1533964899.378231" }, { "bytes": 260, "stream": 108, "flow_id": "flow-597315f56846b35b5c3cc9f0", "packets": 2, "transport": "udp", "last_frame": 9752, "first_frame": 9478, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 59835, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1533964899.625132", "responder_bytes": 184, "first_seen_epoch": "1533964899.379243" }, { "bytes": 31999, "stream": 258, "flow_id": "flow-f6972554d83807f25632e7e9", "packets": 53, "transport": "tcp", "last_frame": 22821, "first_frame": 9479, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.192.1", "initiator_port": 49414, "responder_port": 443, "initiator_bytes": 2319, "last_seen_epoch": "1533964990.415101", "responder_bytes": 29680, "first_seen_epoch": "1533964899.380005" }, { "bytes": 113821, "stream": 259, "flow_id": "flow-fda7272803d1965b26250d37", "packets": 183, "transport": "tcp", "last_frame": 39407, "first_frame": 9640, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.194.162", "initiator_port": 49415, "responder_port": 443, "initiator_bytes": 16617, "last_seen_epoch": "1533965249.301722", "responder_bytes": 97204, "first_seen_epoch": "1533964899.570561" }, { "bytes": 55378, "stream": 260, "flow_id": "flow-154dca69f82f86ae3fd36b43", "packets": 124, "transport": "tcp", "last_frame": 39400, "first_frame": 9641, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.194.162", "initiator_port": 49416, "responder_port": 443, "initiator_bytes": 17930, "last_seen_epoch": "1533965249.300876", "responder_bytes": 37448, "first_seen_epoch": "1533964899.570847" }, { "bytes": 87991, "stream": 261, "flow_id": "flow-73807a29d310798234033661", "packets": 168, "transport": "tcp", "last_frame": 39408, "first_frame": 9642, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.194.162", "initiator_port": 49417, "responder_port": 443, "initiator_bytes": 17510, "last_seen_epoch": "1533965249.301723", "responder_bytes": 70481, "first_seen_epoch": "1533964899.571086" }, { "bytes": 3856, "stream": 262, "flow_id": "flow-d34d46145627b05123208ae5", "packets": 18, "transport": "tcp", "last_frame": 22609, "first_frame": 9755, "initiator_ip": "192.168.1.95", "responder_ip": "23.73.225.194", "initiator_port": 49418, "responder_port": 443, "initiator_bytes": 878, "last_seen_epoch": "1533964990.291062", "responder_bytes": 2978, "first_seen_epoch": "1533964899.625925" }, { "bytes": 13045, "stream": 263, "flow_id": "flow-05da43ad2092cb6e7f7927c3", "packets": 27, "transport": "tcp", "last_frame": 22796, "first_frame": 9756, "initiator_ip": "192.168.1.95", "responder_ip": "23.73.225.194", "initiator_port": 49419, "responder_port": 443, "initiator_bytes": 1514, "last_seen_epoch": "1533964990.396795", "responder_bytes": 11531, "first_seen_epoch": "1533964899.62607" }, { "bytes": 8018, "stream": 264, "flow_id": "flow-34b213bd105282a4e8cacdb6", "packets": 22, "transport": "tcp", "last_frame": 22615, "first_frame": 9797, "initiator_ip": "192.168.1.95", "responder_ip": "8.247.90.250", "initiator_port": 49420, "responder_port": 443, "initiator_bytes": 1231, "last_seen_epoch": "1533964990.292654", "responder_bytes": 6787, "first_seen_epoch": "1533964899.641197" }, { "bytes": 31338, "stream": 265, "flow_id": "flow-b9ccfb464738d9da7ce762cd", "packets": 36, "transport": "tcp", "last_frame": 10604, "first_frame": 9802, "initiator_ip": "192.168.1.95", "responder_ip": "8.247.90.250", "initiator_port": 49421, "responder_port": 443, "initiator_bytes": 2050, "last_seen_epoch": "1533964900.540902", "responder_bytes": 29288, "first_seen_epoch": "1533964899.641858" }, { "bytes": 176, "stream": 109, "flow_id": "flow-f0f33c66880a05e9c3f0a31e", "packets": 2, "transport": "udp", "last_frame": 10021, "first_frame": 9971, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 53815, "responder_port": 53, "initiator_bytes": 80, "last_seen_epoch": "1533964899.857368", "responder_bytes": 96, "first_seen_epoch": "1533964899.767493" }, { "bytes": 9689, "stream": 266, "flow_id": "flow-8aad608d78d05fa506e951b6", "packets": 27, "transport": "tcp", "last_frame": 22787, "first_frame": 10022, "initiator_ip": "192.168.1.95", "responder_ip": "35.186.208.100", "initiator_port": 49422, "responder_port": 443, "initiator_bytes": 2232, "last_seen_epoch": "1533964990.391607", "responder_bytes": 7457, "first_seen_epoch": "1533964899.857844" }, { "bytes": 6733, "stream": 267, "flow_id": "flow-beb3adc42de72d9b6ce4128d", "packets": 19, "transport": "tcp", "last_frame": 22789, "first_frame": 10023, "initiator_ip": "192.168.1.95", "responder_ip": "35.186.208.100", "initiator_port": 49423, "responder_port": 443, "initiator_bytes": 906, "last_seen_epoch": "1533964990.396047", "responder_bytes": 5827, "first_seen_epoch": "1533964899.85807" }, { "bytes": 1163, "stream": 268, "flow_id": "flow-ae8bdcaa9f8d3ef15665f6da", "packets": 13, "transport": "tcp", "last_frame": 22797, "first_frame": 10264, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.194.162", "initiator_port": 49424, "responder_port": 443, "initiator_bytes": 666, "last_seen_epoch": "1533964990.396797", "responder_bytes": 497, "first_seen_epoch": "1533964900.001869" }, { "bytes": 246, "stream": 110, "flow_id": "flow-4d020f6e8bdbe5865780171b", "packets": 2, "transport": "udp", "last_frame": 10626, "first_frame": 10576, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 50390, "responder_port": 53, "initiator_bytes": 80, "last_seen_epoch": "1533964900.625516", "responder_bytes": 166, "first_seen_epoch": "1533964900.522209" }, { "bytes": 220, "stream": 111, "flow_id": "flow-e55f7520f2e68169aa9e1175", "packets": 2, "transport": "udp", "last_frame": 10617, "first_frame": 10577, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 65362, "responder_port": 53, "initiator_bytes": 78, "last_seen_epoch": "1533964900.621189", "responder_bytes": 142, "first_seen_epoch": "1533964900.523369" }, { "bytes": 176, "stream": 112, "flow_id": "flow-48f30bf9364f4765ace18d68", "packets": 2, "transport": "udp", "last_frame": 10606, "first_frame": 10580, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 62367, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1533964900.584234", "responder_bytes": 104, "first_seen_epoch": "1533964900.525737" }, { "bytes": 486, "stream": 113, "flow_id": "flow-bbf509d1292f702cd5f35717", "packets": 2, "transport": "udp", "last_frame": 10616, "first_frame": 10583, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 57895, "responder_port": 53, "initiator_bytes": 78, "last_seen_epoch": "1533964900.621029", "responder_bytes": 408, "first_seen_epoch": "1533964900.52643" }, { "bytes": 236, "stream": 114, "flow_id": "flow-7a0dd596da94262353ca7dda", "packets": 2, "transport": "udp", "last_frame": 10640, "first_frame": 10605, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 65289, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1533964900.661382", "responder_bytes": 164, "first_seen_epoch": "1533964900.561105" }, { "bytes": 7814, "stream": 269, "flow_id": "flow-06a2260df283115314d3f290", "packets": 22, "transport": "tcp", "last_frame": 22597, "first_frame": 10607, "initiator_ip": "192.168.1.95", "responder_ip": "54.209.71.223", "initiator_port": 49425, "responder_port": 443, "initiator_bytes": 1593, "last_seen_epoch": "1533964990.287604", "responder_bytes": 6221, "first_seen_epoch": "1533964900.584861" }, { "bytes": 6650, "stream": 270, "flow_id": "flow-95ebaed4de2ea40560d42e00", "packets": 20, "transport": "tcp", "last_frame": 22598, "first_frame": 10608, "initiator_ip": "192.168.1.95", "responder_ip": "54.209.71.223", "initiator_port": 49426, "responder_port": 443, "initiator_bytes": 974, "last_seen_epoch": "1533964990.287963", "responder_bytes": 5676, "first_seen_epoch": "1533964900.585144" }, { "bytes": 172, "stream": 115, "flow_id": "flow-5237255664569a9d2c5802b0", "packets": 2, "transport": "udp", "last_frame": 10632, "first_frame": 10615, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 54072, "responder_port": 53, "initiator_bytes": 78, "last_seen_epoch": "1533964900.643556", "responder_bytes": 94, "first_seen_epoch": "1533964900.59286" }, { "bytes": 4861, "stream": 271, "flow_id": "flow-50770920c75eed830813ca8a", "packets": 18, "transport": "tcp", "last_frame": 12505, "first_frame": 10622, "initiator_ip": "192.168.1.95", "responder_ip": "162.210.199.69", "initiator_port": 49428, "responder_port": 443, "initiator_bytes": 904, "last_seen_epoch": "1533964902.340285", "responder_bytes": 3957, "first_seen_epoch": "1533964900.624776" }, { "bytes": 8759, "stream": 272, "flow_id": "flow-9afe9a5e2079bf32c17c7f2b", "packets": 24, "transport": "tcp", "last_frame": 22596, "first_frame": 10623, "initiator_ip": "192.168.1.95", "responder_ip": "162.210.199.69", "initiator_port": 49427, "responder_port": 443, "initiator_bytes": 2410, "last_seen_epoch": "1533964990.287224", "responder_bytes": 6349, "first_seen_epoch": "1533964900.624777" }, { "bytes": 6544, "stream": 273, "flow_id": "flow-e30ee8054b98df8b80af0101", "packets": 18, "transport": "tcp", "last_frame": 22600, "first_frame": 10624, "initiator_ip": "192.168.1.95", "responder_ip": "13.33.107.160", "initiator_port": 49429, "responder_port": 443, "initiator_bytes": 920, "last_seen_epoch": "1533964990.28854", "responder_bytes": 5624, "first_seen_epoch": "1533964900.625288" }, { "bytes": 104359, "stream": 274, "flow_id": "flow-385af9008e86365d1568276f", "packets": 101, "transport": "tcp", "last_frame": 22805, "first_frame": 10625, "initiator_ip": "192.168.1.95", "responder_ip": "13.33.107.160", "initiator_port": 49430, "responder_port": 443, "initiator_bytes": 3919, "last_seen_epoch": "1533964990.407065", "responder_bytes": 100440, "first_seen_epoch": "1533964900.625515" }, { "bytes": 24337, "stream": 275, "flow_id": "flow-75e0951d4e51cfb698a01c5d", "packets": 33, "transport": "tcp", "last_frame": 22782, "first_frame": 10627, "initiator_ip": "192.168.1.95", "responder_ip": "23.220.174.162", "initiator_port": 49431, "responder_port": 443, "initiator_bytes": 1821, "last_seen_epoch": "1533964990.387342", "responder_bytes": 22516, "first_seen_epoch": "1533964900.626008" }, { "bytes": 16598, "stream": 276, "flow_id": "flow-fe2eb70d2f2955f0a3d3c770", "packets": 27, "transport": "tcp", "last_frame": 22777, "first_frame": 10628, "initiator_ip": "192.168.1.95", "responder_ip": "23.220.174.162", "initiator_port": 49432, "responder_port": 443, "initiator_bytes": 1641, "last_seen_epoch": "1533964990.386227", "responder_bytes": 14957, "first_seen_epoch": "1533964900.626133" }, { "bytes": 24063, "stream": 277, "flow_id": "flow-be5a180c1a84722dfe401699", "packets": 31, "transport": "tcp", "last_frame": 22785, "first_frame": 10629, "initiator_ip": "192.168.1.95", "responder_ip": "23.220.174.162", "initiator_port": 49433, "responder_port": 443, "initiator_bytes": 1761, "last_seen_epoch": "1533964990.387502", "responder_bytes": 22302, "first_seen_epoch": "1533964900.626156" }, { "bytes": 20152, "stream": 278, "flow_id": "flow-3d575a86b7da6f90cb322b82", "packets": 29, "transport": "tcp", "last_frame": 22779, "first_frame": 10630, "initiator_ip": "192.168.1.95", "responder_ip": "23.220.174.162", "initiator_port": 49434, "responder_port": 443, "initiator_bytes": 1701, "last_seen_epoch": "1533964990.386574", "responder_bytes": 18451, "first_seen_epoch": "1533964900.626415" }, { "bytes": 12476, "stream": 279, "flow_id": "flow-336a70ab25ee120b85dbbd7a", "packets": 27, "transport": "tcp", "last_frame": 22768, "first_frame": 10631, "initiator_ip": "192.168.1.95", "responder_ip": "23.220.174.162", "initiator_port": 49435, "responder_port": 443, "initiator_bytes": 1625, "last_seen_epoch": "1533964990.38258", "responder_bytes": 10851, "first_seen_epoch": "1533964900.626886" }, { "bytes": 8738, "stream": 280, "flow_id": "flow-0000bd1f2730a1aa9d4b386f", "packets": 30, "transport": "tcp", "last_frame": 22592, "first_frame": 10633, "initiator_ip": "192.168.1.95", "responder_ip": "95.142.20.29", "initiator_port": 49436, "responder_port": 443, "initiator_bytes": 2302, "last_seen_epoch": "1533964990.286038", "responder_bytes": 6436, "first_seen_epoch": "1533964900.644102" }, { "bytes": 7600, "stream": 281, "flow_id": "flow-1199cc202c0aab97becf5808", "packets": 22, "transport": "tcp", "last_frame": 22593, "first_frame": 10634, "initiator_ip": "192.168.1.95", "responder_ip": "95.142.20.29", "initiator_port": 49437, "responder_port": 443, "initiator_bytes": 1535, "last_seen_epoch": "1533964990.286335", "responder_bytes": 6065, "first_seen_epoch": "1533964900.644326" }, { "bytes": 196, "stream": 116, "flow_id": "flow-cc2dfdb909171034522bf3ec", "packets": 2, "transport": "udp", "last_frame": 10721, "first_frame": 10635, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 49991, "responder_port": 53, "initiator_bytes": 71, "last_seen_epoch": "1533964900.718497", "responder_bytes": 125, "first_seen_epoch": "1533964900.651992" }, { "bytes": 122887, "stream": 282, "flow_id": "flow-b565d3e69781bb95ceec4fa1", "packets": 128, "transport": "tcp", "last_frame": 22773, "first_frame": 10638, "initiator_ip": "192.168.1.95", "responder_ip": "172.217.0.54", "initiator_port": 49438, "responder_port": 443, "initiator_bytes": 4537, "last_seen_epoch": "1533964990.385003", "responder_bytes": 118350, "first_seen_epoch": "1533964900.657001" }, { "bytes": 1195, "stream": 283, "flow_id": "flow-e3ab88be1370fcc381585aac", "packets": 13, "transport": "tcp", "last_frame": 22771, "first_frame": 10639, "initiator_ip": "192.168.1.95", "responder_ip": "172.217.0.54", "initiator_port": 49439, "responder_port": 443, "initiator_bytes": 674, "last_seen_epoch": "1533964990.384862", "responder_bytes": 521, "first_seen_epoch": "1533964900.657243" }, { "bytes": 176363, "stream": 284, "flow_id": "flow-31299df18bfa1237870c0f4d", "packets": 159, "transport": "tcp", "last_frame": 22783, "first_frame": 10641, "initiator_ip": "192.168.1.95", "responder_ip": "23.73.239.75", "initiator_port": 49440, "responder_port": 443, "initiator_bytes": 9768, "last_seen_epoch": "1533964990.38742", "responder_bytes": 166595, "first_seen_epoch": "1533964900.661935" }, { "bytes": 390283, "stream": 285, "flow_id": "flow-682e78b736a9fda56d7657e9", "packets": 354, "transport": "tcp", "last_frame": 22775, "first_frame": 10642, "initiator_ip": "192.168.1.95", "responder_ip": "23.73.239.75", "initiator_port": 49441, "responder_port": 443, "initiator_bytes": 14323, "last_seen_epoch": "1533964990.385564", "responder_bytes": 375960, "first_seen_epoch": "1533964900.66228" }, { "bytes": 141092, "stream": 286, "flow_id": "flow-755891645f50b4f2915f9b87", "packets": 171, "transport": "tcp", "last_frame": 29535, "first_frame": 10723, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.192.6", "initiator_port": 49442, "responder_port": 443, "initiator_bytes": 8490, "last_seen_epoch": "1533965095.522062", "responder_bytes": 132602, "first_seen_epoch": "1533964900.718953" }, { "bytes": 154357, "stream": 287, "flow_id": "flow-63f65e8b756508e26d877344", "packets": 193, "transport": "tcp", "last_frame": 29531, "first_frame": 10725, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.192.6", "initiator_port": 49443, "responder_port": 443, "initiator_bytes": 9413, "last_seen_epoch": "1533965095.520915", "responder_bytes": 144944, "first_seen_epoch": "1533964900.719598" }, { "bytes": 252, "stream": 117, "flow_id": "flow-f59df3e2c6c188727704c43e", "packets": 2, "transport": "udp", "last_frame": 11114, "first_frame": 10975, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 54833, "responder_port": 53, "initiator_bytes": 78, "last_seen_epoch": "1533964901.05636", "responder_bytes": 174, "first_seen_epoch": "1533964900.961738" }, { "bytes": 257, "stream": 118, "flow_id": "flow-547432b6af1ee4365c5712e8", "packets": 2, "transport": "udp", "last_frame": 11285, "first_frame": 10976, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 63302, "responder_port": 53, "initiator_bytes": 80, "last_seen_epoch": "1533964901.153957", "responder_bytes": 177, "first_seen_epoch": "1533964900.966203" }, { "bytes": 192, "stream": 119, "flow_id": "flow-c2e926fa23750dd39ae32dd2", "packets": 2, "transport": "udp", "last_frame": 11261, "first_frame": 11119, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 57200, "responder_port": 53, "initiator_bytes": 88, "last_seen_epoch": "1533964901.13437", "responder_bytes": 104, "first_seen_epoch": "1533964901.05749" }, { "bytes": 8295, "stream": 288, "flow_id": "flow-e1b87b34f89f5eef36ab928f", "packets": 26, "transport": "tcp", "last_frame": 22588, "first_frame": 11250, "initiator_ip": "192.168.1.95", "responder_ip": "54.175.110.202", "initiator_port": 49444, "responder_port": 443, "initiator_bytes": 1831, "last_seen_epoch": "1533964990.285025", "responder_bytes": 6464, "first_seen_epoch": "1533964901.127329" }, { "bytes": 6773, "stream": 289, "flow_id": "flow-4b478c43df26d3355721e050", "packets": 18, "transport": "tcp", "last_frame": 22589, "first_frame": 11251, "initiator_ip": "192.168.1.95", "responder_ip": "54.175.110.202", "initiator_port": 49445, "responder_port": 443, "initiator_bytes": 920, "last_seen_epoch": "1533964990.285367", "responder_bytes": 5853, "first_seen_epoch": "1533964901.127514" }, { "bytes": 5904, "stream": 290, "flow_id": "flow-eadc586b5e5e7dee9a2f19f6", "packets": 26, "transport": "tcp", "last_frame": 22585, "first_frame": 11265, "initiator_ip": "192.168.1.95", "responder_ip": "173.241.250.220", "initiator_port": 49447, "responder_port": 443, "initiator_bytes": 2351, "last_seen_epoch": "1533964990.284129", "responder_bytes": 3553, "first_seen_epoch": "1533964901.13497" }, { "bytes": 5676, "stream": 291, "flow_id": "flow-3f73ef81633cdd2265005c27", "packets": 22, "transport": "tcp", "last_frame": 22584, "first_frame": 11266, "initiator_ip": "192.168.1.95", "responder_ip": "173.241.250.220", "initiator_port": 49446, "responder_port": 443, "initiator_bytes": 2230, "last_seen_epoch": "1533964990.28374", "responder_bytes": 3446, "first_seen_epoch": "1533964901.134971" }, { "bytes": 33206, "stream": 292, "flow_id": "flow-1829cc676cc1c454505cdffe", "packets": 44, "transport": "tcp", "last_frame": 22769, "first_frame": 11293, "initiator_ip": "192.168.1.95", "responder_ip": "23.54.22.209", "initiator_port": 49448, "responder_port": 443, "initiator_bytes": 2009, "last_seen_epoch": "1533964990.382691", "responder_bytes": 31197, "first_seen_epoch": "1533964901.155561" }, { "bytes": 4718, "stream": 293, "flow_id": "flow-e077e5937795f274536c6cd6", "packets": 18, "transport": "tcp", "last_frame": 22587, "first_frame": 11294, "initiator_ip": "192.168.1.95", "responder_ip": "23.54.22.209", "initiator_port": 49449, "responder_port": 443, "initiator_bytes": 906, "last_seen_epoch": "1533964990.284726", "responder_bytes": 3812, "first_seen_epoch": "1533964901.155693" }, { "bytes": 579, "stream": 120, "flow_id": "flow-a4cc066df124b8e109fbe768", "packets": 4, "transport": "udp", "last_frame": 23682, "first_frame": 11334, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 58531, "responder_port": 53, "initiator_bytes": 151, "last_seen_epoch": "1533964997.88717", "responder_bytes": 428, "first_seen_epoch": "1533964901.171968" }, { "bytes": 292, "stream": 121, "flow_id": "flow-b3c56469ba487bf1fc73414a", "packets": 2, "transport": "udp", "last_frame": 11428, "first_frame": 11335, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 55087, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1533964901.270602", "responder_bytes": 216, "first_seen_epoch": "1533964901.173416" }, { "bytes": 5895, "stream": 294, "flow_id": "flow-d8058bfbb93571e8c4350764", "packets": 18, "transport": "tcp", "last_frame": 22682, "first_frame": 11419, "initiator_ip": "192.168.1.95", "responder_ip": "178.154.131.215", "initiator_port": 49450, "responder_port": 443, "initiator_bytes": 906, "last_seen_epoch": "1533964990.310595", "responder_bytes": 4989, "first_seen_epoch": "1533964901.256514" }, { "bytes": 77985, "stream": 295, "flow_id": "flow-3d8880b64a8ec91904589c73", "packets": 75, "transport": "tcp", "last_frame": 22681, "first_frame": 11420, "initiator_ip": "192.168.1.95", "responder_ip": "178.154.131.215", "initiator_port": 49451, "responder_port": 443, "initiator_bytes": 3288, "last_seen_epoch": "1533964990.31025", "responder_bytes": 74697, "first_seen_epoch": "1533964901.256644" }, { "bytes": 374, "stream": 122, "flow_id": "flow-0efc689d3d58a3683ed4c236", "packets": 2, "transport": "udp", "last_frame": 11789, "first_frame": 11425, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 57621, "responder_port": 53, "initiator_bytes": 67, "last_seen_epoch": "1533964901.574246", "responder_bytes": 307, "first_seen_epoch": "1533964901.268836" }, { "bytes": 182, "stream": 123, "flow_id": "flow-38895a357d1288881822cd82", "packets": 2, "transport": "udp", "last_frame": 11477, "first_frame": 11426, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 58464, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1533964901.323587", "responder_bytes": 110, "first_seen_epoch": "1533964901.269111" }, { "bytes": 152, "stream": 124, "flow_id": "flow-cbfd01e7e42026b6aab93a96", "packets": 2, "transport": "udp", "last_frame": 11530, "first_frame": 11427, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 63479, "responder_port": 53, "initiator_bytes": 68, "last_seen_epoch": "1533964901.340738", "responder_bytes": 84, "first_seen_epoch": "1533964901.269376" }, { "bytes": 2809, "stream": 296, "flow_id": "flow-47d63c59a3acee423cfeba70", "packets": 12, "transport": "tcp", "last_frame": 17133, "first_frame": 11430, "initiator_ip": "192.168.1.95", "responder_ip": "104.16.90.188", "initiator_port": 49452, "responder_port": 80, "initiator_bytes": 499, "last_seen_epoch": "1533964947.477595", "responder_bytes": 2310, "first_seen_epoch": "1533964901.275725" }, { "bytes": 2755, "stream": 297, "flow_id": "flow-81fdf67d6d0f620f30fa77d4", "packets": 11, "transport": "tcp", "last_frame": 17137, "first_frame": 11431, "initiator_ip": "192.168.1.95", "responder_ip": "104.16.90.188", "initiator_port": 49453, "responder_port": 80, "initiator_bytes": 499, "last_seen_epoch": "1533964947.482584", "responder_bytes": 2256, "first_seen_epoch": "1533964901.276336" }, { "bytes": 8513, "stream": 298, "flow_id": "flow-6936613e49b411048a1aa4b0", "packets": 29, "transport": "tcp", "last_frame": 29532, "first_frame": 11432, "initiator_ip": "192.168.1.95", "responder_ip": "172.217.6.66", "initiator_port": 49454, "responder_port": 443, "initiator_bytes": 3414, "last_seen_epoch": "1533965095.520995", "responder_bytes": 5099, "first_seen_epoch": "1533964901.279271" }, { "bytes": 6521, "stream": 299, "flow_id": "flow-e351a7d12828de388b5e6c2b", "packets": 25, "transport": "tcp", "last_frame": 29503, "first_frame": 11433, "initiator_ip": "192.168.1.95", "responder_ip": "172.217.6.66", "initiator_port": 49455, "responder_port": 443, "initiator_bytes": 2597, "last_seen_epoch": "1533965095.518352", "responder_bytes": 3924, "first_seen_epoch": "1533964901.279497" }, { "bytes": 8492, "stream": 300, "flow_id": "flow-bcd8eb0136150ada97d806ca", "packets": 29, "transport": "tcp", "last_frame": 29529, "first_frame": 11434, "initiator_ip": "192.168.1.95", "responder_ip": "172.217.6.66", "initiator_port": 49456, "responder_port": 443, "initiator_bytes": 3281, "last_seen_epoch": "1533965095.520833", "responder_bytes": 5211, "first_seen_epoch": "1533964901.279744" }, { "bytes": 6445, "stream": 301, "flow_id": "flow-20b0f705f7f6e445df9235ff", "packets": 25, "transport": "tcp", "last_frame": 29515, "first_frame": 11435, "initiator_ip": "192.168.1.95", "responder_ip": "172.217.6.66", "initiator_port": 49457, "responder_port": 443, "initiator_bytes": 2752, "last_seen_epoch": "1533965095.519134", "responder_bytes": 3693, "first_seen_epoch": "1533964901.280014" }, { "bytes": 6362, "stream": 302, "flow_id": "flow-29030572c0949f744aed74c7", "packets": 24, "transport": "tcp", "last_frame": 22562, "first_frame": 11484, "initiator_ip": "192.168.1.95", "responder_ip": "148.251.82.59", "initiator_port": 49458, "responder_port": 443, "initiator_bytes": 1765, "last_seen_epoch": "1533964990.281295", "responder_bytes": 4597, "first_seen_epoch": "1533964901.324205" }, { "bytes": 4434, "stream": 303, "flow_id": "flow-e99aff747a258f89b978ff81", "packets": 16, "transport": "tcp", "last_frame": 22566, "first_frame": 11489, "initiator_ip": "192.168.1.95", "responder_ip": "148.251.82.59", "initiator_port": 49459, "responder_port": 443, "initiator_bytes": 838, "last_seen_epoch": "1533964990.281734", "responder_bytes": 3596, "first_seen_epoch": "1533964901.325285" }, { "bytes": 6949, "stream": 304, "flow_id": "flow-3ae58c66003bec3a1d2a56d4", "packets": 22, "transport": "tcp", "last_frame": 22570, "first_frame": 11531, "initiator_ip": "192.168.1.95", "responder_ip": "148.251.82.59", "initiator_port": 49460, "responder_port": 443, "initiator_bytes": 1685, "last_seen_epoch": "1533964990.282083", "responder_bytes": 5264, "first_seen_epoch": "1533964901.341432" }, { "bytes": 5287, "stream": 305, "flow_id": "flow-fe43f4a275cd38c031ae1d4f", "packets": 18, "transport": "tcp", "last_frame": 22575, "first_frame": 11532, "initiator_ip": "192.168.1.95", "responder_ip": "148.251.82.59", "initiator_port": 49461, "responder_port": 443, "initiator_bytes": 894, "last_seen_epoch": "1533964990.282452", "responder_bytes": 4393, "first_seen_epoch": "1533964901.341433" }, { "bytes": 242, "stream": 125, "flow_id": "flow-e28632d0796be4cb69bc847b", "packets": 2, "transport": "udp", "last_frame": 11930, "first_frame": 11727, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 65131, "responder_port": 53, "initiator_bytes": 73, "last_seen_epoch": "1533964901.698652", "responder_bytes": 169, "first_seen_epoch": "1533964901.537832" }, { "bytes": 367, "stream": 126, "flow_id": "flow-f645c952664fef9d3787e43d", "packets": 4, "transport": "udp", "last_frame": 40087, "first_frame": 11738, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 54153, "responder_port": 53, "initiator_bytes": 156, "last_seen_epoch": "1533965768.408215", "responder_bytes": 211, "first_seen_epoch": "1533964901.548766" }, { "bytes": 5397, "stream": 306, "flow_id": "flow-5a49946e5a00eb4e217ceee0", "packets": 20, "transport": "tcp", "last_frame": 22583, "first_frame": 11796, "initiator_ip": "192.168.1.95", "responder_ip": "46.161.36.8", "initiator_port": 49462, "responder_port": 443, "initiator_bytes": 953, "last_seen_epoch": "1533964990.283236", "responder_bytes": 4444, "first_seen_epoch": "1533964901.575975" }, { "bytes": 7103, "stream": 307, "flow_id": "flow-f87f55470593230cc29ae10e", "packets": 25, "transport": "tcp", "last_frame": 22580, "first_frame": 11799, "initiator_ip": "192.168.1.95", "responder_ip": "46.161.36.8", "initiator_port": 49463, "responder_port": 443, "initiator_bytes": 1728, "last_seen_epoch": "1533964990.28288", "responder_bytes": 5375, "first_seen_epoch": "1533964901.576258" }, { "bytes": 246, "stream": 127, "flow_id": "flow-7e2ecdb91586268d248c8930", "packets": 2, "transport": "udp", "last_frame": 11957, "first_frame": 11860, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 54251, "responder_port": 53, "initiator_bytes": 77, "last_seen_epoch": "1533964901.767352", "responder_bytes": 169, "first_seen_epoch": "1533964901.603537" }, { "bytes": 87749, "stream": 308, "flow_id": "flow-827fa2fa9c6675c62d528ee0", "packets": 105, "transport": "tcp", "last_frame": 22753, "first_frame": 11932, "initiator_ip": "192.168.1.95", "responder_ip": "23.54.23.55", "initiator_port": 49464, "responder_port": 443, "initiator_bytes": 3835, "last_seen_epoch": "1533964990.37315", "responder_bytes": 83914, "first_seen_epoch": "1533964901.699525" }, { "bytes": 6422, "stream": 309, "flow_id": "flow-21a8414a509e94528e987394", "packets": 22, "transport": "tcp", "last_frame": 22764, "first_frame": 11933, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.192.2", "initiator_port": 49465, "responder_port": 443, "initiator_bytes": 2604, "last_seen_epoch": "1533964990.382287", "responder_bytes": 3818, "first_seen_epoch": "1533964901.699811" }, { "bytes": 6421, "stream": 310, "flow_id": "flow-6ba333227073bd31b414f00f", "packets": 22, "transport": "tcp", "last_frame": 22765, "first_frame": 11934, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.192.2", "initiator_port": 49466, "responder_port": 443, "initiator_bytes": 2604, "last_seen_epoch": "1533964990.382396", "responder_bytes": 3817, "first_seen_epoch": "1533964901.699934" }, { "bytes": 87923, "stream": 311, "flow_id": "flow-890aa702f31b1c169658118d", "packets": 108, "transport": "tcp", "last_frame": 22743, "first_frame": 11935, "initiator_ip": "192.168.1.95", "responder_ip": "23.54.23.55", "initiator_port": 49467, "responder_port": 443, "initiator_bytes": 3955, "last_seen_epoch": "1533964990.372156", "responder_bytes": 83968, "first_seen_epoch": "1533964901.700129" }, { "bytes": 225, "stream": 128, "flow_id": "flow-d08ee0793995d11766a9e296", "packets": 2, "transport": "udp", "last_frame": 11978, "first_frame": 11954, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 57805, "responder_port": 53, "initiator_bytes": 79, "last_seen_epoch": "1533964901.783846", "responder_bytes": 146, "first_seen_epoch": "1533964901.7069" }, { "bytes": 7834, "stream": 312, "flow_id": "flow-bd3983e7ca7cc7f30911ec27", "packets": 25, "transport": "tcp", "last_frame": 22744, "first_frame": 11962, "initiator_ip": "192.168.1.95", "responder_ip": "104.110.128.239", "initiator_port": 49468, "responder_port": 443, "initiator_bytes": 2645, "last_seen_epoch": "1533964990.372263", "responder_bytes": 5189, "first_seen_epoch": "1533964901.768522" }, { "bytes": 4044, "stream": 313, "flow_id": "flow-5a714b1133281a68eb7fa877", "packets": 18, "transport": "tcp", "last_frame": 22541, "first_frame": 11963, "initiator_ip": "192.168.1.95", "responder_ip": "104.110.128.239", "initiator_port": 49469, "responder_port": 443, "initiator_bytes": 879, "last_seen_epoch": "1533964990.279914", "responder_bytes": 3165, "first_seen_epoch": "1533964901.768745" }, { "bytes": 15741, "stream": 314, "flow_id": "flow-2e63a4fdf72637528bf6e2e8", "packets": 37, "transport": "tcp", "last_frame": 26428, "first_frame": 11979, "initiator_ip": "192.168.1.95", "responder_ip": "104.36.113.17", "initiator_port": 49470, "responder_port": 443, "initiator_bytes": 6133, "last_seen_epoch": "1533965032.718612", "responder_bytes": 9608, "first_seen_epoch": "1533964901.784284" }, { "bytes": 20782, "stream": 315, "flow_id": "flow-04f8777505c218090ec61675", "packets": 44, "transport": "tcp", "last_frame": 26440, "first_frame": 11980, "initiator_ip": "192.168.1.95", "responder_ip": "104.36.113.17", "initiator_port": 49471, "responder_port": 443, "initiator_bytes": 8072, "last_seen_epoch": "1533965032.720109", "responder_bytes": 12710, "first_seen_epoch": "1533964901.784623" }, { "bytes": 263, "stream": 129, "flow_id": "flow-4d5d5f66e6c75658324dd739", "packets": 2, "transport": "udp", "last_frame": 12104, "first_frame": 11983, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 54920, "responder_port": 53, "initiator_bytes": 73, "last_seen_epoch": "1533964901.906766", "responder_bytes": 190, "first_seen_epoch": "1533964901.806285" }, { "bytes": 207, "stream": 130, "flow_id": "flow-b8c08fa1418b2bb8e53c20b0", "packets": 2, "transport": "udp", "last_frame": 12212, "first_frame": 12052, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 56531, "responder_port": 53, "initiator_bytes": 78, "last_seen_epoch": "1533964901.98125", "responder_bytes": 129, "first_seen_epoch": "1533964901.85511" }, { "bytes": 207, "stream": 131, "flow_id": "flow-da088e0c558f6741fe914383", "packets": 2, "transport": "udp", "last_frame": 12208, "first_frame": 12058, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 52282, "responder_port": 53, "initiator_bytes": 78, "last_seen_epoch": "1533964901.980409", "responder_bytes": 129, "first_seen_epoch": "1533964901.85713" }, { "bytes": 251, "stream": 132, "flow_id": "flow-8337d23c66bd976e0ce5a905", "packets": 2, "transport": "udp", "last_frame": 12260, "first_frame": 12096, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 59302, "responder_port": 53, "initiator_bytes": 77, "last_seen_epoch": "1533964902.009546", "responder_bytes": 174, "first_seen_epoch": "1533964901.899258" }, { "bytes": 16714, "stream": 316, "flow_id": "flow-f2df3612ba9dcbd4854e50fd", "packets": 32, "transport": "tcp", "last_frame": 17151, "first_frame": 12106, "initiator_ip": "192.168.1.95", "responder_ip": "54.176.157.57", "initiator_port": 49472, "responder_port": 443, "initiator_bytes": 2938, "last_seen_epoch": "1533964954.819609", "responder_bytes": 13776, "first_seen_epoch": "1533964901.907311" }, { "bytes": 38144, "stream": 317, "flow_id": "flow-1fc21e958d1889c54bc405ff", "packets": 56, "transport": "tcp", "last_frame": 17155, "first_frame": 12107, "initiator_ip": "192.168.1.95", "responder_ip": "54.176.157.57", "initiator_port": 49473, "responder_port": 443, "initiator_bytes": 7995, "last_seen_epoch": "1533964954.820196", "responder_bytes": 30149, "first_seen_epoch": "1533964901.907449" }, { "bytes": 12306, "stream": 318, "flow_id": "flow-444c24d60c3fcb920586c349", "packets": 27, "transport": "tcp", "last_frame": 22508, "first_frame": 12211, "initiator_ip": "192.168.1.95", "responder_ip": "173.0.153.44", "initiator_port": 49474, "responder_port": 443, "initiator_bytes": 1559, "last_seen_epoch": "1533964990.276493", "responder_bytes": 10747, "first_seen_epoch": "1533964901.981037" }, { "bytes": 4842, "stream": 319, "flow_id": "flow-782bed47235cb26aa136736b", "packets": 18, "transport": "tcp", "last_frame": 22510, "first_frame": 12213, "initiator_ip": "192.168.1.95", "responder_ip": "173.0.153.44", "initiator_port": 49475, "responder_port": 443, "initiator_bytes": 904, "last_seen_epoch": "1533964990.276922", "responder_bytes": 3938, "first_seen_epoch": "1533964901.981631" }, { "bytes": 77811, "stream": 320, "flow_id": "flow-6578769a2e1d85b7465a6c81", "packets": 76, "transport": "tcp", "last_frame": 22514, "first_frame": 12216, "initiator_ip": "192.168.1.95", "responder_ip": "173.0.153.44", "initiator_port": 49476, "responder_port": 443, "initiator_bytes": 3534, "last_seen_epoch": "1533964990.277376", "responder_bytes": 74277, "first_seen_epoch": "1533964901.982129" }, { "bytes": 42466, "stream": 321, "flow_id": "flow-6226557df1915f026a0ff994", "packets": 54, "transport": "tcp", "last_frame": 22517, "first_frame": 12217, "initiator_ip": "192.168.1.95", "responder_ip": "173.0.153.44", "initiator_port": 49477, "responder_port": 443, "initiator_bytes": 2814, "last_seen_epoch": "1533964990.277741", "responder_bytes": 39652, "first_seen_epoch": "1533964901.982239" }, { "bytes": 62791, "stream": 322, "flow_id": "flow-bf6e3f2d151549343de23ca7", "packets": 80, "transport": "tcp", "last_frame": 22736, "first_frame": 12261, "initiator_ip": "192.168.1.95", "responder_ip": "23.35.180.245", "initiator_port": 49478, "responder_port": 443, "initiator_bytes": 3134, "last_seen_epoch": "1533964990.371906", "responder_bytes": 59657, "first_seen_epoch": "1533964902.009954" }, { "bytes": 62167, "stream": 323, "flow_id": "flow-f8e594cac39118f53a426855", "packets": 69, "transport": "tcp", "last_frame": 22734, "first_frame": 12262, "initiator_ip": "192.168.1.95", "responder_ip": "23.35.180.245", "initiator_port": 49479, "responder_port": 443, "initiator_bytes": 2834, "last_seen_epoch": "1533964990.371367", "responder_bytes": 59333, "first_seen_epoch": "1533964902.010101" }, { "bytes": 244, "stream": 133, "flow_id": "flow-c443c2e5ac3fea8724980b95", "packets": 2, "transport": "udp", "last_frame": 12591, "first_frame": 12552, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 63593, "responder_port": 53, "initiator_bytes": 74, "last_seen_epoch": "1533964902.539371", "responder_bytes": 170, "first_seen_epoch": "1533964902.453057" }, { "bytes": 40675, "stream": 324, "flow_id": "flow-54c0c2adfde0aeddc7208742", "packets": 83, "transport": "tcp", "last_frame": 25536, "first_frame": 12592, "initiator_ip": "192.168.1.95", "responder_ip": "23.54.23.55", "initiator_port": 49480, "responder_port": 443, "initiator_bytes": 29255, "last_seen_epoch": "1533965025.144914", "responder_bytes": 11420, "first_seen_epoch": "1533964902.540009" }, { "bytes": 18049, "stream": 325, "flow_id": "flow-fa3aae0fca48b6936445b222", "packets": 40, "transport": "tcp", "last_frame": 29493, "first_frame": 12593, "initiator_ip": "192.168.1.95", "responder_ip": "23.54.23.55", "initiator_port": 49481, "responder_port": 443, "initiator_bytes": 12018, "last_seen_epoch": "1533965095.51742", "responder_bytes": 6031, "first_seen_epoch": "1533964902.540309" }, { "bytes": 1423, "stream": 326, "flow_id": "flow-193d977e35e3e39610ed5854", "packets": 16, "transport": "tcp", "last_frame": 22522, "first_frame": 12648, "initiator_ip": "192.168.1.95", "responder_ip": "173.0.153.44", "initiator_port": 49482, "responder_port": 443, "initiator_bytes": 801, "last_seen_epoch": "1533964990.278074", "responder_bytes": 622, "first_seen_epoch": "1533964902.595621" }, { "bytes": 207, "stream": 134, "flow_id": "flow-fd34fa5131cc11d2dc8ba83c", "packets": 2, "transport": "udp", "last_frame": 12763, "first_frame": 12649, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 56191, "responder_port": 53, "initiator_bytes": 78, "last_seen_epoch": "1533964902.706045", "responder_bytes": 129, "first_seen_epoch": "1533964902.596451" }, { "bytes": 1363, "stream": 327, "flow_id": "flow-dbe1696009df547e48b8183a", "packets": 15, "transport": "tcp", "last_frame": 22525, "first_frame": 12650, "initiator_ip": "192.168.1.95", "responder_ip": "173.0.153.44", "initiator_port": 49483, "responder_port": 443, "initiator_bytes": 741, "last_seen_epoch": "1533964990.278564", "responder_bytes": 622, "first_seen_epoch": "1533964902.596965" }, { "bytes": 23681, "stream": 328, "flow_id": "flow-849cc6552b993f3c3c56b3d9", "packets": 32, "transport": "tcp", "last_frame": 22502, "first_frame": 12765, "initiator_ip": "192.168.1.95", "responder_ip": "173.0.153.44", "initiator_port": 49484, "responder_port": 443, "initiator_bytes": 1679, "last_seen_epoch": "1533964990.275299", "responder_bytes": 22002, "first_seen_epoch": "1533964902.706699" }, { "bytes": 4848, "stream": 329, "flow_id": "flow-0b4e0425d2ef61986994d901", "packets": 18, "transport": "tcp", "last_frame": 22503, "first_frame": 12772, "initiator_ip": "192.168.1.95", "responder_ip": "173.0.153.44", "initiator_port": 49485, "responder_port": 443, "initiator_bytes": 904, "last_seen_epoch": "1533964990.275777", "responder_bytes": 3944, "first_seen_epoch": "1533964902.708156" }, { "bytes": 176, "stream": 135, "flow_id": "flow-f0d61fbf7c8cb1a579acf817", "packets": 2, "transport": "udp", "last_frame": 12799, "first_frame": 12773, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 51474, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1533964902.763199", "responder_bytes": 104, "first_seen_epoch": "1533964902.709304" }, { "bytes": 269, "stream": 136, "flow_id": "flow-05093318bfdd211e8c111cff", "packets": 2, "transport": "udp", "last_frame": 12842, "first_frame": 12778, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 60063, "responder_port": 53, "initiator_bytes": 82, "last_seen_epoch": "1533964902.809158", "responder_bytes": 187, "first_seen_epoch": "1533964902.711278" }, { "bytes": 8638, "stream": 330, "flow_id": "flow-01da26d0669f63b8f66b6fed", "packets": 23, "transport": "tcp", "last_frame": 13190, "first_frame": 12802, "initiator_ip": "192.168.1.95", "responder_ip": "64.41.197.55", "initiator_port": 49486, "responder_port": 443, "initiator_bytes": 1705, "last_seen_epoch": "1533964903.152187", "responder_bytes": 6933, "first_seen_epoch": "1533964902.766735" }, { "bytes": 8514, "stream": 331, "flow_id": "flow-0ba031d786d8c6e3764e35fa", "packets": 22, "transport": "tcp", "last_frame": 13189, "first_frame": 12803, "initiator_ip": "192.168.1.95", "responder_ip": "64.41.197.55", "initiator_port": 49487, "responder_port": 443, "initiator_bytes": 1641, "last_seen_epoch": "1533964903.151728", "responder_bytes": 6873, "first_seen_epoch": "1533964902.766905" }, { "bytes": 4530, "stream": 332, "flow_id": "flow-8f3aef7edca0dadee581eff8", "packets": 18, "transport": "tcp", "last_frame": 22501, "first_frame": 12843, "initiator_ip": "192.168.1.95", "responder_ip": "23.220.187.187", "initiator_port": 49488, "responder_port": 443, "initiator_bytes": 924, "last_seen_epoch": "1533964990.274845", "responder_bytes": 3606, "first_seen_epoch": "1533964902.809632" }, { "bytes": 32216, "stream": 333, "flow_id": "flow-00ab7e9bd7a4ee73a249b6a1", "packets": 42, "transport": "tcp", "last_frame": 22742, "first_frame": 12844, "initiator_ip": "192.168.1.95", "responder_ip": "23.220.187.187", "initiator_port": 49489, "responder_port": 443, "initiator_bytes": 1999, "last_seen_epoch": "1533964990.37214", "responder_bytes": 30217, "first_seen_epoch": "1533964902.80983" }, { "bytes": 156, "stream": 137, "flow_id": "flow-fb60305dab86f01a6b6d4441", "packets": 2, "transport": "udp", "last_frame": 13018, "first_frame": 12971, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 49409, "responder_port": 53, "initiator_bytes": 70, "last_seen_epoch": "1533964902.980837", "responder_bytes": 86, "first_seen_epoch": "1533964902.913737" }, { "bytes": 9887, "stream": 334, "flow_id": "flow-83368aa64acd8b6094b0632e", "packets": 25, "transport": "tcp", "last_frame": 22746, "first_frame": 13019, "initiator_ip": "192.168.1.95", "responder_ip": "204.2.250.100", "initiator_port": 49490, "responder_port": 443, "initiator_bytes": 2946, "last_seen_epoch": "1533964990.372349", "responder_bytes": 6941, "first_seen_epoch": "1533964902.981284" }, { "bytes": 6275, "stream": 335, "flow_id": "flow-0e683673b769d24a22b96619", "packets": 17, "transport": "tcp", "last_frame": 22745, "first_frame": 13020, "initiator_ip": "192.168.1.95", "responder_ip": "204.2.250.100", "initiator_port": 49491, "responder_port": 443, "initiator_bytes": 1044, "last_seen_epoch": "1533964990.372264", "responder_bytes": 5231, "first_seen_epoch": "1533964902.981409" }, { "bytes": 5273, "stream": 336, "flow_id": "flow-1a1b4f8312fb946a2d9130d4", "packets": 21, "transport": "tcp", "last_frame": 29522, "first_frame": 13067, "initiator_ip": "192.168.1.95", "responder_ip": "23.73.239.75", "initiator_port": 49492, "responder_port": 443, "initiator_bytes": 2321, "last_seen_epoch": "1533965095.519659", "responder_bytes": 2952, "first_seen_epoch": "1533964902.996449" }, { "bytes": 260, "stream": 138, "flow_id": "flow-e63ad5bca4e8dd87d17b667b", "packets": 2, "transport": "udp", "last_frame": 13349, "first_frame": 13204, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 50030, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1533964903.242983", "responder_bytes": 184, "first_seen_epoch": "1533964903.157823" }, { "bytes": 3138, "stream": 337, "flow_id": "flow-1e712ee5e52e924044b724fc", "packets": 24, "transport": "tcp", "last_frame": 17095, "first_frame": 13248, "initiator_ip": "192.168.1.95", "responder_ip": "64.41.197.55", "initiator_port": 49493, "responder_port": 443, "initiator_bytes": 1466, "last_seen_epoch": "1533964929.009676", "responder_bytes": 1672, "first_seen_epoch": "1533964903.176007" }, { "bytes": 2724, "stream": 338, "flow_id": "flow-0db4a5b50e8d8d3d0d5098f9", "packets": 18, "transport": "tcp", "last_frame": 13557, "first_frame": 13249, "initiator_ip": "192.168.1.95", "responder_ip": "64.41.197.55", "initiator_port": 49494, "responder_port": 443, "initiator_bytes": 1478, "last_seen_epoch": "1533964903.545469", "responder_bytes": 1246, "first_seen_epoch": "1533964903.176141" }, { "bytes": 168, "stream": 139, "flow_id": "flow-7e6aecf32f83c77ca600aaea", "packets": 2, "transport": "udp", "last_frame": 13383, "first_frame": 13252, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 59421, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1533964903.26126", "responder_bytes": 92, "first_seen_epoch": "1533964903.183367" }, { "bytes": 214, "stream": 140, "flow_id": "flow-7bde6d97ff6262ac00579c41", "packets": 2, "transport": "udp", "last_frame": 13400, "first_frame": 13322, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 52631, "responder_port": 53, "initiator_bytes": 81, "last_seen_epoch": "1533964903.310256", "responder_bytes": 133, "first_seen_epoch": "1533964903.228307" }, { "bytes": 13595, "stream": 339, "flow_id": "flow-e61970af35d6ac89cdbed113", "packets": 27, "transport": "tcp", "last_frame": 22754, "first_frame": 13360, "initiator_ip": "192.168.1.95", "responder_ip": "151.101.2.2", "initiator_port": 49495, "responder_port": 443, "initiator_bytes": 1817, "last_seen_epoch": "1533964990.373233", "responder_bytes": 11778, "first_seen_epoch": "1533964903.247274" }, { "bytes": 7115, "stream": 340, "flow_id": "flow-ef7ddeb9dc1e2bda949e7071", "packets": 20, "transport": "tcp", "last_frame": 22755, "first_frame": 13361, "initiator_ip": "192.168.1.95", "responder_ip": "151.101.2.2", "initiator_port": 49496, "responder_port": 443, "initiator_bytes": 918, "last_seen_epoch": "1533964990.373234", "responder_bytes": 6197, "first_seen_epoch": "1533964903.247521" }, { "bytes": 4084, "stream": 341, "flow_id": "flow-e27baa8bd4e7b96cee47ca6b", "packets": 18, "transport": "tcp", "last_frame": 22489, "first_frame": 13385, "initiator_ip": "192.168.1.95", "responder_ip": "173.241.250.220", "initiator_port": 49497, "responder_port": 443, "initiator_bytes": 878, "last_seen_epoch": "1533964990.273389", "responder_bytes": 3206, "first_seen_epoch": "1533964903.263167" }, { "bytes": 75833, "stream": 342, "flow_id": "flow-70fd53d8aef6c3dbca40179f", "packets": 88, "transport": "tcp", "last_frame": 22484, "first_frame": 13386, "initiator_ip": "192.168.1.95", "responder_ip": "173.241.250.220", "initiator_port": 49498, "responder_port": 443, "initiator_bytes": 4971, "last_seen_epoch": "1533964990.273", "responder_bytes": 70862, "first_seen_epoch": "1533964903.263168" }, { "bytes": 181441, "stream": 343, "flow_id": "flow-0504cb13f60069c5c520a440", "packets": 196, "transport": "tcp", "last_frame": 29502, "first_frame": 13413, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.192.10", "initiator_port": 49499, "responder_port": 443, "initiator_bytes": 5831, "last_seen_epoch": "1533965095.518176", "responder_bytes": 175610, "first_seen_epoch": "1533964903.329775" }, { "bytes": 284872, "stream": 344, "flow_id": "flow-4a47417b298768431e19cda8", "packets": 263, "transport": "tcp", "last_frame": 29513, "first_frame": 13414, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.192.10", "initiator_port": 49500, "responder_port": 443, "initiator_bytes": 8383, "last_seen_epoch": "1533965095.518953", "responder_bytes": 276489, "first_seen_epoch": "1533964903.329778" }, { "bytes": 214, "stream": 141, "flow_id": "flow-b08e46011d552367d9d12474", "packets": 2, "transport": "udp", "last_frame": 13494, "first_frame": 13443, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 53377, "responder_port": 53, "initiator_bytes": 91, "last_seen_epoch": "1533964903.481649", "responder_bytes": 123, "first_seen_epoch": "1533964903.409461" }, { "bytes": 2728, "stream": 345, "flow_id": "flow-089a8d05b6a3acd70a4943fc", "packets": 17, "transport": "tcp", "last_frame": 13771, "first_frame": 13444, "initiator_ip": "192.168.1.95", "responder_ip": "64.41.197.55", "initiator_port": 49501, "responder_port": 443, "initiator_bytes": 1482, "last_seen_epoch": "1533964903.71741", "responder_bytes": 1246, "first_seen_epoch": "1533964903.410157" }, { "bytes": 2804, "stream": 346, "flow_id": "flow-55285f36435934bc919ec656", "packets": 18, "transport": "tcp", "last_frame": 13769, "first_frame": 13445, "initiator_ip": "192.168.1.95", "responder_ip": "64.41.197.55", "initiator_port": 49502, "responder_port": 443, "initiator_bytes": 1558, "last_seen_epoch": "1533964903.716895", "responder_bytes": 1246, "first_seen_epoch": "1533964903.410938" }, { "bytes": 2614, "stream": 347, "flow_id": "flow-799272cea3f2b5c17d50b47e", "packets": 15, "transport": "tcp", "last_frame": 13807, "first_frame": 13456, "initiator_ip": "192.168.1.95", "responder_ip": "64.41.197.55", "initiator_port": 49503, "responder_port": 443, "initiator_bytes": 1422, "last_seen_epoch": "1533964903.732759", "responder_bytes": 1192, "first_seen_epoch": "1533964903.452015" }, { "bytes": 2728, "stream": 348, "flow_id": "flow-c9470f6afee6834340b1165d", "packets": 17, "transport": "tcp", "last_frame": 13798, "first_frame": 13458, "initiator_ip": "192.168.1.95", "responder_ip": "64.41.197.55", "initiator_port": 49504, "responder_port": 443, "initiator_bytes": 1482, "last_seen_epoch": "1533964903.730571", "responder_bytes": 1246, "first_seen_epoch": "1533964903.452953" }, { "bytes": 412, "stream": 142, "flow_id": "flow-a041dc2c2b02b9a4b4bb0e54", "packets": 2, "transport": "udp", "last_frame": 13537, "first_frame": 13463, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 50064, "responder_port": 53, "initiator_bytes": 78, "last_seen_epoch": "1533964903.535108", "responder_bytes": 334, "first_seen_epoch": "1533964903.459819" }, { "bytes": 170, "stream": 143, "flow_id": "flow-27b4372346573deaf7fdbb05", "packets": 2, "transport": "udp", "last_frame": 13517, "first_frame": 13464, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 55203, "responder_port": 53, "initiator_bytes": 77, "last_seen_epoch": "1533964903.515128", "responder_bytes": 93, "first_seen_epoch": "1533964903.46098" }, { "bytes": 245, "stream": 144, "flow_id": "flow-9af11197f668989c0d64a945", "packets": 2, "transport": "udp", "last_frame": 13593, "first_frame": 13486, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 57665, "responder_port": 53, "initiator_bytes": 78, "last_seen_epoch": "1533964903.573032", "responder_bytes": 167, "first_seen_epoch": "1533964903.479648" }, { "bytes": 274, "stream": 145, "flow_id": "flow-1fc3d3e4f87a6ba9b16c4e92", "packets": 2, "transport": "udp", "last_frame": 13562, "first_frame": 13493, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 62052, "responder_port": 53, "initiator_bytes": 73, "last_seen_epoch": "1533964903.558314", "responder_bytes": 201, "first_seen_epoch": "1533964903.481648" }, { "bytes": 7064, "stream": 349, "flow_id": "flow-b0d1c032634268ca82fd08df", "packets": 25, "transport": "tcp", "last_frame": 22481, "first_frame": 13501, "initiator_ip": "192.168.1.95", "responder_ip": "13.57.70.199", "initiator_port": 49505, "responder_port": 443, "initiator_bytes": 2439, "last_seen_epoch": "1533964990.272613", "responder_bytes": 4625, "first_seen_epoch": "1533964903.484122" }, { "bytes": 219, "stream": 146, "flow_id": "flow-2a61b45f0ddf15242314ff66", "packets": 2, "transport": "udp", "last_frame": 13566, "first_frame": 13502, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 59715, "responder_port": 53, "initiator_bytes": 80, "last_seen_epoch": "1533964903.560435", "responder_bytes": 139, "first_seen_epoch": "1533964903.485569" }, { "bytes": 5450, "stream": 350, "flow_id": "flow-8f621ff9dd26a0bdb1b98917", "packets": 20, "transport": "tcp", "last_frame": 17036, "first_frame": 13518, "initiator_ip": "192.168.1.95", "responder_ip": "74.119.117.70", "initiator_port": 49506, "responder_port": 443, "initiator_bytes": 1941, "last_seen_epoch": "1533964918.712026", "responder_bytes": 3509, "first_seen_epoch": "1533964903.515763" }, { "bytes": 2734, "stream": 351, "flow_id": "flow-e7032cc1ba0f1ddc8dd8fb7a", "packets": 17, "transport": "tcp", "last_frame": 13904, "first_frame": 13528, "initiator_ip": "192.168.1.95", "responder_ip": "64.41.197.55", "initiator_port": 49507, "responder_port": 443, "initiator_bytes": 1482, "last_seen_epoch": "1533964903.791536", "responder_bytes": 1252, "first_seen_epoch": "1533964903.519791" }, { "bytes": 6593, "stream": 352, "flow_id": "flow-c7c4063f9a0a91f3c76cdf8c", "packets": 25, "transport": "tcp", "last_frame": 22476, "first_frame": 13550, "initiator_ip": "192.168.1.95", "responder_ip": "64.7.205.2", "initiator_port": 49508, "responder_port": 8443, "initiator_bytes": 2026, "last_seen_epoch": "1533964990.272187", "responder_bytes": 4567, "first_seen_epoch": "1533964903.539719" }, { "bytes": 8562, "stream": 353, "flow_id": "flow-8544e148bd7000edd6d7de2a", "packets": 26, "transport": "tcp", "last_frame": 22467, "first_frame": 13568, "initiator_ip": "192.168.1.95", "responder_ip": "35.164.209.30", "initiator_port": 49509, "responder_port": 443, "initiator_bytes": 1762, "last_seen_epoch": "1533964990.271274", "responder_bytes": 6800, "first_seen_epoch": "1533964903.56336" }, { "bytes": 2728, "stream": 354, "flow_id": "flow-fb6591b9ac0783ac5df2c7ff", "packets": 17, "transport": "tcp", "last_frame": 14001, "first_frame": 13576, "initiator_ip": "192.168.1.95", "responder_ip": "64.41.197.55", "initiator_port": 49510, "responder_port": 443, "initiator_bytes": 1482, "last_seen_epoch": "1533964903.863657", "responder_bytes": 1246, "first_seen_epoch": "1533964903.564936" }, { "bytes": 6876, "stream": 355, "flow_id": "flow-e68d9293ecc3fc526ceac070", "packets": 24, "transport": "tcp", "last_frame": 22752, "first_frame": 13596, "initiator_ip": "192.168.1.95", "responder_ip": "74.214.196.133", "initiator_port": 49511, "responder_port": 443, "initiator_bytes": 2046, "last_seen_epoch": "1533964990.373056", "responder_bytes": 4830, "first_seen_epoch": "1533964903.573835" }, { "bytes": 6473, "stream": 356, "flow_id": "flow-c1e2afd7c4b696db93732323", "packets": 17, "transport": "tcp", "last_frame": 22470, "first_frame": 13597, "initiator_ip": "192.168.1.95", "responder_ip": "35.164.209.30", "initiator_port": 49512, "responder_port": 443, "initiator_bytes": 855, "last_seen_epoch": "1533964990.271637", "responder_bytes": 5618, "first_seen_epoch": "1533964903.576685" }, { "bytes": 8956, "stream": 357, "flow_id": "flow-83016dbe0abc8d7ec4e7eaac", "packets": 27, "transport": "tcp", "last_frame": 22464, "first_frame": 13599, "initiator_ip": "192.168.1.95", "responder_ip": "195.244.31.10", "initiator_port": 49513, "responder_port": 443, "initiator_bytes": 1928, "last_seen_epoch": "1533964990.270902", "responder_bytes": 7028, "first_seen_epoch": "1533964903.57737" }, { "bytes": 264, "stream": 147, "flow_id": "flow-943c4ec841e9c6becc013b88", "packets": 2, "transport": "udp", "last_frame": 13794, "first_frame": 13640, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 50852, "responder_port": 53, "initiator_bytes": 82, "last_seen_epoch": "1533964903.730026", "responder_bytes": 182, "first_seen_epoch": "1533964903.629499" }, { "bytes": 2728, "stream": 358, "flow_id": "flow-bddec0c1b80513e41119ffec", "packets": 17, "transport": "tcp", "last_frame": 14178, "first_frame": 13781, "initiator_ip": "192.168.1.95", "responder_ip": "64.41.197.55", "initiator_port": 49514, "responder_port": 443, "initiator_bytes": 1482, "last_seen_epoch": "1533964904.070984", "responder_bytes": 1246, "first_seen_epoch": "1533964903.720893" }, { "bytes": 2674, "stream": 359, "flow_id": "flow-1682602068c4ff878e30235b", "packets": 16, "transport": "tcp", "last_frame": 14109, "first_frame": 13782, "initiator_ip": "192.168.1.95", "responder_ip": "64.41.197.55", "initiator_port": 49515, "responder_port": 443, "initiator_bytes": 1422, "last_seen_epoch": "1533964903.991259", "responder_bytes": 1252, "first_seen_epoch": "1533964903.721064" }, { "bytes": 2728, "stream": 360, "flow_id": "flow-a8fe434ec2d8d2a0b2503b2e", "packets": 17, "transport": "tcp", "last_frame": 14185, "first_frame": 13805, "initiator_ip": "192.168.1.95", "responder_ip": "64.41.197.55", "initiator_port": 49516, "responder_port": 443, "initiator_bytes": 1482, "last_seen_epoch": "1533964904.072214", "responder_bytes": 1246, "first_seen_epoch": "1533964903.732019" }, { "bytes": 2614, "stream": 361, "flow_id": "flow-cf606d15f65d1a0aa49050e0", "packets": 15, "transport": "tcp", "last_frame": 14183, "first_frame": 13812, "initiator_ip": "192.168.1.95", "responder_ip": "64.41.197.55", "initiator_port": 49517, "responder_port": 443, "initiator_bytes": 1422, "last_seen_epoch": "1533964904.071956", "responder_bytes": 1192, "first_seen_epoch": "1533964903.733544" }, { "bytes": 43685, "stream": 362, "flow_id": "flow-7400aba4d4014a9be0f8730e", "packets": 43, "transport": "tcp", "last_frame": 22709, "first_frame": 13837, "initiator_ip": "192.168.1.95", "responder_ip": "23.35.182.113", "initiator_port": 49518, "responder_port": 443, "initiator_bytes": 2021, "last_seen_epoch": "1533964990.344209", "responder_bytes": 41664, "first_seen_epoch": "1533964903.746859" }, { "bytes": 19331, "stream": 363, "flow_id": "flow-f3a55e561c0b6c0fe9d23c83", "packets": 28, "transport": "tcp", "last_frame": 22725, "first_frame": 13839, "initiator_ip": "192.168.1.95", "responder_ip": "23.35.182.113", "initiator_port": 49519, "responder_port": 443, "initiator_bytes": 1601, "last_seen_epoch": "1533964990.345772", "responder_bytes": 17730, "first_seen_epoch": "1533964903.747226" }, { "bytes": 32087, "stream": 364, "flow_id": "flow-632a824687e01e2bdb0e23ad", "packets": 35, "transport": "tcp", "last_frame": 22724, "first_frame": 13840, "initiator_ip": "192.168.1.95", "responder_ip": "23.35.182.113", "initiator_port": 49520, "responder_port": 443, "initiator_bytes": 1841, "last_seen_epoch": "1533964990.345645", "responder_bytes": 30246, "first_seen_epoch": "1533964903.747227" }, { "bytes": 2728, "stream": 365, "flow_id": "flow-261a950f8faa37849e7e0cf6", "packets": 17, "transport": "tcp", "last_frame": 14251, "first_frame": 13900, "initiator_ip": "192.168.1.95", "responder_ip": "64.41.197.55", "initiator_port": 49521, "responder_port": 443, "initiator_bytes": 1482, "last_seen_epoch": "1533964904.142447", "responder_bytes": 1246, "first_seen_epoch": "1533964903.790984" }, { "bytes": 2734, "stream": 366, "flow_id": "flow-8aa9f2fc0531c9e318c355ee", "packets": 17, "transport": "tcp", "last_frame": 14305, "first_frame": 14008, "initiator_ip": "192.168.1.95", "responder_ip": "64.41.197.55", "initiator_port": 49522, "responder_port": 443, "initiator_bytes": 1482, "last_seen_epoch": "1533964904.228519", "responder_bytes": 1252, "first_seen_epoch": "1533964903.870795" }, { "bytes": 2614, "stream": 367, "flow_id": "flow-b5bb04a2d83047022dea1886", "packets": 15, "transport": "tcp", "last_frame": 14359, "first_frame": 14121, "initiator_ip": "192.168.1.95", "responder_ip": "64.41.197.55", "initiator_port": 49523, "responder_port": 443, "initiator_bytes": 1422, "last_seen_epoch": "1533964904.31025", "responder_bytes": 1192, "first_seen_epoch": "1533964903.994986" }, { "bytes": 2788, "stream": 368, "flow_id": "flow-548f81544edecb8000970c56", "packets": 18, "transport": "tcp", "last_frame": 14388, "first_frame": 14175, "initiator_ip": "192.168.1.95", "responder_ip": "64.41.197.55", "initiator_port": 49524, "responder_port": 443, "initiator_bytes": 1542, "last_seen_epoch": "1533964904.338394", "responder_bytes": 1246, "first_seen_epoch": "1533964904.07033" }, { "bytes": 2598, "stream": 369, "flow_id": "flow-51c83c6cccf082f15e4d454e", "packets": 15, "transport": "tcp", "last_frame": 14405, "first_frame": 14186, "initiator_ip": "192.168.1.95", "responder_ip": "64.41.197.55", "initiator_port": 49525, "responder_port": 443, "initiator_bytes": 1422, "last_seen_epoch": "1533964904.37007", "responder_bytes": 1176, "first_seen_epoch": "1533964904.072402" }, { "bytes": 2614, "stream": 370, "flow_id": "flow-306149ccf18572f6d79f07dc", "packets": 15, "transport": "tcp", "last_frame": 14402, "first_frame": 14188, "initiator_ip": "192.168.1.95", "responder_ip": "64.41.197.55", "initiator_port": 49526, "responder_port": 443, "initiator_bytes": 1422, "last_seen_epoch": "1533964904.368972", "responder_bytes": 1192, "first_seen_epoch": "1533964904.073325" }, { "bytes": 2750, "stream": 371, "flow_id": "flow-82ee48e819a730723d4e21c0", "packets": 17, "transport": "tcp", "last_frame": 14478, "first_frame": 14255, "initiator_ip": "192.168.1.95", "responder_ip": "64.41.197.55", "initiator_port": 49527, "responder_port": 443, "initiator_bytes": 1498, "last_seen_epoch": "1533964904.486226", "responder_bytes": 1252, "first_seen_epoch": "1533964904.145257" }, { "bytes": 2690, "stream": 372, "flow_id": "flow-48a4a3df65c0e59186ad5fd9", "packets": 16, "transport": "tcp", "last_frame": 14551, "first_frame": 14298, "initiator_ip": "192.168.1.95", "responder_ip": "64.41.197.55", "initiator_port": 49528, "responder_port": 443, "initiator_bytes": 1438, "last_seen_epoch": "1533964904.581963", "responder_bytes": 1252, "first_seen_epoch": "1533964904.227034" }, { "bytes": 7102, "stream": 373, "flow_id": "flow-7359b6e71ab9e802c5dd3197", "packets": 29, "transport": "tcp", "last_frame": 22633, "first_frame": 14313, "initiator_ip": "192.168.1.95", "responder_ip": "173.241.250.143", "initiator_port": 49529, "responder_port": 443, "initiator_bytes": 2440, "last_seen_epoch": "1533964990.298889", "responder_bytes": 4662, "first_seen_epoch": "1533964904.246105" }, { "bytes": 5131, "stream": 374, "flow_id": "flow-65e2c573f309c12737430ce8", "packets": 20, "transport": "tcp", "last_frame": 22635, "first_frame": 14314, "initiator_ip": "192.168.1.95", "responder_ip": "173.241.250.143", "initiator_port": 49530, "responder_port": 443, "initiator_bytes": 1642, "last_seen_epoch": "1533964990.299764", "responder_bytes": 3489, "first_seen_epoch": "1533964904.247508" }, { "bytes": 5341, "stream": 375, "flow_id": "flow-2c23cac24753364c55d951d5", "packets": 22, "transport": "tcp", "last_frame": 22636, "first_frame": 14315, "initiator_ip": "192.168.1.95", "responder_ip": "173.241.250.143", "initiator_port": 49531, "responder_port": 443, "initiator_bytes": 1755, "last_seen_epoch": "1533964990.300149", "responder_bytes": 3586, "first_seen_epoch": "1533964904.248102" }, { "bytes": 174, "stream": 148, "flow_id": "flow-a87c4a01577895c2cbb3f858", "packets": 2, "transport": "udp", "last_frame": 14376, "first_frame": 14316, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 57347, "responder_port": 53, "initiator_bytes": 71, "last_seen_epoch": "1533964904.333194", "responder_bytes": 103, "first_seen_epoch": "1533964904.262876" }, { "bytes": 8242, "stream": 376, "flow_id": "flow-17a1d5f308bad1e034296274", "packets": 32, "transport": "tcp", "last_frame": 22632, "first_frame": 14322, "initiator_ip": "192.168.1.95", "responder_ip": "173.241.250.143", "initiator_port": 49532, "responder_port": 443, "initiator_bytes": 3089, "last_seen_epoch": "1533964990.298527", "responder_bytes": 5153, "first_seen_epoch": "1533964904.266925" }, { "bytes": 2614, "stream": 377, "flow_id": "flow-4533e5ce9aae16eb591b2a24", "packets": 15, "transport": "tcp", "last_frame": 14591, "first_frame": 14389, "initiator_ip": "192.168.1.95", "responder_ip": "64.41.197.55", "initiator_port": 49533, "responder_port": 443, "initiator_bytes": 1422, "last_seen_epoch": "1533964904.627777", "responder_bytes": 1192, "first_seen_epoch": "1533964904.338601" }, { "bytes": 6409, "stream": 378, "flow_id": "flow-78cf5f62c83b97d5cdcd172b", "packets": 17, "transport": "tcp", "last_frame": 22809, "first_frame": 14392, "initiator_ip": "192.168.1.95", "responder_ip": "34.194.201.62", "initiator_port": 49534, "responder_port": 443, "initiator_bytes": 853, "last_seen_epoch": "1533964990.407587", "responder_bytes": 5556, "first_seen_epoch": "1533964904.34527" }, { "bytes": 8135, "stream": 379, "flow_id": "flow-b54e62283db8d584420741c4", "packets": 21, "transport": "tcp", "last_frame": 22803, "first_frame": 14393, "initiator_ip": "192.168.1.95", "responder_ip": "34.194.201.62", "initiator_port": 49535, "responder_port": 443, "initiator_bytes": 1996, "last_seen_epoch": "1533964990.405002", "responder_bytes": 6139, "first_seen_epoch": "1533964904.345502" }, { "bytes": 2718, "stream": 380, "flow_id": "flow-bed6d365daaa41366be97bff", "packets": 17, "transport": "tcp", "last_frame": 14616, "first_frame": 14394, "initiator_ip": "192.168.1.95", "responder_ip": "64.41.197.55", "initiator_port": 49536, "responder_port": 443, "initiator_bytes": 1482, "last_seen_epoch": "1533964904.637909", "responder_bytes": 1236, "first_seen_epoch": "1533964904.356882" }, { "bytes": 2728, "stream": 381, "flow_id": "flow-2c835122cc59a4b2842bbb04", "packets": 17, "transport": "tcp", "last_frame": 14651, "first_frame": 14416, "initiator_ip": "192.168.1.95", "responder_ip": "64.41.197.55", "initiator_port": 49537, "responder_port": 443, "initiator_bytes": 1482, "last_seen_epoch": "1533964904.668575", "responder_bytes": 1246, "first_seen_epoch": "1533964904.396637" }, { "bytes": 6880, "stream": 382, "flow_id": "flow-8b59ce973cf68d3fff6ef5aa", "packets": 18, "transport": "tcp", "last_frame": 22446, "first_frame": 14454, "initiator_ip": "192.168.1.95", "responder_ip": "34.246.244.104", "initiator_port": 49538, "responder_port": 443, "initiator_bytes": 961, "last_seen_epoch": "1533964990.269262", "responder_bytes": 5919, "first_seen_epoch": "1533964904.453121" }, { "bytes": 8560, "stream": 383, "flow_id": "flow-cdbacb0b42a3c7b0431f83c4", "packets": 24, "transport": "tcp", "last_frame": 22443, "first_frame": 14455, "initiator_ip": "192.168.1.95", "responder_ip": "34.246.244.104", "initiator_port": 49539, "responder_port": 443, "initiator_bytes": 2164, "last_seen_epoch": "1533964990.268817", "responder_bytes": 6396, "first_seen_epoch": "1533964904.453236" }, { "bytes": 1316, "stream": 384, "flow_id": "flow-44791f7fcc8bcdf21dca4e71", "packets": 14, "transport": "tcp", "last_frame": 22440, "first_frame": 14456, "initiator_ip": "192.168.1.95", "responder_ip": "104.20.21.239", "initiator_port": 49540, "responder_port": 443, "initiator_bytes": 748, "last_seen_epoch": "1533964990.268414", "responder_bytes": 568, "first_seen_epoch": "1533964904.453727" }, { "bytes": 3052, "stream": 385, "flow_id": "flow-3e77c367c98b6aa92e01bffc", "packets": 17, "transport": "tcp", "last_frame": 22717, "first_frame": 14458, "initiator_ip": "192.168.1.95", "responder_ip": "104.20.21.239", "initiator_port": 49541, "responder_port": 443, "initiator_bytes": 1815, "last_seen_epoch": "1533964990.34463", "responder_bytes": 1237, "first_seen_epoch": "1533964904.454042" }, { "bytes": 270, "stream": 149, "flow_id": "flow-d23c263fbe5784f2485747b9", "packets": 2, "transport": "udp", "last_frame": 14601, "first_frame": 14513, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 53856, "responder_port": 53, "initiator_bytes": 85, "last_seen_epoch": "1533964904.629602", "responder_bytes": 185, "first_seen_epoch": "1533964904.540196" }, { "bytes": 272, "stream": 150, "flow_id": "flow-c13ae175efc0f343b6993d7a", "packets": 2, "transport": "udp", "last_frame": 14614, "first_frame": 14516, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 59818, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1533964904.637907", "responder_bytes": 200, "first_seen_epoch": "1533964904.554032" }, { "bytes": 406, "stream": 151, "flow_id": "flow-6930a01f54532124bd042168", "packets": 2, "transport": "udp", "last_frame": 14626, "first_frame": 14517, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 61209, "responder_port": 53, "initiator_bytes": 75, "last_seen_epoch": "1533964904.64177", "responder_bytes": 331, "first_seen_epoch": "1533964904.556113" }, { "bytes": 1353, "stream": 386, "flow_id": "flow-4aa9651fe7572f909899b9c1", "packets": 14, "transport": "tcp", "last_frame": 17224, "first_frame": 14530, "initiator_ip": "192.168.1.95", "responder_ip": "23.73.239.75", "initiator_port": 49542, "responder_port": 443, "initiator_bytes": 751, "last_seen_epoch": "1533964955.191042", "responder_bytes": 602, "first_seen_epoch": "1533964904.566358" }, { "bytes": 2758, "stream": 387, "flow_id": "flow-d86316afa5405b80d02a6a99", "packets": 15, "transport": "tcp", "last_frame": 14941, "first_frame": 14537, "initiator_ip": "192.168.1.95", "responder_ip": "64.41.197.55", "initiator_port": 49543, "responder_port": 443, "initiator_bytes": 1566, "last_seen_epoch": "1533964904.913076", "responder_bytes": 1192, "first_seen_epoch": "1533964904.574049" }, { "bytes": 2742, "stream": 388, "flow_id": "flow-38f75fbddfb9e88798719422", "packets": 15, "transport": "tcp", "last_frame": 14945, "first_frame": 14538, "initiator_ip": "192.168.1.95", "responder_ip": "64.41.197.55", "initiator_port": 49544, "responder_port": 443, "initiator_bytes": 1566, "last_seen_epoch": "1533964904.920168", "responder_bytes": 1176, "first_seen_epoch": "1533964904.575182" }, { "bytes": 1473, "stream": 389, "flow_id": "flow-b2c2254e04e7e5694dba8f65", "packets": 16, "transport": "tcp", "last_frame": 17228, "first_frame": 14541, "initiator_ip": "192.168.1.95", "responder_ip": "23.73.239.75", "initiator_port": 49545, "responder_port": 443, "initiator_bytes": 811, "last_seen_epoch": "1533964955.191652", "responder_bytes": 662, "first_seen_epoch": "1533964904.57846" }, { "bytes": 251, "stream": 152, "flow_id": "flow-206f7eb359e368e550c974d5", "packets": 2, "transport": "udp", "last_frame": 14656, "first_frame": 14557, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 60584, "responder_port": 53, "initiator_bytes": 80, "last_seen_epoch": "1533964904.683765", "responder_bytes": 171, "first_seen_epoch": "1533964904.585739" }, { "bytes": 166, "stream": 153, "flow_id": "flow-b55887d0bd507c2ea111901e", "packets": 2, "transport": "udp", "last_frame": 14611, "first_frame": 14558, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 54810, "responder_port": 53, "initiator_bytes": 75, "last_seen_epoch": "1533964904.637605", "responder_bytes": 91, "first_seen_epoch": "1533964904.5865" }, { "bytes": 2822, "stream": 390, "flow_id": "flow-f1cc409ff0807185932750e7", "packets": 15, "transport": "tcp", "last_frame": 14949, "first_frame": 14563, "initiator_ip": "192.168.1.95", "responder_ip": "64.41.197.55", "initiator_port": 49546, "responder_port": 443, "initiator_bytes": 1630, "last_seen_epoch": "1533964904.922776", "responder_bytes": 1192, "first_seen_epoch": "1533964904.592379" }, { "bytes": 327, "stream": 154, "flow_id": "flow-2f698d2bada03650e0e7c236", "packets": 2, "transport": "udp", "last_frame": 14640, "first_frame": 14564, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 59592, "responder_port": 53, "initiator_bytes": 81, "last_seen_epoch": "1533964904.663956", "responder_bytes": 246, "first_seen_epoch": "1533964904.594862" }, { "bytes": 276, "stream": 155, "flow_id": "flow-83304ecc5e0de9363f8020be", "packets": 2, "transport": "udp", "last_frame": 14641, "first_frame": 14565, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 64916, "responder_port": 53, "initiator_bytes": 74, "last_seen_epoch": "1533964904.664048", "responder_bytes": 202, "first_seen_epoch": "1533964904.595064" }, { "bytes": 335, "stream": 156, "flow_id": "flow-0da7786e58a51ff6b3bb8a9e", "packets": 2, "transport": "udp", "last_frame": 14613, "first_frame": 14568, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 54464, "responder_port": 53, "initiator_bytes": 70, "last_seen_epoch": "1533964904.637787", "responder_bytes": 265, "first_seen_epoch": "1533964904.596445" }, { "bytes": 6491, "stream": 391, "flow_id": "flow-e9eba96d5c80c19d0843c18d", "packets": 19, "transport": "tcp", "last_frame": 22430, "first_frame": 14602, "initiator_ip": "192.168.1.95", "responder_ip": "23.213.38.151", "initiator_port": 49547, "responder_port": 443, "initiator_bytes": 911, "last_seen_epoch": "1533964990.267818", "responder_bytes": 5580, "first_seen_epoch": "1533964904.630024" }, { "bytes": 7511, "stream": 392, "flow_id": "flow-e9227ba91bf43d844a1e9efe", "packets": 21, "transport": "tcp", "last_frame": 22731, "first_frame": 14603, "initiator_ip": "192.168.1.95", "responder_ip": "23.213.38.151", "initiator_port": 49548, "responder_port": 443, "initiator_bytes": 1514, "last_seen_epoch": "1533964990.346014", "responder_bytes": 5997, "first_seen_epoch": "1533964904.630184" }, { "bytes": 6840, "stream": 393, "flow_id": "flow-de5cb094acc5b5be96ae89e8", "packets": 19, "transport": "tcp", "last_frame": 22767, "first_frame": 14618, "initiator_ip": "192.168.1.95", "responder_ip": "4.78.226.232", "initiator_port": 49549, "responder_port": 443, "initiator_bytes": 901, "last_seen_epoch": "1533964990.382502", "responder_bytes": 5939, "first_seen_epoch": "1533964904.638951" }, { "bytes": 8196, "stream": 394, "flow_id": "flow-97dbc750475cd97136a6f759", "packets": 21, "transport": "tcp", "last_frame": 22756, "first_frame": 14619, "initiator_ip": "192.168.1.95", "responder_ip": "4.78.226.232", "initiator_port": 49550, "responder_port": 443, "initiator_bytes": 1360, "last_seen_epoch": "1533964990.373367", "responder_bytes": 6836, "first_seen_epoch": "1533964904.639066" }, { "bytes": 10912, "stream": 395, "flow_id": "flow-4733922720ca2a10e8c208ce", "packets": 32, "transport": "tcp", "last_frame": 22421, "first_frame": 14620, "initiator_ip": "192.168.1.95", "responder_ip": "54.191.4.242", "initiator_port": 49551, "responder_port": 443, "initiator_bytes": 2883, "last_seen_epoch": "1533964990.266886", "responder_bytes": 8029, "first_seen_epoch": "1533964904.639532" }, { "bytes": 6854, "stream": 396, "flow_id": "flow-3824180cc74b0b437eed5db8", "packets": 20, "transport": "tcp", "last_frame": 22424, "first_frame": 14621, "initiator_ip": "192.168.1.95", "responder_ip": "54.191.4.242", "initiator_port": 49552, "responder_port": 443, "initiator_bytes": 974, "last_seen_epoch": "1533964990.267237", "responder_bytes": 5880, "first_seen_epoch": "1533964904.639942" }, { "bytes": 7941, "stream": 397, "flow_id": "flow-32b6203f8f194adeba135972", "packets": 22, "transport": "tcp", "last_frame": 22391, "first_frame": 14622, "initiator_ip": "192.168.1.95", "responder_ip": "54.186.237.130", "initiator_port": 49554, "responder_port": 443, "initiator_bytes": 1543, "last_seen_epoch": "1533964990.26355", "responder_bytes": 6398, "first_seen_epoch": "1533964904.640362" }, { "bytes": 6633, "stream": 398, "flow_id": "flow-1b7ac6ab084832eba57c7959", "packets": 20, "transport": "tcp", "last_frame": 22396, "first_frame": 14623, "initiator_ip": "192.168.1.95", "responder_ip": "54.186.237.130", "initiator_port": 49553, "responder_port": 443, "initiator_bytes": 972, "last_seen_epoch": "1533964990.263975", "responder_bytes": 5661, "first_seen_epoch": "1533964904.640423" }, { "bytes": 418, "stream": 157, "flow_id": "flow-c48e9df076b9840123d1f82a", "packets": 2, "transport": "udp", "last_frame": 14679, "first_frame": 14624, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 59186, "responder_port": 53, "initiator_bytes": 70, "last_seen_epoch": "1533964904.689217", "responder_bytes": 348, "first_seen_epoch": "1533964904.640864" }, { "bytes": 41324, "stream": 399, "flow_id": "flow-98f2b929cc90bb21fce2de35", "packets": 138, "transport": "tcp", "last_frame": 39427, "first_frame": 14629, "initiator_ip": "192.168.1.95", "responder_ip": "64.233.184.94", "initiator_port": 49555, "responder_port": 443, "initiator_bytes": 21894, "last_seen_epoch": "1533965249.303765", "responder_bytes": 19430, "first_seen_epoch": "1533964904.642425" }, { "bytes": 52273, "stream": 400, "flow_id": "flow-7ed834cb2ba0fbb94c2d9515", "packets": 155, "transport": "tcp", "last_frame": 39428, "first_frame": 14630, "initiator_ip": "192.168.1.95", "responder_ip": "64.233.184.94", "initiator_port": 49556, "responder_port": 443, "initiator_bytes": 31417, "last_seen_epoch": "1533965249.303825", "responder_bytes": 20856, "first_seen_epoch": "1533964904.642552" }, { "bytes": 302, "stream": 158, "flow_id": "flow-47d8d9a4c8456eb3a9953172", "packets": 2, "transport": "udp", "last_frame": 14749, "first_frame": 14636, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 53358, "responder_port": 53, "initiator_bytes": 91, "last_seen_epoch": "1533964904.736366", "responder_bytes": 211, "first_seen_epoch": "1533964904.647012" }, { "bytes": 6211, "stream": 401, "flow_id": "flow-d3be6ae8f5fdb5cef1cbed35", "packets": 24, "transport": "tcp", "last_frame": 22405, "first_frame": 14642, "initiator_ip": "192.168.1.95", "responder_ip": "52.9.78.114", "initiator_port": 49557, "responder_port": 443, "initiator_bytes": 1518, "last_seen_epoch": "1533964990.265023", "responder_bytes": 4693, "first_seen_epoch": "1533964904.666565" }, { "bytes": 5033, "stream": 402, "flow_id": "flow-310342ad38f6ec4cb60bc30f", "packets": 19, "transport": "tcp", "last_frame": 22408, "first_frame": 14644, "initiator_ip": "192.168.1.95", "responder_ip": "52.9.78.114", "initiator_port": 49558, "responder_port": 443, "initiator_bytes": 923, "last_seen_epoch": "1533964990.265397", "responder_bytes": 4110, "first_seen_epoch": "1533964904.666966" }, { "bytes": 7786, "stream": 403, "flow_id": "flow-3e71ba55a4b785295f8ddfcd", "packets": 22, "transport": "tcp", "last_frame": 22399, "first_frame": 14648, "initiator_ip": "192.168.1.95", "responder_ip": "34.211.69.152", "initiator_port": 49559, "responder_port": 443, "initiator_bytes": 1707, "last_seen_epoch": "1533964990.264313", "responder_bytes": 6079, "first_seen_epoch": "1533964904.668086" }, { "bytes": 6600, "stream": 404, "flow_id": "flow-55bcd89254eb62e5e5720b0f", "packets": 19, "transport": "tcp", "last_frame": 22402, "first_frame": 14649, "initiator_ip": "192.168.1.95", "responder_ip": "34.211.69.152", "initiator_port": 49560, "responder_port": 443, "initiator_bytes": 976, "last_seen_epoch": "1533964990.264675", "responder_bytes": 5624, "first_seen_epoch": "1533964904.668356" }, { "bytes": 2774, "stream": 405, "flow_id": "flow-572c69c045890ad71139ddf6", "packets": 15, "transport": "tcp", "last_frame": 14973, "first_frame": 14654, "initiator_ip": "192.168.1.95", "responder_ip": "64.41.197.55", "initiator_port": 49561, "responder_port": 443, "initiator_bytes": 1582, "last_seen_epoch": "1533964904.96896", "responder_bytes": 1192, "first_seen_epoch": "1533964904.680633" }, { "bytes": 2888, "stream": 406, "flow_id": "flow-786ae730c5901f2cdc26b19e", "packets": 17, "transport": "tcp", "last_frame": 14982, "first_frame": 14655, "initiator_ip": "192.168.1.95", "responder_ip": "64.41.197.55", "initiator_port": 49562, "responder_port": 443, "initiator_bytes": 1642, "last_seen_epoch": "1533964904.976585", "responder_bytes": 1246, "first_seen_epoch": "1533964904.681191" }, { "bytes": 4822, "stream": 407, "flow_id": "flow-6faafbfa5bb09f244fff66ae", "packets": 20, "transport": "tcp", "last_frame": 22416, "first_frame": 14659, "initiator_ip": "192.168.1.95", "responder_ip": "23.8.170.84", "initiator_port": 49563, "responder_port": 443, "initiator_bytes": 966, "last_seen_epoch": "1533964990.266475", "responder_bytes": 3856, "first_seen_epoch": "1533964904.684961" }, { "bytes": 6403, "stream": 408, "flow_id": "flow-57bef319eb0196ceb4f3dde1", "packets": 24, "transport": "tcp", "last_frame": 22723, "first_frame": 14660, "initiator_ip": "192.168.1.95", "responder_ip": "23.8.170.84", "initiator_port": 49564, "responder_port": 443, "initiator_bytes": 1489, "last_seen_epoch": "1533964990.345521", "responder_bytes": 4914, "first_seen_epoch": "1533964904.685307" }, { "bytes": 8688, "stream": 409, "flow_id": "flow-3d6b2bb1a98c916c174805ee", "packets": 24, "transport": "tcp", "last_frame": 22388, "first_frame": 14713, "initiator_ip": "192.168.1.95", "responder_ip": "146.20.133.87", "initiator_port": 49565, "responder_port": 443, "initiator_bytes": 1783, "last_seen_epoch": "1533964990.263166", "responder_bytes": 6905, "first_seen_epoch": "1533964904.706816" }, { "bytes": 7494, "stream": 410, "flow_id": "flow-2a98f8cb5ae213a82939658d", "packets": 24, "transport": "tcp", "last_frame": 22385, "first_frame": 14714, "initiator_ip": "192.168.1.95", "responder_ip": "146.20.133.87", "initiator_port": 49566, "responder_port": 443, "initiator_bytes": 1875, "last_seen_epoch": "1533964990.262691", "responder_bytes": 5619, "first_seen_epoch": "1533964904.707073" }, { "bytes": 13863, "stream": 411, "flow_id": "flow-d2299e75f29775168a1c4462", "packets": 32, "transport": "tcp", "last_frame": 22382, "first_frame": 14715, "initiator_ip": "192.168.1.95", "responder_ip": "146.20.133.87", "initiator_port": 49567, "responder_port": 443, "initiator_bytes": 3776, "last_seen_epoch": "1533964990.262203", "responder_bytes": 10087, "first_seen_epoch": "1533964904.707075" }, { "bytes": 14205, "stream": 412, "flow_id": "flow-f76c1d0a3d91809e927a81bb", "packets": 38, "transport": "tcp", "last_frame": 22379, "first_frame": 14716, "initiator_ip": "192.168.1.95", "responder_ip": "146.20.133.87", "initiator_port": 49568, "responder_port": 443, "initiator_bytes": 3956, "last_seen_epoch": "1533964990.261705", "responder_bytes": 10249, "first_seen_epoch": "1533964904.707276" }, { "bytes": 6605, "stream": 413, "flow_id": "flow-0cac3ec9a18106a8ebe7f8a7", "packets": 20, "transport": "tcp", "last_frame": 22716, "first_frame": 14750, "initiator_ip": "192.168.1.95", "responder_ip": "8.39.36.145", "initiator_port": 49569, "responder_port": 443, "initiator_bytes": 1636, "last_seen_epoch": "1533964990.344528", "responder_bytes": 4969, "first_seen_epoch": "1533964904.737024" }, { "bytes": 4148, "stream": 414, "flow_id": "flow-ed5b6745b0627b96ad65bb03", "packets": 15, "transport": "tcp", "last_frame": 22707, "first_frame": 14751, "initiator_ip": "192.168.1.95", "responder_ip": "8.39.36.145", "initiator_port": 49570, "responder_port": 443, "initiator_bytes": 1005, "last_seen_epoch": "1533964990.340488", "responder_bytes": 3143, "first_seen_epoch": "1533964904.737196" }, { "bytes": 236, "stream": 159, "flow_id": "flow-6473fa90e3bd6ceffdb3c792", "packets": 2, "transport": "udp", "last_frame": 15053, "first_frame": 14974, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 51231, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1533964905.068551", "responder_bytes": 164, "first_seen_epoch": "1533964904.971944" }, { "bytes": 8330, "stream": 415, "flow_id": "flow-94e4c48ab3f375a1d6c14e0f", "packets": 24, "transport": "tcp", "last_frame": 29494, "first_frame": 15054, "initiator_ip": "192.168.1.95", "responder_ip": "23.73.239.75", "initiator_port": 49571, "responder_port": 443, "initiator_bytes": 3352, "last_seen_epoch": "1533965095.517504", "responder_bytes": 4978, "first_seen_epoch": "1533964905.071242" }, { "bytes": 12040, "stream": 416, "flow_id": "flow-c0932f71aefe1de1ddfa8613", "packets": 34, "transport": "tcp", "last_frame": 22715, "first_frame": 15055, "initiator_ip": "192.168.1.95", "responder_ip": "23.73.239.75", "initiator_port": 49572, "responder_port": 443, "initiator_bytes": 5874, "last_seen_epoch": "1533964990.344504", "responder_bytes": 6166, "first_seen_epoch": "1533964905.071372" }, { "bytes": 207, "stream": 160, "flow_id": "flow-c02575ab3ce9f48a42dc80a9", "packets": 2, "transport": "udp", "last_frame": 15186, "first_frame": 15185, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 52262, "responder_port": 53, "initiator_bytes": 71, "last_seen_epoch": "1533964906.152257", "responder_bytes": 136, "first_seen_epoch": "1533964905.944747" }, { "bytes": 115295, "stream": 417, "flow_id": "flow-b75361493bffaff5bf126e5b", "packets": 106, "transport": "tcp", "last_frame": 22349, "first_frame": 15187, "initiator_ip": "192.168.1.95", "responder_ip": "205.185.216.10", "initiator_port": 49573, "responder_port": 443, "initiator_bytes": 3783, "last_seen_epoch": "1533964990.25894", "responder_bytes": 111512, "first_seen_epoch": "1533964906.188846" }, { "bytes": 115875, "stream": 418, "flow_id": "flow-c3e26c79c9cab642f4327f9b", "packets": 118, "transport": "tcp", "last_frame": 22352, "first_frame": 15188, "initiator_ip": "192.168.1.95", "responder_ip": "205.185.216.10", "initiator_port": 49574, "responder_port": 443, "initiator_bytes": 4383, "last_seen_epoch": "1533964990.259175", "responder_bytes": 111492, "first_seen_epoch": "1533964906.188987" }, { "bytes": 116181, "stream": 419, "flow_id": "flow-14231564f63538d861f89362", "packets": 124, "transport": "tcp", "last_frame": 22344, "first_frame": 15189, "initiator_ip": "192.168.1.95", "responder_ip": "205.185.216.10", "initiator_port": 49575, "responder_port": 443, "initiator_bytes": 4683, "last_seen_epoch": "1533964990.258334", "responder_bytes": 111498, "first_seen_epoch": "1533964906.189826" }, { "bytes": 5589, "stream": 420, "flow_id": "flow-e56b9c549513b8a94f02fbb2", "packets": 16, "transport": "tcp", "last_frame": 22357, "first_frame": 15190, "initiator_ip": "192.168.1.95", "responder_ip": "205.185.216.10", "initiator_port": 49576, "responder_port": 443, "initiator_bytes": 853, "last_seen_epoch": "1533964990.259593", "responder_bytes": 4736, "first_seen_epoch": "1533964906.20994" }, { "bytes": 5817, "stream": 421, "flow_id": "flow-cdaae01e2a842ef48564a598", "packets": 20, "transport": "tcp", "last_frame": 22360, "first_frame": 15191, "initiator_ip": "192.168.1.95", "responder_ip": "205.185.216.10", "initiator_port": 49577, "responder_port": 443, "initiator_bytes": 973, "last_seen_epoch": "1533964990.260113", "responder_bytes": 4844, "first_seen_epoch": "1533964906.223327" }, { "bytes": 5643, "stream": 422, "flow_id": "flow-10ec8c951b79756e4d944076", "packets": 17, "transport": "tcp", "last_frame": 22365, "first_frame": 15198, "initiator_ip": "192.168.1.95", "responder_ip": "205.185.216.10", "initiator_port": 49578, "responder_port": 443, "initiator_bytes": 853, "last_seen_epoch": "1533964990.260531", "responder_bytes": 4790, "first_seen_epoch": "1533964906.257212" }, { "bytes": 170, "stream": 161, "flow_id": "flow-56eb113e9d1d22d3ad9cd21c", "packets": 2, "transport": "udp", "last_frame": 15402, "first_frame": 15268, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 49373, "responder_port": 53, "initiator_bytes": 77, "last_seen_epoch": "1533964906.564513", "responder_bytes": 93, "first_seen_epoch": "1533964906.418364" }, { "bytes": 328, "stream": 162, "flow_id": "flow-f8968c583c18c89a46210ef3", "packets": 2, "transport": "udp", "last_frame": 15556, "first_frame": 15389, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 62271, "responder_port": 53, "initiator_bytes": 75, "last_seen_epoch": "1533964906.746311", "responder_bytes": 253, "first_seen_epoch": "1533964906.55097" }, { "bytes": 4087, "stream": 423, "flow_id": "flow-6eefcc2cf056994eed2964f4", "packets": 15, "transport": "tcp", "last_frame": 22732, "first_frame": 15405, "initiator_ip": "192.168.1.95", "responder_ip": "74.119.117.129", "initiator_port": 49579, "responder_port": 443, "initiator_bytes": 991, "last_seen_epoch": "1533964990.346106", "responder_bytes": 3096, "first_seen_epoch": "1533964906.565378" }, { "bytes": 31238, "stream": 424, "flow_id": "flow-f3056410d89b65e99b9b5a4a", "packets": 49, "transport": "tcp", "last_frame": 22727, "first_frame": 15406, "initiator_ip": "192.168.1.95", "responder_ip": "74.119.117.129", "initiator_port": 49580, "responder_port": 443, "initiator_bytes": 2797, "last_seen_epoch": "1533964990.345774", "responder_bytes": 28441, "first_seen_epoch": "1533964906.565484" }, { "bytes": 9425, "stream": 425, "flow_id": "flow-b98deaacc532231cc06fc74f", "packets": 32, "transport": "tcp", "last_frame": 22322, "first_frame": 15560, "initiator_ip": "192.168.1.95", "responder_ip": "54.214.11.239", "initiator_port": 49581, "responder_port": 443, "initiator_bytes": 2647, "last_seen_epoch": "1533964990.256859", "responder_bytes": 6778, "first_seen_epoch": "1533964906.748157" }, { "bytes": 6787, "stream": 426, "flow_id": "flow-ef571eec0b5aaf1e6c96e80d", "packets": 22, "transport": "tcp", "last_frame": 22329, "first_frame": 15564, "initiator_ip": "192.168.1.95", "responder_ip": "54.214.11.239", "initiator_port": 49582, "responder_port": 443, "initiator_bytes": 1037, "last_seen_epoch": "1533964990.257396", "responder_bytes": 5750, "first_seen_epoch": "1533964906.748583" }, { "bytes": 396, "stream": 163, "flow_id": "flow-bcc062fb3b0ace292907d573", "packets": 2, "transport": "udp", "last_frame": 15635, "first_frame": 15606, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 56281, "responder_port": 53, "initiator_bytes": 70, "last_seen_epoch": "1533964906.967863", "responder_bytes": 326, "first_seen_epoch": "1533964906.852301" }, { "bytes": 9945, "stream": 427, "flow_id": "flow-aa28d93e2ba37bfb14921688", "packets": 34, "transport": "tcp", "last_frame": 22287, "first_frame": 15640, "initiator_ip": "192.168.1.95", "responder_ip": "146.20.132.243", "initiator_port": 49583, "responder_port": 443, "initiator_bytes": 3180, "last_seen_epoch": "1533964990.254603", "responder_bytes": 6765, "first_seen_epoch": "1533964906.968703" }, { "bytes": 9945, "stream": 428, "flow_id": "flow-f269216d62abd5955da4a5fd", "packets": 34, "transport": "tcp", "last_frame": 22294, "first_frame": 15641, "initiator_ip": "192.168.1.95", "responder_ip": "146.20.132.243", "initiator_port": 49584, "responder_port": 443, "initiator_bytes": 3180, "last_seen_epoch": "1533964990.255116", "responder_bytes": 6765, "first_seen_epoch": "1533964906.968906" }, { "bytes": 8843, "stream": 429, "flow_id": "flow-4ece2ce4b78894973dedfc91", "packets": 30, "transport": "tcp", "last_frame": 22301, "first_frame": 15656, "initiator_ip": "192.168.1.95", "responder_ip": "146.20.132.243", "initiator_port": 49585, "responder_port": 443, "initiator_bytes": 2709, "last_seen_epoch": "1533964990.255466", "responder_bytes": 6134, "first_seen_epoch": "1533964906.998798" }, { "bytes": 7693, "stream": 430, "flow_id": "flow-bae34024c8ce715242e8150f", "packets": 26, "transport": "tcp", "last_frame": 22306, "first_frame": 15686, "initiator_ip": "192.168.1.95", "responder_ip": "146.20.132.243", "initiator_port": 49586, "responder_port": 443, "initiator_bytes": 2130, "last_seen_epoch": "1533964990.255844", "responder_bytes": 5563, "first_seen_epoch": "1533964907.214413" }, { "bytes": 5990, "stream": 431, "flow_id": "flow-9717e2cb4a077a7ed9a076c7", "packets": 23, "transport": "tcp", "last_frame": 22315, "first_frame": 15702, "initiator_ip": "192.168.1.95", "responder_ip": "146.20.132.243", "initiator_port": 49587, "responder_port": 443, "initiator_bytes": 1032, "last_seen_epoch": "1533964990.256324", "responder_bytes": 4958, "first_seen_epoch": "1533964907.299771" }, { "bytes": 2920, "stream": 432, "flow_id": "flow-6cbf2f79a1756683d2cd726c", "packets": 17, "transport": "tcp", "last_frame": 15860, "first_frame": 15756, "initiator_ip": "192.168.1.95", "responder_ip": "64.41.197.55", "initiator_port": 49589, "responder_port": 443, "initiator_bytes": 1674, "last_seen_epoch": "1533964907.782215", "responder_bytes": 1246, "first_seen_epoch": "1533964907.495076" }, { "bytes": 2806, "stream": 433, "flow_id": "flow-90856f2a0027b3ae2efcd770", "packets": 15, "transport": "tcp", "last_frame": 15865, "first_frame": 15757, "initiator_ip": "192.168.1.95", "responder_ip": "64.41.197.55", "initiator_port": 49588, "responder_port": 443, "initiator_bytes": 1614, "last_seen_epoch": "1533964907.785557", "responder_bytes": 1192, "first_seen_epoch": "1533964907.495078" }, { "bytes": 7731, "stream": 434, "flow_id": "flow-37508742ea8384463598948e", "packets": 26, "transport": "tcp", "last_frame": 22280, "first_frame": 15781, "initiator_ip": "192.168.1.95", "responder_ip": "146.20.132.243", "initiator_port": 49590, "responder_port": 443, "initiator_bytes": 2222, "last_seen_epoch": "1533964990.254092", "responder_bytes": 5509, "first_seen_epoch": "1533964907.576839" }, { "bytes": 235, "stream": 164, "flow_id": "flow-36658d86a07f25bcfe56c53c", "packets": 2, "transport": "udp", "last_frame": 15826, "first_frame": 15784, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 51692, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1533964907.702394", "responder_bytes": 159, "first_seen_epoch": "1533964907.606307" }, { "bytes": 28227, "stream": 435, "flow_id": "flow-5d8d6631972d7192f69a46ef", "packets": 44, "transport": "tcp", "last_frame": 29477, "first_frame": 15829, "initiator_ip": "192.168.1.95", "responder_ip": "23.54.21.180", "initiator_port": 49591, "responder_port": 443, "initiator_bytes": 4395, "last_seen_epoch": "1533965095.516415", "responder_bytes": 23832, "first_seen_epoch": "1533964907.716214" }, { "bytes": 4835, "stream": 436, "flow_id": "flow-7edfb1427bd0540f4836fd4c", "packets": 20, "transport": "tcp", "last_frame": 18175, "first_frame": 15830, "initiator_ip": "192.168.1.95", "responder_ip": "23.54.21.180", "initiator_port": 49592, "responder_port": 443, "initiator_bytes": 902, "last_seen_epoch": "1533964958.35819", "responder_bytes": 3933, "first_seen_epoch": "1533964907.716215" }, { "bytes": 227, "stream": 165, "flow_id": "flow-5fa6cf4c32755fbfd31cb538", "packets": 2, "transport": "udp", "last_frame": 15930, "first_frame": 15919, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 61160, "responder_port": 53, "initiator_bytes": 79, "last_seen_epoch": "1533964908.051426", "responder_bytes": 148, "first_seen_epoch": "1533964907.947302" }, { "bytes": 11539, "stream": 437, "flow_id": "flow-c54c0ed97ac31c5dba566908", "packets": 21, "transport": "tcp", "last_frame": 22705, "first_frame": 15931, "initiator_ip": "192.168.1.95", "responder_ip": "104.36.113.23", "initiator_port": 49593, "responder_port": 443, "initiator_bytes": 1608, "last_seen_epoch": "1533964990.322939", "responder_bytes": 9931, "first_seen_epoch": "1533964908.056895" }, { "bytes": 22242, "stream": 438, "flow_id": "flow-a5cdff1ba90d57e4e966a22d", "packets": 43, "transport": "tcp", "last_frame": 29492, "first_frame": 15932, "initiator_ip": "192.168.1.95", "responder_ip": "104.36.113.23", "initiator_port": 49594, "responder_port": 443, "initiator_bytes": 7149, "last_seen_epoch": "1533965095.517314", "responder_bytes": 15093, "first_seen_epoch": "1533964908.056999" }, { "bytes": 388, "stream": 166, "flow_id": "flow-c88c8c357560f744432ab1a5", "packets": 2, "transport": "udp", "last_frame": 16032, "first_frame": 15967, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 64922, "responder_port": 53, "initiator_bytes": 77, "last_seen_epoch": "1533964908.406611", "responder_bytes": 311, "first_seen_epoch": "1533964908.323614" }, { "bytes": 5646, "stream": 439, "flow_id": "flow-f747a20ad31a692ad34a7762", "packets": 24, "transport": "tcp", "last_frame": 22265, "first_frame": 15974, "initiator_ip": "192.168.1.95", "responder_ip": "69.194.244.11", "initiator_port": 49596, "responder_port": 443, "initiator_bytes": 1659, "last_seen_epoch": "1533964990.253027", "responder_bytes": 3987, "first_seen_epoch": "1533964908.327523" }, { "bytes": 5377, "stream": 440, "flow_id": "flow-602834be232b54428d06c83c", "packets": 22, "transport": "tcp", "last_frame": 22259, "first_frame": 15975, "initiator_ip": "192.168.1.95", "responder_ip": "69.194.244.11", "initiator_port": 49595, "responder_port": 443, "initiator_bytes": 1599, "last_seen_epoch": "1533964990.252549", "responder_bytes": 3778, "first_seen_epoch": "1533964908.327524" }, { "bytes": 6171, "stream": 441, "flow_id": "flow-586cf9c609b2ce0e3f00f125", "packets": 22, "transport": "tcp", "last_frame": 17039, "first_frame": 15976, "initiator_ip": "192.168.1.95", "responder_ip": "199.38.167.128", "initiator_port": 49597, "responder_port": 443, "initiator_bytes": 1981, "last_seen_epoch": "1533964919.639094", "responder_bytes": 4190, "first_seen_epoch": "1533964908.328508" }, { "bytes": 4089, "stream": 442, "flow_id": "flow-52bbace01641aa46b563dc0c", "packets": 14, "transport": "tcp", "last_frame": 17040, "first_frame": 15977, "initiator_ip": "192.168.1.95", "responder_ip": "199.38.167.128", "initiator_port": 49598, "responder_port": 443, "initiator_bytes": 958, "last_seen_epoch": "1533964919.639094", "responder_bytes": 3131, "first_seen_epoch": "1533964908.328593" }, { "bytes": 15748, "stream": 443, "flow_id": "flow-bb970fa9b033ba1d6e86c7a4", "packets": 41, "transport": "tcp", "last_frame": 26292, "first_frame": 15978, "initiator_ip": "192.168.1.95", "responder_ip": "54.186.116.83", "initiator_port": 49599, "responder_port": 443, "initiator_bytes": 5221, "last_seen_epoch": "1533965032.30225", "responder_bytes": 10527, "first_seen_epoch": "1533964908.329578" }, { "bytes": 20354, "stream": 444, "flow_id": "flow-d9795a947218f36505ac0175", "packets": 46, "transport": "tcp", "last_frame": 29266, "first_frame": 15979, "initiator_ip": "192.168.1.95", "responder_ip": "54.186.116.83", "initiator_port": 49600, "responder_port": 443, "initiator_bytes": 6919, "last_seen_epoch": "1533965095.247093", "responder_bytes": 13435, "first_seen_epoch": "1533964908.329683" }, { "bytes": 8565, "stream": 445, "flow_id": "flow-12854f158a4d0d403efe0bbc", "packets": 22, "transport": "tcp", "last_frame": 16216, "first_frame": 15980, "initiator_ip": "192.168.1.95", "responder_ip": "151.101.2.49", "initiator_port": 49601, "responder_port": 443, "initiator_bytes": 1624, "last_seen_epoch": "1533964908.595124", "responder_bytes": 6941, "first_seen_epoch": "1533964908.331986" }, { "bytes": 8447, "stream": 446, "flow_id": "flow-d76c32584495e493ae646898", "packets": 22, "transport": "tcp", "last_frame": 16556, "first_frame": 15981, "initiator_ip": "192.168.1.95", "responder_ip": "151.101.2.49", "initiator_port": 49602, "responder_port": 443, "initiator_bytes": 1576, "last_seen_epoch": "1533964910.067304", "responder_bytes": 6871, "first_seen_epoch": "1533964908.331988" }, { "bytes": 164, "stream": 167, "flow_id": "flow-9295196de099d529f376079c", "packets": 2, "transport": "udp", "last_frame": 15991, "first_frame": 15982, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 57433, "responder_port": 53, "initiator_bytes": 74, "last_seen_epoch": "1533964908.383676", "responder_bytes": 90, "first_seen_epoch": "1533964908.334286" }, { "bytes": 7215, "stream": 447, "flow_id": "flow-6ab90045a5d86daef600e185", "packets": 26, "transport": "tcp", "last_frame": 29525, "first_frame": 15983, "initiator_ip": "192.168.1.95", "responder_ip": "216.200.232.221", "initiator_port": 49603, "responder_port": 443, "initiator_bytes": 2424, "last_seen_epoch": "1533965095.520221", "responder_bytes": 4791, "first_seen_epoch": "1533964908.336198" }, { "bytes": 7403, "stream": 448, "flow_id": "flow-a2ec27807e1c8eb9f9b6310a", "packets": 27, "transport": "tcp", "last_frame": 29544, "first_frame": 15984, "initiator_ip": "192.168.1.95", "responder_ip": "216.200.232.221", "initiator_port": 49604, "responder_port": 443, "initiator_bytes": 2532, "last_seen_epoch": "1533965095.522467", "responder_bytes": 4871, "first_seen_epoch": "1533964908.336313" }, { "bytes": 289, "stream": 168, "flow_id": "flow-673ab4c20617d4d38b82b627", "packets": 2, "transport": "udp", "last_frame": 16039, "first_frame": 15985, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 63507, "responder_port": 53, "initiator_bytes": 85, "last_seen_epoch": "1533964908.424347", "responder_bytes": 204, "first_seen_epoch": "1533964908.336781" }, { "bytes": 261, "stream": 169, "flow_id": "flow-b6d1d0c128a6cb5d3afa6c68", "packets": 2, "transport": "udp", "last_frame": 16028, "first_frame": 15986, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 54525, "responder_port": 53, "initiator_bytes": 89, "last_seen_epoch": "1533964908.406114", "responder_bytes": 172, "first_seen_epoch": "1533964908.338567" }, { "bytes": 5216, "stream": 449, "flow_id": "flow-14d88785a85db0adf4033c1b", "packets": 18, "transport": "tcp", "last_frame": 17037, "first_frame": 16004, "initiator_ip": "192.168.1.95", "responder_ip": "74.119.117.94", "initiator_port": 49605, "responder_port": 443, "initiator_bytes": 1607, "last_seen_epoch": "1533964918.774764", "responder_bytes": 3609, "first_seen_epoch": "1533964908.388066" }, { "bytes": 3958, "stream": 450, "flow_id": "flow-68398a8ccf0c6e792a151ccd", "packets": 13, "transport": "tcp", "last_frame": 17048, "first_frame": 16005, "initiator_ip": "192.168.1.95", "responder_ip": "74.119.117.94", "initiator_port": 49606, "responder_port": 443, "initiator_bytes": 868, "last_seen_epoch": "1533964920.681474", "responder_bytes": 3090, "first_seen_epoch": "1533964908.388252" }, { "bytes": 227, "stream": 170, "flow_id": "flow-e77e3b4991d61f252db0a208", "packets": 2, "transport": "udp", "last_frame": 16092, "first_frame": 16023, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 54474, "responder_port": 53, "initiator_bytes": 80, "last_seen_epoch": "1533964908.469322", "responder_bytes": 147, "first_seen_epoch": "1533964908.405443" }, { "bytes": 6772, "stream": 451, "flow_id": "flow-faa87b7f37ddf9403b1d76ef", "packets": 19, "transport": "tcp", "last_frame": 22253, "first_frame": 16031, "initiator_ip": "192.168.1.95", "responder_ip": "104.193.83.156", "initiator_port": 49607, "responder_port": 443, "initiator_bytes": 975, "last_seen_epoch": "1533964990.252033", "responder_bytes": 5797, "first_seen_epoch": "1533964908.406588" }, { "bytes": 7848, "stream": 452, "flow_id": "flow-ef13a679638fb732fc481bfc", "packets": 25, "transport": "tcp", "last_frame": 22246, "first_frame": 16033, "initiator_ip": "192.168.1.95", "responder_ip": "104.193.83.156", "initiator_port": 49608, "responder_port": 443, "initiator_bytes": 1418, "last_seen_epoch": "1533964990.251532", "responder_bytes": 6430, "first_seen_epoch": "1533964908.406794" }, { "bytes": 6123, "stream": 453, "flow_id": "flow-776f984214bb9e9ad16fc392", "packets": 23, "transport": "tcp", "last_frame": 29275, "first_frame": 16035, "initiator_ip": "192.168.1.95", "responder_ip": "52.44.44.54", "initiator_port": 49609, "responder_port": 443, "initiator_bytes": 1630, "last_seen_epoch": "1533965095.248204", "responder_bytes": 4493, "first_seen_epoch": "1533964908.4092" }, { "bytes": 19093, "stream": 454, "flow_id": "flow-4149eeb08a894157a8c09611", "packets": 55, "transport": "tcp", "last_frame": 22766, "first_frame": 16036, "initiator_ip": "192.168.1.95", "responder_ip": "52.44.44.54", "initiator_port": 49610, "responder_port": 443, "initiator_bytes": 8198, "last_seen_epoch": "1533964990.382398", "responder_bytes": 10895, "first_seen_epoch": "1533964908.409202" }, { "bytes": 6111, "stream": 455, "flow_id": "flow-058b541c8d1868a83399fefc", "packets": 19, "transport": "tcp", "last_frame": 16298, "first_frame": 16040, "initiator_ip": "192.168.1.95", "responder_ip": "205.180.87.137", "initiator_port": 49611, "responder_port": 443, "initiator_bytes": 1390, "last_seen_epoch": "1533964908.710971", "responder_bytes": 4721, "first_seen_epoch": "1533964908.426287" }, { "bytes": 6385, "stream": 456, "flow_id": "flow-8aa481f06643bbf7e67f5300", "packets": 21, "transport": "tcp", "last_frame": 16335, "first_frame": 16041, "initiator_ip": "192.168.1.95", "responder_ip": "205.180.87.137", "initiator_port": 49612, "responder_port": 443, "initiator_bytes": 1514, "last_seen_epoch": "1533964908.781577", "responder_bytes": 4871, "first_seen_epoch": "1533964908.426519" }, { "bytes": 11058, "stream": 457, "flow_id": "flow-7ddd8aa80a34153de356241b", "packets": 30, "transport": "tcp", "last_frame": 22703, "first_frame": 16099, "initiator_ip": "192.168.1.95", "responder_ip": "104.36.113.17", "initiator_port": 49613, "responder_port": 443, "initiator_bytes": 3284, "last_seen_epoch": "1533964990.321023", "responder_bytes": 7774, "first_seen_epoch": "1533964908.47637" }, { "bytes": 15068, "stream": 458, "flow_id": "flow-2a711fecb505c11d747f49d9", "packets": 36, "transport": "tcp", "last_frame": 22701, "first_frame": 16100, "initiator_ip": "192.168.1.95", "responder_ip": "104.36.113.17", "initiator_port": 49614, "responder_port": 443, "initiator_bytes": 5846, "last_seen_epoch": "1533964990.320943", "responder_bytes": 9222, "first_seen_epoch": "1533964908.479729" }, { "bytes": 8626, "stream": 459, "flow_id": "flow-c1edab43c5d8619afbeb803d", "packets": 24, "transport": "tcp", "last_frame": 22704, "first_frame": 16214, "initiator_ip": "192.168.1.95", "responder_ip": "104.36.113.17", "initiator_port": 49615, "responder_port": 443, "initiator_bytes": 2097, "last_seen_epoch": "1533964990.321024", "responder_bytes": 6529, "first_seen_epoch": "1533964908.594889" }, { "bytes": 13790, "stream": 460, "flow_id": "flow-0cdcb27cf1274ea79226616e", "packets": 35, "transport": "tcp", "last_frame": 29485, "first_frame": 16321, "initiator_ip": "192.168.1.95", "responder_ip": "104.36.113.17", "initiator_port": 49616, "responder_port": 443, "initiator_bytes": 9139, "last_seen_epoch": "1533965095.516713", "responder_bytes": 4651, "first_seen_epoch": "1533964908.760459" }, { "bytes": 14350, "stream": 461, "flow_id": "flow-e912f52d36309a204db9905f", "packets": 35, "transport": "tcp", "last_frame": 29484, "first_frame": 16328, "initiator_ip": "192.168.1.95", "responder_ip": "104.36.113.17", "initiator_port": 49617, "responder_port": 443, "initiator_bytes": 9603, "last_seen_epoch": "1533965095.516712", "responder_bytes": 4747, "first_seen_epoch": "1533964908.769253" }, { "bytes": 13726, "stream": 462, "flow_id": "flow-4984aebc4ea29a72048ca6c8", "packets": 35, "transport": "tcp", "last_frame": 29486, "first_frame": 16336, "initiator_ip": "192.168.1.95", "responder_ip": "104.36.113.17", "initiator_port": 49618, "responder_port": 443, "initiator_bytes": 9091, "last_seen_epoch": "1533965095.516875", "responder_bytes": 4635, "first_seen_epoch": "1533964908.782414" }, { "bytes": 227, "stream": 171, "flow_id": "flow-09fb398ebce32fb95e1db470", "packets": 2, "transport": "udp", "last_frame": 16389, "first_frame": 16362, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 52094, "responder_port": 53, "initiator_bytes": 79, "last_seen_epoch": "1533964908.885044", "responder_bytes": 148, "first_seen_epoch": "1533964908.826784" }, { "bytes": 8283, "stream": 463, "flow_id": "flow-9c1b1c2eeded834830c07b79", "packets": 23, "transport": "tcp", "last_frame": 22700, "first_frame": 16392, "initiator_ip": "192.168.1.95", "responder_ip": "104.36.113.24", "initiator_port": 49619, "responder_port": 443, "initiator_bytes": 2096, "last_seen_epoch": "1533964990.319665", "responder_bytes": 6187, "first_seen_epoch": "1533964908.88881" }, { "bytes": 8759, "stream": 464, "flow_id": "flow-1577362f58387eb7e98778c6", "packets": 24, "transport": "tcp", "last_frame": 29481, "first_frame": 16393, "initiator_ip": "192.168.1.95", "responder_ip": "104.36.113.24", "initiator_port": 49620, "responder_port": 443, "initiator_bytes": 2512, "last_seen_epoch": "1533965095.516547", "responder_bytes": 6247, "first_seen_epoch": "1533964908.888812" }, { "bytes": 261, "stream": 172, "flow_id": "flow-fe75512bde4448282f979d00", "packets": 2, "transport": "udp", "last_frame": 16445, "first_frame": 16422, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 52816, "responder_port": 53, "initiator_bytes": 82, "last_seen_epoch": "1533964909.104131", "responder_bytes": 179, "first_seen_epoch": "1533964908.974972" }, { "bytes": 23054, "stream": 465, "flow_id": "flow-68714a4a69c4530dab21747b", "packets": 32, "transport": "tcp", "last_frame": 29483, "first_frame": 16446, "initiator_ip": "192.168.1.95", "responder_ip": "184.26.122.58", "initiator_port": 49621, "responder_port": 443, "initiator_bytes": 3090, "last_seen_epoch": "1533965095.516625", "responder_bytes": 19964, "first_seen_epoch": "1533964909.104657" }, { "bytes": 4530, "stream": 466, "flow_id": "flow-269babc63b5c783afc32c16f", "packets": 18, "transport": "tcp", "last_frame": 18669, "first_frame": 16447, "initiator_ip": "192.168.1.95", "responder_ip": "184.26.122.58", "initiator_port": 49622, "responder_port": 443, "initiator_bytes": 924, "last_seen_epoch": "1533964959.614935", "responder_bytes": 3606, "first_seen_epoch": "1533964909.104796" }, { "bytes": 379, "stream": 173, "flow_id": "flow-13e06a4cd3ec83144621f22e", "packets": 2, "transport": "udp", "last_frame": 16524, "first_frame": 16523, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 57868, "responder_port": 53, "initiator_bytes": 74, "last_seen_epoch": "1533964909.718959", "responder_bytes": 305, "first_seen_epoch": "1533964909.665205" }, { "bytes": 4777, "stream": 467, "flow_id": "flow-c689c7664de506176d22b13b", "packets": 21, "transport": "tcp", "last_frame": 22226, "first_frame": 16525, "initiator_ip": "192.168.1.95", "responder_ip": "54.246.133.167", "initiator_port": 49623, "responder_port": 443, "initiator_bytes": 976, "last_seen_epoch": "1533964990.249861", "responder_bytes": 3801, "first_seen_epoch": "1533964909.720227" }, { "bytes": 8081, "stream": 468, "flow_id": "flow-7f7b76f8d47372fb2778ce8d", "packets": 30, "transport": "tcp", "last_frame": 22221, "first_frame": 16526, "initiator_ip": "192.168.1.95", "responder_ip": "54.246.133.167", "initiator_port": 49624, "responder_port": 443, "initiator_bytes": 2442, "last_seen_epoch": "1533964990.249329", "responder_bytes": 5639, "first_seen_epoch": "1533964909.720229" }, { "bytes": 254, "stream": 174, "flow_id": "flow-e1e3313c275c5d1f90aa1c78", "packets": 2, "transport": "udp", "last_frame": 16558, "first_frame": 16538, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 64055, "responder_port": 53, "initiator_bytes": 84, "last_seen_epoch": "1533964910.093175", "responder_bytes": 170, "first_seen_epoch": "1533964909.995908" }, { "bytes": 249, "stream": 175, "flow_id": "flow-2b2bd8cbd8601f772935d466", "packets": 2, "transport": "udp", "last_frame": 16602, "first_frame": 16557, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 50164, "responder_port": 53, "initiator_bytes": 84, "last_seen_epoch": "1533964910.201908", "responder_bytes": 165, "first_seen_epoch": "1533964910.070782" }, { "bytes": 5825, "stream": 469, "flow_id": "flow-7533835c1ee4ddfe95f0fe92", "packets": 20, "transport": "tcp", "last_frame": 22217, "first_frame": 16559, "initiator_ip": "192.168.1.95", "responder_ip": "8.39.36.172", "initiator_port": 49625, "responder_port": 443, "initiator_bytes": 1837, "last_seen_epoch": "1533964990.248609", "responder_bytes": 3988, "first_seen_epoch": "1533964910.093917" }, { "bytes": 6031, "stream": 470, "flow_id": "flow-02226e79393ab3458b0f333f", "packets": 23, "transport": "tcp", "last_frame": 22702, "first_frame": 16560, "initiator_ip": "192.168.1.95", "responder_ip": "8.39.36.172", "initiator_port": 49626, "responder_port": 443, "initiator_bytes": 1957, "last_seen_epoch": "1533964990.320944", "responder_bytes": 4074, "first_seen_epoch": "1533964910.093958" }, { "bytes": 5869, "stream": 471, "flow_id": "flow-acf917b4367cd7011a13135e", "packets": 21, "transport": "tcp", "last_frame": 22220, "first_frame": 16561, "initiator_ip": "192.168.1.95", "responder_ip": "8.39.36.172", "initiator_port": 49627, "responder_port": 443, "initiator_bytes": 1897, "last_seen_epoch": "1533964990.249129", "responder_bytes": 3972, "first_seen_epoch": "1533964910.094161" }, { "bytes": 9056, "stream": 472, "flow_id": "flow-097954433b9d7f8579ea2687", "packets": 25, "transport": "tcp", "last_frame": 22675, "first_frame": 16603, "initiator_ip": "192.168.1.95", "responder_ip": "8.39.36.143", "initiator_port": 49628, "responder_port": 443, "initiator_bytes": 2992, "last_seen_epoch": "1533964990.308169", "responder_bytes": 6064, "first_seen_epoch": "1533964910.202514" }, { "bytes": 6607, "stream": 473, "flow_id": "flow-3ffa65160a98f97c1d427f75", "packets": 23, "transport": "tcp", "last_frame": 22673, "first_frame": 16604, "initiator_ip": "192.168.1.95", "responder_ip": "8.39.36.143", "initiator_port": 49629, "responder_port": 443, "initiator_bytes": 1989, "last_seen_epoch": "1533964990.308017", "responder_bytes": 4618, "first_seen_epoch": "1533964910.202598" }, { "bytes": 6783, "stream": 474, "flow_id": "flow-dd5972b5589cb29f09f8b592", "packets": 23, "transport": "tcp", "last_frame": 22674, "first_frame": 16605, "initiator_ip": "192.168.1.95", "responder_ip": "8.39.36.143", "initiator_port": 49631, "responder_port": 443, "initiator_bytes": 2005, "last_seen_epoch": "1533964990.308168", "responder_bytes": 4778, "first_seen_epoch": "1533964910.202777" }, { "bytes": 6445, "stream": 475, "flow_id": "flow-fc09ba8b3e4e0900cf1b3540", "packets": 21, "transport": "tcp", "last_frame": 22662, "first_frame": 16606, "initiator_ip": "192.168.1.95", "responder_ip": "8.39.36.143", "initiator_port": 49630, "responder_port": 443, "initiator_bytes": 1945, "last_seen_epoch": "1533964990.30698", "responder_bytes": 4500, "first_seen_epoch": "1533964910.202779" }, { "bytes": 6605, "stream": 476, "flow_id": "flow-59a4f2996f16306b4a8b3c28", "packets": 21, "transport": "tcp", "last_frame": 22671, "first_frame": 16607, "initiator_ip": "192.168.1.95", "responder_ip": "8.39.36.143", "initiator_port": 49632, "responder_port": 443, "initiator_bytes": 1961, "last_seen_epoch": "1533964990.308016", "responder_bytes": 4644, "first_seen_epoch": "1533964910.203011" }, { "bytes": 3912, "stream": 477, "flow_id": "flow-3e3c80f3d3e8d40490c363db", "packets": 22, "transport": "tcp", "last_frame": 19644, "first_frame": 16701, "initiator_ip": "192.168.1.95", "responder_ip": "74.6.34.27", "initiator_port": 49633, "responder_port": 443, "initiator_bytes": 1429, "last_seen_epoch": "1533964962.765992", "responder_bytes": 2483, "first_seen_epoch": "1533964910.338927" }, { "bytes": 7244, "stream": 478, "flow_id": "flow-41e6f3ce33ca9ae0707223a6", "packets": 22, "transport": "tcp", "last_frame": 22203, "first_frame": 16702, "initiator_ip": "192.168.1.95", "responder_ip": "74.6.34.27", "initiator_port": 49634, "responder_port": 443, "initiator_bytes": 1504, "last_seen_epoch": "1533964990.247162", "responder_bytes": 5740, "first_seen_epoch": "1533964910.338993" }, { "bytes": 7776, "stream": 479, "flow_id": "flow-306f34a08e01c61f21861d52", "packets": 26, "transport": "tcp", "last_frame": 22195, "first_frame": 16705, "initiator_ip": "192.168.1.95", "responder_ip": "98.136.101.121", "initiator_port": 49635, "responder_port": 443, "initiator_bytes": 1606, "last_seen_epoch": "1533964990.246332", "responder_bytes": 6170, "first_seen_epoch": "1533964910.342989" }, { "bytes": 5045, "stream": 480, "flow_id": "flow-ed426a68794af2408c6d0ec6", "packets": 19, "transport": "tcp", "last_frame": 22730, "first_frame": 16706, "initiator_ip": "192.168.1.95", "responder_ip": "98.136.101.121", "initiator_port": 49636, "responder_port": 443, "initiator_bytes": 947, "last_seen_epoch": "1533964990.34597", "responder_bytes": 4098, "first_seen_epoch": "1533964910.343075" }, { "bytes": 229, "stream": 176, "flow_id": "flow-e0c19f57118c352b520d5e55", "packets": 2, "transport": "udp", "last_frame": 16722, "first_frame": 16707, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 63097, "responder_port": 53, "initiator_bytes": 80, "last_seen_epoch": "1533964910.397514", "responder_bytes": 149, "first_seen_epoch": "1533964910.343517" }, { "bytes": 15290, "stream": 481, "flow_id": "flow-663abd154f1b3a2f3c94a522", "packets": 32, "transport": "tcp", "last_frame": 29468, "first_frame": 16723, "initiator_ip": "192.168.1.95", "responder_ip": "104.36.113.24", "initiator_port": 49637, "responder_port": 443, "initiator_bytes": 7523, "last_seen_epoch": "1533965095.515564", "responder_bytes": 7767, "first_seen_epoch": "1533964910.399277" }, { "bytes": 8360, "stream": 482, "flow_id": "flow-ccfb81b0e08afc9e7e20eef3", "packets": 19, "transport": "tcp", "last_frame": 22696, "first_frame": 16724, "initiator_ip": "192.168.1.95", "responder_ip": "104.36.113.24", "initiator_port": 49638, "responder_port": 443, "initiator_bytes": 2281, "last_seen_epoch": "1533964990.315654", "responder_bytes": 6079, "first_seen_epoch": "1533964910.399296" }, { "bytes": 7412, "stream": 483, "flow_id": "flow-9871b544607aca3baa84b345", "packets": 22, "transport": "tcp", "last_frame": 22189, "first_frame": 16829, "initiator_ip": "192.168.1.95", "responder_ip": "67.195.229.45", "initiator_port": 49639, "responder_port": 443, "initiator_bytes": 1490, "last_seen_epoch": "1533964990.245565", "responder_bytes": 5922, "first_seen_epoch": "1533964910.714736" }, { "bytes": 4933, "stream": 484, "flow_id": "flow-48fc8de641c46cd7773bf6ce", "packets": 17, "transport": "tcp", "last_frame": 22718, "first_frame": 16830, "initiator_ip": "192.168.1.95", "responder_ip": "67.195.229.45", "initiator_port": 49640, "responder_port": 443, "initiator_bytes": 835, "last_seen_epoch": "1533964990.344632", "responder_bytes": 4098, "first_seen_epoch": "1533964910.715074" }, { "bytes": 224, "stream": 177, "flow_id": "flow-52112d8add57210366b68eb6", "packets": 2, "transport": "udp", "last_frame": 16951, "first_frame": 16943, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 64276, "responder_port": 53, "initiator_bytes": 85, "last_seen_epoch": "1533964912.917076", "responder_bytes": 139, "first_seen_epoch": "1533964912.828553" }, { "bytes": 7910, "stream": 485, "flow_id": "flow-797f93c984c0644693b3b62d", "packets": 27, "transport": "tcp", "last_frame": 25287, "first_frame": 16952, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.192.2", "initiator_port": 49641, "responder_port": 443, "initiator_bytes": 2704, "last_seen_epoch": "1533965023.575181", "responder_bytes": 5206, "first_seen_epoch": "1533964912.917924" }, { "bytes": 8025, "stream": 486, "flow_id": "flow-df5a9afb10b0c3d9cbf1a171", "packets": 29, "transport": "tcp", "last_frame": 25288, "first_frame": 16953, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.192.2", "initiator_port": 49642, "responder_port": 443, "initiator_bytes": 2764, "last_seen_epoch": "1533965023.575182", "responder_bytes": 5261, "first_seen_epoch": "1533964912.917925" }, { "bytes": 7940, "stream": 487, "flow_id": "flow-34c39b5553cfb378c8b03311", "packets": 28, "transport": "tcp", "last_frame": 22528, "first_frame": 17154, "initiator_ip": "192.168.1.95", "responder_ip": "54.176.157.57", "initiator_port": 49643, "responder_port": 443, "initiator_bytes": 4278, "last_seen_epoch": "1533964990.278886", "responder_bytes": 3662, "first_seen_epoch": "1533964954.820195" }, { "bytes": 2776, "stream": 488, "flow_id": "flow-b1ebe1067dc6dcccedd773fe", "packets": 20, "transport": "tcp", "last_frame": 22533, "first_frame": 17156, "initiator_ip": "192.168.1.95", "responder_ip": "54.176.157.57", "initiator_port": 49644, "responder_port": 443, "initiator_bytes": 1587, "last_seen_epoch": "1533964990.279388", "responder_bytes": 1189, "first_seen_epoch": "1533964954.820196" }, { "bytes": 2964, "stream": 489, "flow_id": "flow-1d9d666c91485fdfb024c9aa", "packets": 18, "transport": "tcp", "last_frame": 17210, "first_frame": 17157, "initiator_ip": "192.168.1.95", "responder_ip": "64.41.197.55", "initiator_port": 49646, "responder_port": 443, "initiator_bytes": 1658, "last_seen_epoch": "1533964955.175937", "responder_bytes": 1306, "first_seen_epoch": "1533964954.823058" }, { "bytes": 2948, "stream": 490, "flow_id": "flow-0215b25c934b840874a06ff9", "packets": 18, "transport": "tcp", "last_frame": 17219, "first_frame": 17158, "initiator_ip": "192.168.1.95", "responder_ip": "64.41.197.55", "initiator_port": 49645, "responder_port": 443, "initiator_bytes": 1642, "last_seen_epoch": "1533964955.188066", "responder_bytes": 1306, "first_seen_epoch": "1533964954.823135" }, { "bytes": 251, "stream": 178, "flow_id": "flow-8875401e525483db10a34d74", "packets": 2, "transport": "udp", "last_frame": 17309, "first_frame": 17308, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 54690, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1533964955.900897", "responder_bytes": 175, "first_seen_epoch": "1533964955.786374" }, { "bytes": 11535, "stream": 491, "flow_id": "flow-c4c703568bf5a6e011631e3a", "packets": 26, "transport": "tcp", "last_frame": 22186, "first_frame": 17310, "initiator_ip": "192.168.1.95", "responder_ip": "94.31.29.138", "initiator_port": 49647, "responder_port": 443, "initiator_bytes": 1573, "last_seen_epoch": "1533964990.245219", "responder_bytes": 9962, "first_seen_epoch": "1533964955.901813" }, { "bytes": 63006, "stream": 492, "flow_id": "flow-f7d0bf663492e54e04060c2f", "packets": 56, "transport": "tcp", "last_frame": 22181, "first_frame": 17311, "initiator_ip": "192.168.1.95", "responder_ip": "94.31.29.138", "initiator_port": 49648, "responder_port": 443, "initiator_bytes": 2173, "last_seen_epoch": "1533964990.244725", "responder_bytes": 60833, "first_seen_epoch": "1533964955.901814" }, { "bytes": 388, "stream": 179, "flow_id": "flow-c04ccf4792787e6b57ebf060", "packets": 2, "transport": "udp", "last_frame": 17349, "first_frame": 17346, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 62175, "responder_port": 53, "initiator_bytes": 90, "last_seen_epoch": "1533964956.315471", "responder_bytes": 298, "first_seen_epoch": "1533964956.246434" }, { "bytes": 13713, "stream": 493, "flow_id": "flow-824d40dfcd351355988f29b4", "packets": 35, "transport": "tcp", "last_frame": 29223, "first_frame": 17350, "initiator_ip": "192.168.1.95", "responder_ip": "35.171.141.177", "initiator_port": 49649, "responder_port": 443, "initiator_bytes": 1875, "last_seen_epoch": "1533965095.241307", "responder_bytes": 11838, "first_seen_epoch": "1533964956.316181" }, { "bytes": 5253, "stream": 494, "flow_id": "flow-2d96156f0000e811ceaaa05e", "packets": 22, "transport": "tcp", "last_frame": 29226, "first_frame": 17351, "initiator_ip": "192.168.1.95", "responder_ip": "35.171.141.177", "initiator_port": 49650, "responder_port": 443, "initiator_bytes": 1052, "last_seen_epoch": "1533965095.241693", "responder_bytes": 4201, "first_seen_epoch": "1533964956.316246" }, { "bytes": 177353, "stream": 495, "flow_id": "flow-af77ddcd4bbe159b8ded3ce8", "packets": 166, "transport": "tcp", "last_frame": 29504, "first_frame": 17396, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.192.10", "initiator_port": 49651, "responder_port": 443, "initiator_bytes": 5188, "last_seen_epoch": "1533965095.518441", "responder_bytes": 172165, "first_seen_epoch": "1533964956.457823" }, { "bytes": 44997, "stream": 496, "flow_id": "flow-7f1f089e0e7e5f22d05c755b", "packets": 55, "transport": "tcp", "last_frame": 29509, "first_frame": 17399, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.192.6", "initiator_port": 49652, "responder_port": 443, "initiator_bytes": 2317, "last_seen_epoch": "1533965095.518703", "responder_bytes": 42680, "first_seen_epoch": "1533964956.461723" }, { "bytes": 24318, "stream": 497, "flow_id": "flow-df03970fc60750607ef2ed25", "packets": 88, "transport": "tcp", "last_frame": 39446, "first_frame": 17400, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.194.162", "initiator_port": 49653, "responder_port": 443, "initiator_bytes": 8564, "last_seen_epoch": "1533965249.306162", "responder_bytes": 15754, "first_seen_epoch": "1533964956.468327" }, { "bytes": 466, "stream": 180, "flow_id": "flow-22ae0121bd974ed4737f0022", "packets": 4, "transport": "udp", "last_frame": 20228, "first_frame": 17429, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 55133, "responder_port": 53, "initiator_bytes": 153, "last_seen_epoch": "1533964965.012614", "responder_bytes": 313, "first_seen_epoch": "1533964956.524984" }, { "bytes": 6956, "stream": 498, "flow_id": "flow-a88473b1fe02b03baf7fa225", "packets": 20, "transport": "tcp", "last_frame": 22177, "first_frame": 17694, "initiator_ip": "192.168.1.95", "responder_ip": "52.27.237.90", "initiator_port": 49654, "responder_port": 443, "initiator_bytes": 984, "last_seen_epoch": "1533964990.244265", "responder_bytes": 5972, "first_seen_epoch": "1533964957.012056" }, { "bytes": 7968, "stream": 499, "flow_id": "flow-54c07e91b854df0fc0f07a06", "packets": 25, "transport": "tcp", "last_frame": 22173, "first_frame": 17695, "initiator_ip": "192.168.1.95", "responder_ip": "52.27.237.90", "initiator_port": 49655, "responder_port": 443, "initiator_bytes": 1583, "last_seen_epoch": "1533964990.24369", "responder_bytes": 6385, "first_seen_epoch": "1533964957.012059" }, { "bytes": 286, "stream": 181, "flow_id": "flow-ea3ebf6f749d500368065771", "packets": 2, "transport": "udp", "last_frame": 17890, "first_frame": 17792, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 56338, "responder_port": 53, "initiator_bytes": 79, "last_seen_epoch": "1533964957.470463", "responder_bytes": 207, "first_seen_epoch": "1533964957.237351" }, { "bytes": 360, "stream": 182, "flow_id": "flow-2961dee8fefc929160a77959", "packets": 2, "transport": "udp", "last_frame": 17855, "first_frame": 17854, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 55099, "responder_port": 53, "initiator_bytes": 87, "last_seen_epoch": "1533964957.358759", "responder_bytes": 273, "first_seen_epoch": "1533964957.358429" }, { "bytes": 20810, "stream": 500, "flow_id": "flow-10ba810b3b9caa18042084b6", "packets": 59, "transport": "tcp", "last_frame": 29365, "first_frame": 17856, "initiator_ip": "192.168.1.95", "responder_ip": "52.44.165.199", "initiator_port": 49656, "responder_port": 443, "initiator_bytes": 7319, "last_seen_epoch": "1533965095.303499", "responder_bytes": 13491, "first_seen_epoch": "1533964957.359399" }, { "bytes": 31454, "stream": 501, "flow_id": "flow-738fd17247b32e32895222c1", "packets": 59, "transport": "tcp", "last_frame": 29362, "first_frame": 17857, "initiator_ip": "192.168.1.95", "responder_ip": "52.44.165.199", "initiator_port": 49657, "responder_port": 443, "initiator_bytes": 7247, "last_seen_epoch": "1533965095.303013", "responder_bytes": 24207, "first_seen_epoch": "1533964957.359542" }, { "bytes": 32784, "stream": 502, "flow_id": "flow-9b4cc1d4d828bc36895a879c", "packets": 60, "transport": "tcp", "last_frame": 39443, "first_frame": 17898, "initiator_ip": "192.168.1.95", "responder_ip": "35.164.52.21", "initiator_port": 49658, "responder_port": 443, "initiator_bytes": 9853, "last_seen_epoch": "1533965249.305775", "responder_bytes": 22931, "first_seen_epoch": "1533964957.475692" }, { "bytes": 29314, "stream": 503, "flow_id": "flow-b40081393226f07e5f08a2b1", "packets": 51, "transport": "tcp", "last_frame": 39441, "first_frame": 17899, "initiator_ip": "192.168.1.95", "responder_ip": "35.164.52.21", "initiator_port": 49659, "responder_port": 443, "initiator_bytes": 8594, "last_seen_epoch": "1533965249.305578", "responder_bytes": 20720, "first_seen_epoch": "1533964957.477744" }, { "bytes": 210, "stream": 183, "flow_id": "flow-bf063c6608a08d2cd031c4a3", "packets": 2, "transport": "udp", "last_frame": 18111, "first_frame": 18026, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 52348, "responder_port": 53, "initiator_bytes": 84, "last_seen_epoch": "1533964958.070258", "responder_bytes": 126, "first_seen_epoch": "1533964957.807117" }, { "bytes": 52794, "stream": 504, "flow_id": "flow-fb46819453f54af467953f85", "packets": 98, "transport": "tcp", "last_frame": 39442, "first_frame": 18124, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.192.2", "initiator_port": 49660, "responder_port": 443, "initiator_bytes": 25586, "last_seen_epoch": "1533965249.305683", "responder_bytes": 27208, "first_seen_epoch": "1533964958.076971" }, { "bytes": 52943, "stream": 505, "flow_id": "flow-3a15160c91a6e2eded84e34c", "packets": 97, "transport": "tcp", "last_frame": 39439, "first_frame": 18125, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.192.2", "initiator_port": 49661, "responder_port": 443, "initiator_bytes": 25595, "last_seen_epoch": "1533965249.305469", "responder_bytes": 27348, "first_seen_epoch": "1533964958.077069" }, { "bytes": 329, "stream": 184, "flow_id": "flow-47e0ee8790d27445f270ba74", "packets": 2, "transport": "udp", "last_frame": 18186, "first_frame": 18164, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 54018, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1533964958.450245", "responder_bytes": 253, "first_seen_epoch": "1533964958.349333" }, { "bytes": 192, "stream": 185, "flow_id": "flow-71d4c0f12e2af889fa761edb", "packets": 2, "transport": "udp", "last_frame": 18200, "first_frame": 18167, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 50522, "responder_port": 53, "initiator_bytes": 80, "last_seen_epoch": "1533964958.477773", "responder_bytes": 112, "first_seen_epoch": "1533964958.352142" }, { "bytes": 158, "stream": 186, "flow_id": "flow-09666605de41aa61467cdf82", "packets": 2, "transport": "udp", "last_frame": 18183, "first_frame": 18168, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 54759, "responder_port": 53, "initiator_bytes": 71, "last_seen_epoch": "1533964958.434721", "responder_bytes": 87, "first_seen_epoch": "1533964958.35291" }, { "bytes": 168, "stream": 187, "flow_id": "flow-39dbb2c871f47c97a4afc8c7", "packets": 2, "transport": "udp", "last_frame": 18189, "first_frame": 18169, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 55876, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1533964958.450799", "responder_bytes": 92, "first_seen_epoch": "1533964958.353897" }, { "bytes": 289, "stream": 188, "flow_id": "flow-b755cdd93c7314c5497bd323", "packets": 2, "transport": "udp", "last_frame": 18210, "first_frame": 18172, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 65054, "responder_port": 53, "initiator_bytes": 92, "last_seen_epoch": "1533964958.485955", "responder_bytes": 197, "first_seen_epoch": "1533964958.356489" }, { "bytes": 13370, "stream": 506, "flow_id": "flow-67b8a96539160e0b0b5e57a7", "packets": 37, "transport": "tcp", "last_frame": 29510, "first_frame": 18184, "initiator_ip": "192.168.1.95", "responder_ip": "8.41.222.241", "initiator_port": 49662, "responder_port": 443, "initiator_bytes": 4280, "last_seen_epoch": "1533965095.518857", "responder_bytes": 9090, "first_seen_epoch": "1533964958.435561" }, { "bytes": 13514, "stream": 507, "flow_id": "flow-709c84ccd07b690f87635f70", "packets": 37, "transport": "tcp", "last_frame": 29519, "first_frame": 18185, "initiator_ip": "192.168.1.95", "responder_ip": "8.41.222.241", "initiator_port": 49663, "responder_port": 443, "initiator_bytes": 4152, "last_seen_epoch": "1533965095.519501", "responder_bytes": 9362, "first_seen_epoch": "1533964958.435563" }, { "bytes": 9081, "stream": 508, "flow_id": "flow-ea9f97e54aab157674c00395", "packets": 25, "transport": "tcp", "last_frame": 18495, "first_frame": 18190, "initiator_ip": "192.168.1.95", "responder_ip": "207.244.102.143", "initiator_port": 49664, "responder_port": 443, "initiator_bytes": 1657, "last_seen_epoch": "1533964959.115188", "responder_bytes": 7424, "first_seen_epoch": "1533964958.451691" }, { "bytes": 7695, "stream": 509, "flow_id": "flow-b03380bed1c6177abc28281e", "packets": 24, "transport": "tcp", "last_frame": 22160, "first_frame": 18191, "initiator_ip": "192.168.1.95", "responder_ip": "207.244.102.143", "initiator_port": 49665, "responder_port": 443, "initiator_bytes": 1082, "last_seen_epoch": "1533964990.242299", "responder_bytes": 6613, "first_seen_epoch": "1533964958.452056" }, { "bytes": 10977, "stream": 510, "flow_id": "flow-fe682a284e43768933f7d74d", "packets": 28, "transport": "tcp", "last_frame": 22163, "first_frame": 18192, "initiator_ip": "192.168.1.95", "responder_ip": "104.254.150.69", "initiator_port": 49666, "responder_port": 443, "initiator_bytes": 3015, "last_seen_epoch": "1533964990.24277", "responder_bytes": 7962, "first_seen_epoch": "1533964958.453469" }, { "bytes": 7427, "stream": 511, "flow_id": "flow-95c25c118535b6ee75ac0410", "packets": 22, "transport": "tcp", "last_frame": 22168, "first_frame": 18193, "initiator_ip": "192.168.1.95", "responder_ip": "104.254.150.69", "initiator_port": 49667, "responder_port": 443, "initiator_bytes": 1809, "last_seen_epoch": "1533964990.243236", "responder_bytes": 5618, "first_seen_epoch": "1533964958.453693" }, { "bytes": 8718, "stream": 512, "flow_id": "flow-36667fb5bfe15fe0f96927cd", "packets": 26, "transport": "tcp", "last_frame": 29209, "first_frame": 18203, "initiator_ip": "192.168.1.95", "responder_ip": "52.26.87.58", "initiator_port": 49668, "responder_port": 443, "initiator_bytes": 2088, "last_seen_epoch": "1533965095.239582", "responder_bytes": 6630, "first_seen_epoch": "1533964958.478682" }, { "bytes": 7896, "stream": 513, "flow_id": "flow-72e7fef9447a72b3f34b529c", "packets": 24, "transport": "tcp", "last_frame": 26280, "first_frame": 18204, "initiator_ip": "192.168.1.95", "responder_ip": "52.26.87.58", "initiator_port": 49669, "responder_port": 443, "initiator_bytes": 1565, "last_seen_epoch": "1533965032.299251", "responder_bytes": 6331, "first_seen_epoch": "1533964958.478684" }, { "bytes": 19474, "stream": 514, "flow_id": "flow-008fabdaf1e370ac20345726", "packets": 51, "transport": "tcp", "last_frame": 29363, "first_frame": 18209, "initiator_ip": "192.168.1.95", "responder_ip": "52.44.165.199", "initiator_port": 49670, "responder_port": 443, "initiator_bytes": 5918, "last_seen_epoch": "1533965095.303119", "responder_bytes": 13556, "first_seen_epoch": "1533964958.482845" }, { "bytes": 4426, "stream": 515, "flow_id": "flow-1dd80578dd2f909e54c3d257", "packets": 16, "transport": "tcp", "last_frame": 22156, "first_frame": 18211, "initiator_ip": "192.168.1.95", "responder_ip": "23.220.187.187", "initiator_port": 49671, "responder_port": 443, "initiator_bytes": 874, "last_seen_epoch": "1533964990.242032", "responder_bytes": 3552, "first_seen_epoch": "1533964958.487282" }, { "bytes": 9496, "stream": 516, "flow_id": "flow-2ba8aab4a34dec37787b9f7c", "packets": 26, "transport": "tcp", "last_frame": 29435, "first_frame": 18212, "initiator_ip": "192.168.1.95", "responder_ip": "23.220.187.187", "initiator_port": 49672, "responder_port": 443, "initiator_bytes": 2089, "last_seen_epoch": "1533965095.513028", "responder_bytes": 7407, "first_seen_epoch": "1533964958.487678" }, { "bytes": 233, "stream": 189, "flow_id": "flow-72ede3acdb8367e3b78a342b", "packets": 2, "transport": "udp", "last_frame": 18270, "first_frame": 18233, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 53354, "responder_port": 53, "initiator_bytes": 81, "last_seen_epoch": "1533964958.600112", "responder_bytes": 152, "first_seen_epoch": "1533964958.535877" }, { "bytes": 115664, "stream": 517, "flow_id": "flow-9a920b8b227d8ceec709b0a3", "packets": 131, "transport": "tcp", "last_frame": 22151, "first_frame": 18286, "initiator_ip": "192.168.1.95", "responder_ip": "94.31.29.250", "initiator_port": 49673, "responder_port": 443, "initiator_bytes": 4578, "last_seen_epoch": "1533964990.241423", "responder_bytes": 111086, "first_seen_epoch": "1533964958.606113" }, { "bytes": 6940, "stream": 518, "flow_id": "flow-752ce9364e10777f0394410d", "packets": 22, "transport": "tcp", "last_frame": 29194, "first_frame": 18287, "initiator_ip": "192.168.1.95", "responder_ip": "94.31.29.250", "initiator_port": 49674, "responder_port": 443, "initiator_bytes": 1043, "last_seen_epoch": "1533965095.238452", "responder_bytes": 5897, "first_seen_epoch": "1533964958.612058" }, { "bytes": 314, "stream": 190, "flow_id": "flow-87f17b4e90cfeb2683ae98cb", "packets": 2, "transport": "udp", "last_frame": 18568, "first_frame": 18440, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 52730, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1533964959.365164", "responder_bytes": 238, "first_seen_epoch": "1533964959.043665" }, { "bytes": 2328, "stream": 519, "flow_id": "flow-0d83ec1e03510d416546bc35", "packets": 20, "transport": "tcp", "last_frame": 23259, "first_frame": 18452, "initiator_ip": "192.168.1.95", "responder_ip": "185.167.164.37", "initiator_port": 49675, "responder_port": 443, "initiator_bytes": 1347, "last_seen_epoch": "1533964997.191262", "responder_bytes": 981, "first_seen_epoch": "1533964959.046405" }, { "bytes": 3418, "stream": 520, "flow_id": "flow-f84140dfe1350bfcb0f2ee9a", "packets": 23, "transport": "tcp", "last_frame": 23255, "first_frame": 18453, "initiator_ip": "192.168.1.95", "responder_ip": "185.167.164.37", "initiator_port": 49676, "responder_port": 443, "initiator_bytes": 1870, "last_seen_epoch": "1533964997.190848", "responder_bytes": 1548, "first_seen_epoch": "1533964959.046621" }, { "bytes": 5340, "stream": 521, "flow_id": "flow-3ff9a77c22f3728ae5f13b75", "packets": 18, "transport": "tcp", "last_frame": 18835, "first_frame": 18456, "initiator_ip": "192.168.1.95", "responder_ip": "69.174.248.228", "initiator_port": 49677, "responder_port": 443, "initiator_bytes": 1345, "last_seen_epoch": "1533964960.13176", "responder_bytes": 3995, "first_seen_epoch": "1533964959.048005" }, { "bytes": 4925, "stream": 522, "flow_id": "flow-7f5a7dcdf80bcee29bbd63bc", "packets": 18, "transport": "tcp", "last_frame": 22142, "first_frame": 18457, "initiator_ip": "192.168.1.95", "responder_ip": "69.174.248.228", "initiator_port": 49678, "responder_port": 443, "initiator_bytes": 942, "last_seen_epoch": "1533964990.240547", "responder_bytes": 3983, "first_seen_epoch": "1533964959.048007" }, { "bytes": 264, "stream": 191, "flow_id": "flow-7179afead58d2121f9c0aaa6", "packets": 2, "transport": "udp", "last_frame": 18574, "first_frame": 18461, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 64499, "responder_port": 53, "initiator_bytes": 80, "last_seen_epoch": "1533964959.368247", "responder_bytes": 184, "first_seen_epoch": "1533964959.050612" }, { "bytes": 238, "stream": 192, "flow_id": "flow-a077be871e81722b05fa5cb1", "packets": 2, "transport": "udp", "last_frame": 18626, "first_frame": 18474, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 59433, "responder_port": 53, "initiator_bytes": 83, "last_seen_epoch": "1533964959.502753", "responder_bytes": 155, "first_seen_epoch": "1533964959.055539" }, { "bytes": 449, "stream": 193, "flow_id": "flow-a07c254aac2a784fae90154e", "packets": 4, "transport": "udp", "last_frame": 44698, "first_frame": 18475, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 60504, "responder_port": 53, "initiator_bytes": 151, "last_seen_epoch": "1533965786.043507", "responder_bytes": 298, "first_seen_epoch": "1533964959.057459" }, { "bytes": 6002, "stream": 523, "flow_id": "flow-9b4cda93dc4feb6b62c024b2", "packets": 25, "transport": "tcp", "last_frame": 21943, "first_frame": 18513, "initiator_ip": "192.168.1.95", "responder_ip": "104.254.150.77", "initiator_port": 49679, "responder_port": 443, "initiator_bytes": 2327, "last_seen_epoch": "1533964979.964225", "responder_bytes": 3675, "first_seen_epoch": "1533964959.154196" }, { "bytes": 7219, "stream": 524, "flow_id": "flow-df7838e69b0b46416d3db8f2", "packets": 26, "transport": "tcp", "last_frame": 21946, "first_frame": 18514, "initiator_ip": "192.168.1.95", "responder_ip": "104.254.150.77", "initiator_port": 49680, "responder_port": 443, "initiator_bytes": 3175, "last_seen_epoch": "1533964979.96468", "responder_bytes": 4044, "first_seen_epoch": "1533964959.154398" }, { "bytes": 13041, "stream": 525, "flow_id": "flow-d561809748d112f133a372dc", "packets": 33, "transport": "tcp", "last_frame": 22145, "first_frame": 18569, "initiator_ip": "192.168.1.95", "responder_ip": "34.207.5.71", "initiator_port": 49681, "responder_port": 443, "initiator_bytes": 3495, "last_seen_epoch": "1533964990.240993", "responder_bytes": 9546, "first_seen_epoch": "1533964959.366109" }, { "bytes": 8954, "stream": 526, "flow_id": "flow-c0fec5d100659dbb541c16e6", "packets": 20, "transport": "tcp", "last_frame": 20195, "first_frame": 18570, "initiator_ip": "192.168.1.95", "responder_ip": "34.207.5.71", "initiator_port": 49682, "responder_port": 443, "initiator_bytes": 1641, "last_seen_epoch": "1533964964.922194", "responder_bytes": 7313, "first_seen_epoch": "1533964959.366111" }, { "bytes": 8637, "stream": 527, "flow_id": "flow-87d606933776d9e9c83a0827", "packets": 23, "transport": "tcp", "last_frame": 29444, "first_frame": 18581, "initiator_ip": "192.168.1.95", "responder_ip": "151.101.2.49", "initiator_port": 49683, "responder_port": 443, "initiator_bytes": 1477, "last_seen_epoch": "1533965095.513525", "responder_bytes": 7160, "first_seen_epoch": "1533964959.371555" }, { "bytes": 7055, "stream": 528, "flow_id": "flow-c8abd1a90593f7562459fe81", "packets": 19, "transport": "tcp", "last_frame": 29433, "first_frame": 18585, "initiator_ip": "192.168.1.95", "responder_ip": "151.101.2.49", "initiator_port": 49684, "responder_port": 443, "initiator_bytes": 922, "last_seen_epoch": "1533965095.512874", "responder_bytes": 6133, "first_seen_epoch": "1533964959.372" }, { "bytes": 6410, "stream": 529, "flow_id": "flow-644a9684bd6878f8c894990d", "packets": 20, "transport": "tcp", "last_frame": 22138, "first_frame": 18641, "initiator_ip": "192.168.1.95", "responder_ip": "204.2.197.201", "initiator_port": 49685, "responder_port": 443, "initiator_bytes": 909, "last_seen_epoch": "1533964990.24012", "responder_bytes": 5501, "first_seen_epoch": "1533964959.509316" }, { "bytes": 7684, "stream": 530, "flow_id": "flow-b75dcd315a4f3c7485e9f850", "packets": 21, "transport": "tcp", "last_frame": 19039, "first_frame": 18642, "initiator_ip": "192.168.1.95", "responder_ip": "204.2.197.201", "initiator_port": 49686, "responder_port": 443, "initiator_bytes": 1308, "last_seen_epoch": "1533964960.50481", "responder_bytes": 6376, "first_seen_epoch": "1533964959.50944" }, { "bytes": 8075, "stream": 531, "flow_id": "flow-810a84693e2abb9a492876b6", "packets": 23, "transport": "tcp", "last_frame": 29432, "first_frame": 18643, "initiator_ip": "192.168.1.95", "responder_ip": "204.11.109.68", "initiator_port": 49687, "responder_port": 443, "initiator_bytes": 1775, "last_seen_epoch": "1533965095.512757", "responder_bytes": 6300, "first_seen_epoch": "1533964959.509834" }, { "bytes": 8123, "stream": 532, "flow_id": "flow-8b2906a1397e9be18745cac6", "packets": 23, "transport": "tcp", "last_frame": 29461, "first_frame": 18644, "initiator_ip": "192.168.1.95", "responder_ip": "204.11.109.68", "initiator_port": 49688, "responder_port": 443, "initiator_bytes": 1839, "last_seen_epoch": "1533965095.515199", "responder_bytes": 6284, "first_seen_epoch": "1533964959.509835" }, { "bytes": 223, "stream": 194, "flow_id": "flow-3205f53b2d462e53a2498a7a", "packets": 2, "transport": "udp", "last_frame": 18742, "first_frame": 18662, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 58483, "responder_port": 53, "initiator_bytes": 78, "last_seen_epoch": "1533964959.980701", "responder_bytes": 145, "first_seen_epoch": "1533964959.545185" }, { "bytes": 6098, "stream": 533, "flow_id": "flow-8dbc0e1df5e36a305923c741", "packets": 24, "transport": "tcp", "last_frame": 21938, "first_frame": 18663, "initiator_ip": "192.168.1.95", "responder_ip": "104.254.150.77", "initiator_port": 49689, "responder_port": 443, "initiator_bytes": 2926, "last_seen_epoch": "1533964979.96345", "responder_bytes": 3172, "first_seen_epoch": "1533964959.600131" }, { "bytes": 6097, "stream": 534, "flow_id": "flow-479a74aeee2e436c620a8718", "packets": 24, "transport": "tcp", "last_frame": 21935, "first_frame": 18664, "initiator_ip": "192.168.1.95", "responder_ip": "104.254.150.77", "initiator_port": 49690, "responder_port": 443, "initiator_bytes": 2927, "last_seen_epoch": "1533964979.961852", "responder_bytes": 3170, "first_seen_epoch": "1533964959.601338" }, { "bytes": 235, "stream": 195, "flow_id": "flow-732622ff70d5e7a16a25f58e", "packets": 2, "transport": "udp", "last_frame": 18760, "first_frame": 18665, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 54211, "responder_port": 53, "initiator_bytes": 73, "last_seen_epoch": "1533964960.021343", "responder_bytes": 162, "first_seen_epoch": "1533964959.603319" }, { "bytes": 273, "stream": 196, "flow_id": "flow-4d565c3bc905746454561b6c", "packets": 2, "transport": "udp", "last_frame": 18786, "first_frame": 18671, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 60199, "responder_port": 53, "initiator_bytes": 92, "last_seen_epoch": "1533964960.049215", "responder_bytes": 181, "first_seen_epoch": "1533964959.616289" }, { "bytes": 22494, "stream": 535, "flow_id": "flow-f2b6cf96cdac69b5ea921533", "packets": 41, "transport": "tcp", "last_frame": 29182, "first_frame": 18743, "initiator_ip": "192.168.1.95", "responder_ip": "216.115.100.123", "initiator_port": 49691, "responder_port": 443, "initiator_bytes": 2071, "last_seen_epoch": "1533965095.237232", "responder_bytes": 20423, "first_seen_epoch": "1533964959.981697" }, { "bytes": 4940, "stream": 536, "flow_id": "flow-0854bf843d63d5b8d63de2d2", "packets": 17, "transport": "tcp", "last_frame": 29431, "first_frame": 18744, "initiator_ip": "192.168.1.95", "responder_ip": "216.115.100.123", "initiator_port": 49692, "responder_port": 443, "initiator_bytes": 860, "last_seen_epoch": "1533965095.512755", "responder_bytes": 4080, "first_seen_epoch": "1533964959.981699" }, { "bytes": 14759, "stream": 537, "flow_id": "flow-76c4273c198aee974710459e", "packets": 37, "transport": "tcp", "last_frame": 26951, "first_frame": 18766, "initiator_ip": "192.168.1.95", "responder_ip": "185.167.164.39", "initiator_port": 49693, "responder_port": 443, "initiator_bytes": 4652, "last_seen_epoch": "1533965033.939435", "responder_bytes": 10107, "first_seen_epoch": "1533964960.024897" }, { "bytes": 22081, "stream": 538, "flow_id": "flow-f6ab5030ae3e88989bac7f57", "packets": 44, "transport": "tcp", "last_frame": 26955, "first_frame": 18768, "initiator_ip": "192.168.1.95", "responder_ip": "185.167.164.39", "initiator_port": 49694, "responder_port": 443, "initiator_bytes": 4371, "last_seen_epoch": "1533965033.940073", "responder_bytes": 17710, "first_seen_epoch": "1533964960.025129" }, { "bytes": 6489, "stream": 539, "flow_id": "flow-c537babe7e5cf5b65c2ab67f", "packets": 25, "transport": "tcp", "last_frame": 26600, "first_frame": 18790, "initiator_ip": "192.168.1.95", "responder_ip": "208.185.50.80", "initiator_port": 49695, "responder_port": 443, "initiator_bytes": 2297, "last_seen_epoch": "1533965032.993432", "responder_bytes": 4192, "first_seen_epoch": "1533964960.050067" }, { "bytes": 9573, "stream": 540, "flow_id": "flow-4ae0173a48f94d01d1bc330b", "packets": 32, "transport": "tcp", "last_frame": 29505, "first_frame": 18791, "initiator_ip": "192.168.1.95", "responder_ip": "208.185.50.80", "initiator_port": 49696, "responder_port": 443, "initiator_bytes": 4380, "last_seen_epoch": "1533965095.518533", "responder_bytes": 5193, "first_seen_epoch": "1533964960.050068" }, { "bytes": 5927, "stream": 541, "flow_id": "flow-44dc67ac4ad2e67e9d8634d0", "packets": 22, "transport": "tcp", "last_frame": 22130, "first_frame": 18853, "initiator_ip": "192.168.1.95", "responder_ip": "69.174.248.228", "initiator_port": 49697, "responder_port": 443, "initiator_bytes": 1520, "last_seen_epoch": "1533964990.239476", "responder_bytes": 4407, "first_seen_epoch": "1533964960.140933" }, { "bytes": 4920, "stream": 542, "flow_id": "flow-a8248810e395f16c3db48538", "packets": 18, "transport": "tcp", "last_frame": 22133, "first_frame": 18855, "initiator_ip": "192.168.1.95", "responder_ip": "69.174.248.228", "initiator_port": 49698, "responder_port": 443, "initiator_bytes": 937, "last_seen_epoch": "1533964990.239836", "responder_bytes": 3983, "first_seen_epoch": "1533964960.141323" }, { "bytes": 459, "stream": 197, "flow_id": "flow-207b521d92a8450752b5d16c", "packets": 2, "transport": "udp", "last_frame": 19066, "first_frame": 19011, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 52694, "responder_port": 53, "initiator_bytes": 86, "last_seen_epoch": "1533964960.516077", "responder_bytes": 373, "first_seen_epoch": "1533964960.452739" }, { "bytes": 4070, "stream": 543, "flow_id": "flow-5e17e5685dd42e53da32d2fd", "packets": 22, "transport": "tcp", "last_frame": 29333, "first_frame": 19035, "initiator_ip": "192.168.1.95", "responder_ip": "52.94.232.32", "initiator_port": 49699, "responder_port": 443, "initiator_bytes": 1926, "last_seen_epoch": "1533965095.25461", "responder_bytes": 2144, "first_seen_epoch": "1533964960.499881" }, { "bytes": 3910, "stream": 544, "flow_id": "flow-979edb2203cf837d11784706", "packets": 22, "transport": "tcp", "last_frame": 29336, "first_frame": 19036, "initiator_ip": "192.168.1.95", "responder_ip": "52.94.232.32", "initiator_port": 49700, "responder_port": 443, "initiator_bytes": 2038, "last_seen_epoch": "1533965095.254852", "responder_bytes": 1872, "first_seen_epoch": "1533964960.499912" }, { "bytes": 37696, "stream": 545, "flow_id": "flow-50b984ec9c42dddf3f30b7ee", "packets": 76, "transport": "tcp", "last_frame": 39447, "first_frame": 19067, "initiator_ip": "192.168.1.95", "responder_ip": "54.183.210.45", "initiator_port": 49701, "responder_port": 443, "initiator_bytes": 15757, "last_seen_epoch": "1533965249.306262", "responder_bytes": 21939, "first_seen_epoch": "1533964960.516781" }, { "bytes": 36222, "stream": 546, "flow_id": "flow-0e183f99cfec415495c63b6b", "packets": 75, "transport": "tcp", "last_frame": 39401, "first_frame": 19068, "initiator_ip": "192.168.1.95", "responder_ip": "54.183.210.45", "initiator_port": 49702, "responder_port": 443, "initiator_bytes": 14229, "last_seen_epoch": "1533965249.301046", "responder_bytes": 21993, "first_seen_epoch": "1533964960.516782" }, { "bytes": 233, "stream": 198, "flow_id": "flow-47c91c3c4d32719dd8d2ee0c", "packets": 2, "transport": "udp", "last_frame": 19168, "first_frame": 19141, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 53160, "responder_port": 53, "initiator_bytes": 73, "last_seen_epoch": "1533964960.86906", "responder_bytes": 160, "first_seen_epoch": "1533964960.729475" }, { "bytes": 62289, "stream": 547, "flow_id": "flow-74773552d1dded17c1c167a9", "packets": 80, "transport": "tcp", "last_frame": 29167, "first_frame": 19169, "initiator_ip": "192.168.1.95", "responder_ip": "185.167.166.41", "initiator_port": 49703, "responder_port": 443, "initiator_bytes": 3661, "last_seen_epoch": "1533965095.235893", "responder_bytes": 58628, "first_seen_epoch": "1533964960.870331" }, { "bytes": 44564, "stream": 548, "flow_id": "flow-a0c97c3c6ac2606e0dea1974", "packets": 54, "transport": "tcp", "last_frame": 29170, "first_frame": 19170, "initiator_ip": "192.168.1.95", "responder_ip": "185.167.166.41", "initiator_port": 49704, "responder_port": 443, "initiator_bytes": 2529, "last_seen_epoch": "1533965095.236203", "responder_bytes": 42035, "first_seen_epoch": "1533964960.870478" }, { "bytes": 292, "stream": 199, "flow_id": "flow-3de3ec79c912446df060450c", "packets": 2, "transport": "udp", "last_frame": 19231, "first_frame": 19230, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 55469, "responder_port": 53, "initiator_bytes": 82, "last_seen_epoch": "1533964961.387623", "responder_bytes": 210, "first_seen_epoch": "1533964961.289231" }, { "bytes": 10193, "stream": 549, "flow_id": "flow-3171310277ad60aad9e0a212", "packets": 31, "transport": "tcp", "last_frame": 22007, "first_frame": 19232, "initiator_ip": "192.168.1.95", "responder_ip": "34.213.12.32", "initiator_port": 49705, "responder_port": 443, "initiator_bytes": 3346, "last_seen_epoch": "1533964981.223418", "responder_bytes": 6847, "first_seen_epoch": "1533964961.388359" }, { "bytes": 225, "stream": 200, "flow_id": "flow-bfad14f2ba2dc63ed01851b0", "packets": 2, "transport": "udp", "last_frame": 19258, "first_frame": 19245, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 58479, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1533964961.633523", "responder_bytes": 153, "first_seen_epoch": "1533964961.545252" }, { "bytes": 5180, "stream": 550, "flow_id": "flow-51c4a9c5509553f560f1ddb0", "packets": 19, "transport": "tcp", "last_frame": 22127, "first_frame": 19260, "initiator_ip": "192.168.1.95", "responder_ip": "109.232.197.110", "initiator_port": 49706, "responder_port": 443, "initiator_bytes": 898, "last_seen_epoch": "1533964990.239339", "responder_bytes": 4282, "first_seen_epoch": "1533964961.641452" }, { "bytes": 7022, "stream": 551, "flow_id": "flow-3e3ec74b7def76714155e715", "packets": 17, "transport": "tcp", "last_frame": 19605, "first_frame": 19261, "initiator_ip": "192.168.1.95", "responder_ip": "109.232.197.110", "initiator_port": 49707, "responder_port": 443, "initiator_bytes": 1493, "last_seen_epoch": "1533964962.542898", "responder_bytes": 5529, "first_seen_epoch": "1533964961.641637" }, { "bytes": 206, "stream": 201, "flow_id": "flow-975ca5b91f185149f3866f44", "packets": 2, "transport": "udp", "last_frame": 19305, "first_frame": 19272, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 51059, "responder_port": 53, "initiator_bytes": 74, "last_seen_epoch": "1533964961.766961", "responder_bytes": 132, "first_seen_epoch": "1533964961.686987" }, { "bytes": 282, "stream": 202, "flow_id": "flow-74135846a84bdfad9916ec2d", "packets": 2, "transport": "udp", "last_frame": 19300, "first_frame": 19273, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 55753, "responder_port": 53, "initiator_bytes": 77, "last_seen_epoch": "1533964961.756585", "responder_bytes": 205, "first_seen_epoch": "1533964961.687478" }, { "bytes": 233, "stream": 203, "flow_id": "flow-9c0075e81584d816325292cc", "packets": 2, "transport": "udp", "last_frame": 19312, "first_frame": 19274, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 56945, "responder_port": 53, "initiator_bytes": 73, "last_seen_epoch": "1533964961.782585", "responder_bytes": 160, "first_seen_epoch": "1533964961.688095" }, { "bytes": 207, "stream": 204, "flow_id": "flow-4f9ce24c58831c4fbdf8430f", "packets": 2, "transport": "udp", "last_frame": 19335, "first_frame": 19275, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 56940, "responder_port": 53, "initiator_bytes": 78, "last_seen_epoch": "1533964961.815071", "responder_bytes": 129, "first_seen_epoch": "1533964961.689236" }, { "bytes": 7024, "stream": 552, "flow_id": "flow-23a0345bc49ea140daa16979", "packets": 23, "transport": "tcp", "last_frame": 22123, "first_frame": 19303, "initiator_ip": "192.168.1.95", "responder_ip": "104.254.150.77", "initiator_port": 49708, "responder_port": 443, "initiator_bytes": 3064, "last_seen_epoch": "1533964990.23895", "responder_bytes": 3960, "first_seen_epoch": "1533964961.757421" }, { "bytes": 7014, "stream": 553, "flow_id": "flow-3fbe4efbc7649e38b2bf2be2", "packets": 23, "transport": "tcp", "last_frame": 22120, "first_frame": 19304, "initiator_ip": "192.168.1.95", "responder_ip": "104.254.150.77", "initiator_port": 49709, "responder_port": 443, "initiator_bytes": 3167, "last_seen_epoch": "1533964990.238549", "responder_bytes": 3847, "first_seen_epoch": "1533964961.757423" }, { "bytes": 4923, "stream": 554, "flow_id": "flow-043582ec5cf47fa6ce8cbadf", "packets": 16, "transport": "tcp", "last_frame": 29436, "first_frame": 19306, "initiator_ip": "192.168.1.95", "responder_ip": "151.101.53.108", "initiator_port": 49711, "responder_port": 443, "initiator_bytes": 796, "last_seen_epoch": "1533965095.513276", "responder_bytes": 4127, "first_seen_epoch": "1533964961.767708" }, { "bytes": 24711, "stream": 555, "flow_id": "flow-54b76988ff6fd078f00b20d2", "packets": 41, "transport": "tcp", "last_frame": 29434, "first_frame": 19307, "initiator_ip": "192.168.1.95", "responder_ip": "151.101.53.108", "initiator_port": 49710, "responder_port": 443, "initiator_bytes": 2199, "last_seen_epoch": "1533965095.512876", "responder_bytes": 22512, "first_seen_epoch": "1533964961.76771" }, { "bytes": 5164, "stream": 556, "flow_id": "flow-f0a53baf0ea4131a69d21ce0", "packets": 20, "transport": "tcp", "last_frame": 22114, "first_frame": 19314, "initiator_ip": "192.168.1.95", "responder_ip": "23.54.20.214", "initiator_port": 49712, "responder_port": 443, "initiator_bytes": 915, "last_seen_epoch": "1533964990.238068", "responder_bytes": 4249, "first_seen_epoch": "1533964961.79301" }, { "bytes": 36732, "stream": 557, "flow_id": "flow-33268de330c908c7f29fdf39", "packets": 48, "transport": "tcp", "last_frame": 29411, "first_frame": 19315, "initiator_ip": "192.168.1.95", "responder_ip": "23.54.20.214", "initiator_port": 49713, "responder_port": 443, "initiator_bytes": 2362, "last_seen_epoch": "1533965095.511481", "responder_bytes": 34370, "first_seen_epoch": "1533964961.793338" }, { "bytes": 5283, "stream": 558, "flow_id": "flow-be60644b97d433d2b345a97f", "packets": 16, "transport": "tcp", "last_frame": 29156, "first_frame": 19338, "initiator_ip": "192.168.1.95", "responder_ip": "72.21.91.113", "initiator_port": 49714, "responder_port": 443, "initiator_bytes": 800, "last_seen_epoch": "1533965095.234951", "responder_bytes": 4483, "first_seen_epoch": "1533964961.81597" }, { "bytes": 17230, "stream": 559, "flow_id": "flow-ef127f83dcba65ce194c53b2", "packets": 28, "transport": "tcp", "last_frame": 29430, "first_frame": 19339, "initiator_ip": "192.168.1.95", "responder_ip": "72.21.91.113", "initiator_port": 49715, "responder_port": 443, "initiator_bytes": 1575, "last_seen_epoch": "1533965095.51265", "responder_bytes": 15655, "first_seen_epoch": "1533964961.816252" }, { "bytes": 1156, "stream": 560, "flow_id": "flow-e6e7537b4311690c4a938ccd", "packets": 13, "transport": "tcp", "last_frame": 29541, "first_frame": 19588, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.192.10", "initiator_port": 49716, "responder_port": 443, "initiator_bytes": 659, "last_seen_epoch": "1533965095.522347", "responder_bytes": 497, "first_seen_epoch": "1533964962.451043" }, { "bytes": 2835, "stream": 561, "flow_id": "flow-2614ae5abb5681896f721d49", "packets": 19, "transport": "tcp", "last_frame": 29526, "first_frame": 19589, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.192.10", "initiator_port": 49717, "responder_port": 443, "initiator_bytes": 1148, "last_seen_epoch": "1533965095.520298", "responder_bytes": 1687, "first_seen_epoch": "1533964962.451432" }, { "bytes": 294, "stream": 205, "flow_id": "flow-fda08f0f5b129b2e42f054ef", "packets": 2, "transport": "udp", "last_frame": 19619, "first_frame": 19606, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 53820, "responder_port": 53, "initiator_bytes": 83, "last_seen_epoch": "1533964962.605621", "responder_bytes": 211, "first_seen_epoch": "1533964962.543898" }, { "bytes": 4937, "stream": 562, "flow_id": "flow-5f05b8397d89c8f98e9dbd2f", "packets": 19, "transport": "tcp", "last_frame": 22109, "first_frame": 19620, "initiator_ip": "192.168.1.95", "responder_ip": "34.237.234.13", "initiator_port": 49718, "responder_port": 443, "initiator_bytes": 925, "last_seen_epoch": "1533964990.237609", "responder_bytes": 4012, "first_seen_epoch": "1533964962.606175" }, { "bytes": 7345, "stream": 563, "flow_id": "flow-0bc42dbc30b6245a4826a69a", "packets": 22, "transport": "tcp", "last_frame": 22105, "first_frame": 19622, "initiator_ip": "192.168.1.95", "responder_ip": "34.237.234.13", "initiator_port": 49719, "responder_port": 443, "initiator_bytes": 1860, "last_seen_epoch": "1533964990.237383", "responder_bytes": 5485, "first_seen_epoch": "1533964962.614895" }, { "bytes": 230, "stream": 206, "flow_id": "flow-685e1e9d8f432826ac33331b", "packets": 2, "transport": "udp", "last_frame": 19673, "first_frame": 19648, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 54180, "responder_port": 53, "initiator_bytes": 70, "last_seen_epoch": "1533964962.856769", "responder_bytes": 160, "first_seen_epoch": "1533964962.773029" }, { "bytes": 330, "stream": 207, "flow_id": "flow-c5ebaaebc7ad1e5d6ffe5586", "packets": 2, "transport": "udp", "last_frame": 19702, "first_frame": 19653, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 56627, "responder_port": 53, "initiator_bytes": 75, "last_seen_epoch": "1533964962.896098", "responder_bytes": 255, "first_seen_epoch": "1533964962.787255" }, { "bytes": 219, "stream": 208, "flow_id": "flow-bc834882afad71cef017bf0f", "packets": 2, "transport": "udp", "last_frame": 19705, "first_frame": 19654, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 56345, "responder_port": 53, "initiator_bytes": 78, "last_seen_epoch": "1533964962.898059", "responder_bytes": 141, "first_seen_epoch": "1533964962.787413" }, { "bytes": 282, "stream": 209, "flow_id": "flow-52e2bc55e7ca1bd9e362f70c", "packets": 2, "transport": "udp", "last_frame": 19708, "first_frame": 19655, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 62526, "responder_port": 53, "initiator_bytes": 87, "last_seen_epoch": "1533964962.901909", "responder_bytes": 195, "first_seen_epoch": "1533964962.787611" }, { "bytes": 8009, "stream": 564, "flow_id": "flow-22d356a65f694b03e24a3e4a", "packets": 18, "transport": "tcp", "last_frame": 26255, "first_frame": 19677, "initiator_ip": "192.168.1.95", "responder_ip": "204.79.197.200", "initiator_port": 49720, "responder_port": 443, "initiator_bytes": 1363, "last_seen_epoch": "1533965031.768071", "responder_bytes": 6646, "first_seen_epoch": "1533964962.858565" }, { "bytes": 6203, "stream": 565, "flow_id": "flow-a0d373c3ed7861e48c6f7b25", "packets": 14, "transport": "tcp", "last_frame": 28552, "first_frame": 19678, "initiator_ip": "192.168.1.95", "responder_ip": "204.79.197.200", "initiator_port": 49721, "responder_port": 443, "initiator_bytes": 732, "last_seen_epoch": "1533965086.308506", "responder_bytes": 5471, "first_seen_epoch": "1533964962.859728" }, { "bytes": 8115, "stream": 566, "flow_id": "flow-201284909ed8074189b1ec9d", "packets": 26, "transport": "tcp", "last_frame": 29146, "first_frame": 19703, "initiator_ip": "192.168.1.95", "responder_ip": "54.209.46.223", "initiator_port": 49722, "responder_port": 443, "initiator_bytes": 2131, "last_seen_epoch": "1533965095.233898", "responder_bytes": 5984, "first_seen_epoch": "1533964962.89698" }, { "bytes": 8211, "stream": 567, "flow_id": "flow-92a4a661469c7090dcb65f86", "packets": 26, "transport": "tcp", "last_frame": 29143, "first_frame": 19704, "initiator_ip": "192.168.1.95", "responder_ip": "54.209.46.223", "initiator_port": 49723, "responder_port": 443, "initiator_bytes": 2243, "last_seen_epoch": "1533965095.233632", "responder_bytes": 5968, "first_seen_epoch": "1533964962.896981" }, { "bytes": 5928, "stream": 568, "flow_id": "flow-ae955705cdd14fe0f38716ae", "packets": 15, "transport": "tcp", "last_frame": 29466, "first_frame": 19706, "initiator_ip": "192.168.1.95", "responder_ip": "161.170.239.188", "initiator_port": 49724, "responder_port": 443, "initiator_bytes": 784, "last_seen_epoch": "1533965095.515453", "responder_bytes": 5144, "first_seen_epoch": "1533964962.898629" }, { "bytes": 7308, "stream": 569, "flow_id": "flow-a6e7e07de2bad8d29650eff5", "packets": 20, "transport": "tcp", "last_frame": 29472, "first_frame": 19707, "initiator_ip": "192.168.1.95", "responder_ip": "161.170.239.188", "initiator_port": 49725, "responder_port": 443, "initiator_bytes": 1335, "last_seen_epoch": "1533965095.516055", "responder_bytes": 5973, "first_seen_epoch": "1533964962.89863" }, { "bytes": 5771, "stream": 570, "flow_id": "flow-cb5acade9596b4dbf60b35ad", "packets": 20, "transport": "tcp", "last_frame": 22866, "first_frame": 19709, "initiator_ip": "192.168.1.95", "responder_ip": "198.54.12.145", "initiator_port": 49726, "responder_port": 443, "initiator_bytes": 1552, "last_seen_epoch": "1533964994.260206", "responder_bytes": 4219, "first_seen_epoch": "1533964962.90301" }, { "bytes": 5835, "stream": 571, "flow_id": "flow-89d2b3386d6d9a60f331b6c6", "packets": 20, "transport": "tcp", "last_frame": 22895, "first_frame": 19710, "initiator_ip": "192.168.1.95", "responder_ip": "198.54.12.145", "initiator_port": 49727, "responder_port": 443, "initiator_bytes": 1664, "last_seen_epoch": "1533964995.180039", "responder_bytes": 4171, "first_seen_epoch": "1533964962.903012" }, { "bytes": 242, "stream": 210, "flow_id": "flow-f1a1722002b98bb88d4fb5af", "packets": 2, "transport": "udp", "last_frame": 19910, "first_frame": 19905, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 58722, "responder_port": 53, "initiator_bytes": 71, "last_seen_epoch": "1533964963.540458", "responder_bytes": 171, "first_seen_epoch": "1533964963.453564" }, { "bytes": 6142, "stream": 572, "flow_id": "flow-28d0cb08a117d35cac52d780", "packets": 21, "transport": "tcp", "last_frame": 22100, "first_frame": 19912, "initiator_ip": "192.168.1.95", "responder_ip": "104.254.150.179", "initiator_port": 49729, "responder_port": 443, "initiator_bytes": 1845, "last_seen_epoch": "1533964990.236866", "responder_bytes": 4297, "first_seen_epoch": "1533964963.542804" }, { "bytes": 8665, "stream": 573, "flow_id": "flow-2f6f6982a23bce05192c1a04", "packets": 26, "transport": "tcp", "last_frame": 22095, "first_frame": 19913, "initiator_ip": "192.168.1.95", "responder_ip": "104.254.150.179", "initiator_port": 49728, "responder_port": 443, "initiator_bytes": 2917, "last_seen_epoch": "1533964990.236295", "responder_bytes": 5748, "first_seen_epoch": "1533964963.542924" }, { "bytes": 21739, "stream": 574, "flow_id": "flow-94cdf68ca8bf0c63b876d78e", "packets": 74, "transport": "tcp", "last_frame": 39451, "first_frame": 19933, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.194.162", "initiator_port": 49730, "responder_port": 443, "initiator_bytes": 10082, "last_seen_epoch": "1533965249.306706", "responder_bytes": 11657, "first_seen_epoch": "1533964963.617566" }, { "bytes": 23957, "stream": 575, "flow_id": "flow-f897a46d9813e4f63aec9fca", "packets": 78, "transport": "tcp", "last_frame": 39452, "first_frame": 19934, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.194.162", "initiator_port": 49731, "responder_port": 443, "initiator_bytes": 11543, "last_seen_epoch": "1533965249.306707", "responder_bytes": 12414, "first_seen_epoch": "1533964963.634095" }, { "bytes": 21823, "stream": 576, "flow_id": "flow-9b98ba1570a6958d1c0dc84a", "packets": 74, "transport": "tcp", "last_frame": 39453, "first_frame": 19935, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.194.162", "initiator_port": 49732, "responder_port": 443, "initiator_bytes": 10166, "last_seen_epoch": "1533965249.306872", "responder_bytes": 11657, "first_seen_epoch": "1533964963.636498" }, { "bytes": 166, "stream": 211, "flow_id": "flow-2b2bce725021b2991045878c", "packets": 2, "transport": "udp", "last_frame": 20032, "first_frame": 20027, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 62801, "responder_port": 53, "initiator_bytes": 75, "last_seen_epoch": "1533964964.154372", "responder_bytes": 91, "first_seen_epoch": "1533964964.071735" }, { "bytes": 6571, "stream": 577, "flow_id": "flow-d49123f6538273eae83d19fd", "packets": 23, "transport": "tcp", "last_frame": 29418, "first_frame": 20035, "initiator_ip": "192.168.1.95", "responder_ip": "35.227.197.177", "initiator_port": 49733, "responder_port": 443, "initiator_bytes": 1584, "last_seen_epoch": "1533965095.511849", "responder_bytes": 4987, "first_seen_epoch": "1533964964.155119" }, { "bytes": 8020, "stream": 578, "flow_id": "flow-3786e785b9033e11dfb51ced", "packets": 26, "transport": "tcp", "last_frame": 29426, "first_frame": 20036, "initiator_ip": "192.168.1.95", "responder_ip": "35.227.197.177", "initiator_port": 49734, "responder_port": 443, "initiator_bytes": 2371, "last_seen_epoch": "1533965095.512468", "responder_bytes": 5649, "first_seen_epoch": "1533964964.17612" }, { "bytes": 336, "stream": 212, "flow_id": "flow-f1c99b5ee1c5c827850187a4", "packets": 2, "transport": "udp", "last_frame": 20071, "first_frame": 20064, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 49902, "responder_port": 53, "initiator_bytes": 77, "last_seen_epoch": "1533964964.450971", "responder_bytes": 259, "first_seen_epoch": "1533964964.377258" }, { "bytes": 14418, "stream": 579, "flow_id": "flow-195f19d1f08454ac04cf7b1b", "packets": 32, "transport": "tcp", "last_frame": 32276, "first_frame": 20072, "initiator_ip": "192.168.1.95", "responder_ip": "52.8.202.139", "initiator_port": 49735, "responder_port": 443, "initiator_bytes": 3800, "last_seen_epoch": "1533965106.521429", "responder_bytes": 10618, "first_seen_epoch": "1533964964.452241" }, { "bytes": 9908, "stream": 580, "flow_id": "flow-012ae7e4106768a16a310d11", "packets": 28, "transport": "tcp", "last_frame": 27549, "first_frame": 20073, "initiator_ip": "192.168.1.95", "responder_ip": "52.8.202.139", "initiator_port": 49736, "responder_port": 443, "initiator_bytes": 2769, "last_seen_epoch": "1533965035.701035", "responder_bytes": 7139, "first_seen_epoch": "1533964964.452244" }, { "bytes": 240, "stream": 213, "flow_id": "flow-d050802b35549af5a6e9cecc", "packets": 2, "transport": "udp", "last_frame": 20107, "first_frame": 20088, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 65220, "responder_port": 53, "initiator_bytes": 88, "last_seen_epoch": "1533964964.633293", "responder_bytes": 152, "first_seen_epoch": "1533964964.561974" }, { "bytes": 239, "stream": 214, "flow_id": "flow-7dcf933f8eaf69c1ff5699bb", "packets": 2, "transport": "udp", "last_frame": 20116, "first_frame": 20089, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 49516, "responder_port": 53, "initiator_bytes": 92, "last_seen_epoch": "1533964964.705871", "responder_bytes": 147, "first_seen_epoch": "1533964964.568163" }, { "bytes": 115727, "stream": 581, "flow_id": "flow-09923ed9b480122678d55327", "packets": 89, "transport": "tcp", "last_frame": 28744, "first_frame": 20108, "initiator_ip": "192.168.1.95", "responder_ip": "13.33.78.101", "initiator_port": 49737, "responder_port": 443, "initiator_bytes": 3716, "last_seen_epoch": "1533965094.687204", "responder_bytes": 112011, "first_seen_epoch": "1533964964.634689" }, { "bytes": 6096, "stream": 582, "flow_id": "flow-531db1620c2bb7146fe589b7", "packets": 20, "transport": "tcp", "last_frame": 24517, "first_frame": 20109, "initiator_ip": "192.168.1.95", "responder_ip": "13.33.78.101", "initiator_port": 49738, "responder_port": 443, "initiator_bytes": 990, "last_seen_epoch": "1533965019.517581", "responder_bytes": 5106, "first_seen_epoch": "1533964964.634776" }, { "bytes": 45379, "stream": 583, "flow_id": "flow-c94ed55266c82bbc72ddc4a9", "packets": 36, "transport": "tcp", "last_frame": 20251, "first_frame": 20117, "initiator_ip": "192.168.1.95", "responder_ip": "192.229.210.158", "initiator_port": 49739, "responder_port": 443, "initiator_bytes": 1773, "last_seen_epoch": "1533964965.02582", "responder_bytes": 43606, "first_seen_epoch": "1533964964.706776" }, { "bytes": 1433051, "stream": 584, "flow_id": "flow-1560cc65a2e9b4cc2f93ce5e", "packets": 1191, "transport": "tcp", "last_frame": 24550, "first_frame": 20118, "initiator_ip": "192.168.1.95", "responder_ip": "192.229.210.158", "initiator_port": 49740, "responder_port": 443, "initiator_bytes": 35671, "last_seen_epoch": "1533965019.846183", "responder_bytes": 1397380, "first_seen_epoch": "1533964964.706904" }, { "bytes": 170, "stream": 215, "flow_id": "flow-ae637428510927d54089ab38", "packets": 2, "transport": "udp", "last_frame": 20229, "first_frame": 20177, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 62477, "responder_port": 53, "initiator_bytes": 69, "last_seen_epoch": "1533964965.012616", "responder_bytes": 101, "first_seen_epoch": "1533964964.882716" }, { "bytes": 252, "stream": 216, "flow_id": "flow-2e8666912ef19cfb468ab855", "packets": 2, "transport": "udp", "last_frame": 20234, "first_frame": 20180, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 55972, "responder_port": 53, "initiator_bytes": 78, "last_seen_epoch": "1533964965.013702", "responder_bytes": 174, "first_seen_epoch": "1533964964.890981" }, { "bytes": 254, "stream": 217, "flow_id": "flow-0d79cccab07c8cef5e401605", "packets": 2, "transport": "udp", "last_frame": 20227, "first_frame": 20181, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 64873, "responder_port": 53, "initiator_bytes": 79, "last_seen_epoch": "1533964965.01252", "responder_bytes": 175, "first_seen_epoch": "1533964964.890983" }, { "bytes": 6863, "stream": 585, "flow_id": "flow-1c76000059ccb57b9d06f2cc", "packets": 21, "transport": "tcp", "last_frame": 20673, "first_frame": 20231, "initiator_ip": "192.168.1.95", "responder_ip": "156.154.202.36", "initiator_port": 49742, "responder_port": 443, "initiator_bytes": 1740, "last_seen_epoch": "1533964966.008008", "responder_bytes": 5123, "first_seen_epoch": "1533964965.013479" }, { "bytes": 6097, "stream": 586, "flow_id": "flow-20ce27d726d07b93469de70f", "packets": 23, "transport": "tcp", "last_frame": 29124, "first_frame": 20233, "initiator_ip": "192.168.1.95", "responder_ip": "54.183.248.197", "initiator_port": 49741, "responder_port": 443, "initiator_bytes": 1696, "last_seen_epoch": "1533965095.231325", "responder_bytes": 4401, "first_seen_epoch": "1533964965.013486" }, { "bytes": 4721, "stream": 587, "flow_id": "flow-b68483e5baf3cfb953d85b6f", "packets": 22, "transport": "tcp", "last_frame": 29127, "first_frame": 20235, "initiator_ip": "192.168.1.95", "responder_ip": "54.183.248.197", "initiator_port": 49743, "responder_port": 443, "initiator_bytes": 1041, "last_seen_epoch": "1533965095.231728", "responder_bytes": 3680, "first_seen_epoch": "1533964965.013825" }, { "bytes": 5387, "stream": 588, "flow_id": "flow-1f1dffee29528760c94c01db", "packets": 16, "transport": "tcp", "last_frame": 29448, "first_frame": 20236, "initiator_ip": "192.168.1.95", "responder_ip": "156.154.202.36", "initiator_port": 49744, "responder_port": 443, "initiator_bytes": 985, "last_seen_epoch": "1533965095.513908", "responder_bytes": 4402, "first_seen_epoch": "1533964965.01398" }, { "bytes": 8178, "stream": 589, "flow_id": "flow-38fdf73d3500b81070f32e4f", "packets": 26, "transport": "tcp", "last_frame": 29130, "first_frame": 20237, "initiator_ip": "192.168.1.95", "responder_ip": "54.191.20.146", "initiator_port": 49745, "responder_port": 443, "initiator_bytes": 1774, "last_seen_epoch": "1533965095.232037", "responder_bytes": 6404, "first_seen_epoch": "1533964965.014079" }, { "bytes": 6766, "stream": 590, "flow_id": "flow-69c1fc1c55227efcd8bdcce7", "packets": 22, "transport": "tcp", "last_frame": 29131, "first_frame": 20238, "initiator_ip": "192.168.1.95", "responder_ip": "54.191.20.146", "initiator_port": 49746, "responder_port": 443, "initiator_bytes": 971, "last_seen_epoch": "1533965095.232364", "responder_bytes": 5795, "first_seen_epoch": "1533964965.014195" }, { "bytes": 8970, "stream": 591, "flow_id": "flow-041458631a028578ae5fcbc4", "packets": 25, "transport": "tcp", "last_frame": 22086, "first_frame": 20241, "initiator_ip": "192.168.1.95", "responder_ip": "63.251.252.12", "initiator_port": 49747, "responder_port": 443, "initiator_bytes": 1963, "last_seen_epoch": "1533964990.235289", "responder_bytes": 7007, "first_seen_epoch": "1533964965.014931" }, { "bytes": 8880, "stream": 592, "flow_id": "flow-1446bd03dd80f6f2615659ee", "packets": 26, "transport": "tcp", "last_frame": 22091, "first_frame": 20242, "initiator_ip": "192.168.1.95", "responder_ip": "63.251.252.12", "initiator_port": 49748, "responder_port": 443, "initiator_bytes": 1739, "last_seen_epoch": "1533964990.235861", "responder_bytes": 7141, "first_seen_epoch": "1533964965.014932" }, { "bytes": 156, "stream": 218, "flow_id": "flow-f375eb5966b7eb358b20e22a", "packets": 2, "transport": "udp", "last_frame": 20323, "first_frame": 20280, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 50728, "responder_port": 53, "initiator_bytes": 70, "last_seen_epoch": "1533964965.29746", "responder_bytes": 86, "first_seen_epoch": "1533964965.146026" }, { "bytes": 7650, "stream": 593, "flow_id": "flow-9a6915297a2b3daec521e954", "packets": 22, "transport": "tcp", "last_frame": 29417, "first_frame": 20341, "initiator_ip": "192.168.1.95", "responder_ip": "107.178.254.65", "initiator_port": 49749, "responder_port": 443, "initiator_bytes": 1615, "last_seen_epoch": "1533965095.51173", "responder_bytes": 6035, "first_seen_epoch": "1533964965.301971" }, { "bytes": 7860, "stream": 594, "flow_id": "flow-6a70135be20a2b0a9ec6d43f", "packets": 23, "transport": "tcp", "last_frame": 29428, "first_frame": 20342, "initiator_ip": "192.168.1.95", "responder_ip": "107.178.254.65", "initiator_port": 49750, "responder_port": 443, "initiator_bytes": 1591, "last_seen_epoch": "1533965095.51247", "responder_bytes": 6269, "first_seen_epoch": "1533964965.301972" }, { "bytes": 282, "stream": 219, "flow_id": "flow-123c0a6e4c34b1b86b3008f6", "packets": 2, "transport": "udp", "last_frame": 20551, "first_frame": 20426, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 59567, "responder_port": 53, "initiator_bytes": 110, "last_seen_epoch": "1533964965.682355", "responder_bytes": 172, "first_seen_epoch": "1533964965.457165" }, { "bytes": 8924, "stream": 595, "flow_id": "flow-ca0426a7e84b086c471cb0eb", "packets": 22, "transport": "tcp", "last_frame": 22081, "first_frame": 20563, "initiator_ip": "192.168.1.95", "responder_ip": "69.168.106.81", "initiator_port": 49751, "responder_port": 443, "initiator_bytes": 1503, "last_seen_epoch": "1533964990.234749", "responder_bytes": 7421, "first_seen_epoch": "1533964965.689886" }, { "bytes": 5088, "stream": 596, "flow_id": "flow-79a4bc880b18e22a26453968", "packets": 20, "transport": "tcp", "last_frame": 29113, "first_frame": 20564, "initiator_ip": "192.168.1.95", "responder_ip": "69.168.106.81", "initiator_port": 49752, "responder_port": 443, "initiator_bytes": 1012, "last_seen_epoch": "1533965095.230321", "responder_bytes": 4076, "first_seen_epoch": "1533964965.690026" }, { "bytes": 174, "stream": 220, "flow_id": "flow-9b07156c38c311421c8ba0b3", "packets": 2, "transport": "udp", "last_frame": 20725, "first_frame": 20585, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 52869, "responder_port": 53, "initiator_bytes": 79, "last_seen_epoch": "1533964966.306264", "responder_bytes": 95, "first_seen_epoch": "1533964965.733767" }, { "bytes": 5394, "stream": 597, "flow_id": "flow-83026222fc4c66b9f13a7924", "packets": 19, "transport": "tcp", "last_frame": 29425, "first_frame": 20729, "initiator_ip": "192.168.1.95", "responder_ip": "35.190.91.160", "initiator_port": 49753, "responder_port": 443, "initiator_bytes": 905, "last_seen_epoch": "1533965095.512158", "responder_bytes": 4489, "first_seen_epoch": "1533964966.309425" }, { "bytes": 6704, "stream": 598, "flow_id": "flow-f61f5545ba72040e05124a3d", "packets": 23, "transport": "tcp", "last_frame": 29390, "first_frame": 20730, "initiator_ip": "192.168.1.95", "responder_ip": "35.190.91.160", "initiator_port": 49754, "responder_port": 443, "initiator_bytes": 1728, "last_seen_epoch": "1533965095.510201", "responder_bytes": 4976, "first_seen_epoch": "1533964966.309614" }, { "bytes": 212, "stream": 221, "flow_id": "flow-a40c3ffd59aeb28a45cc6f56", "packets": 2, "transport": "udp", "last_frame": 21150, "first_frame": 20905, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 54159, "responder_port": 53, "initiator_bytes": 79, "last_seen_epoch": "1533964967.906377", "responder_bytes": 133, "first_seen_epoch": "1533964966.935817" }, { "bytes": 4698, "stream": 599, "flow_id": "flow-eceb5683f542d78ac1dee278", "packets": 17, "transport": "tcp", "last_frame": 22076, "first_frame": 21153, "initiator_ip": "192.168.1.95", "responder_ip": "185.180.13.28", "initiator_port": 49755, "responder_port": 443, "initiator_bytes": 861, "last_seen_epoch": "1533964990.234286", "responder_bytes": 3837, "first_seen_epoch": "1533964967.907274" }, { "bytes": 6364, "stream": 600, "flow_id": "flow-1de8ace23f082effff575ee5", "packets": 24, "transport": "tcp", "last_frame": 22071, "first_frame": 21154, "initiator_ip": "192.168.1.95", "responder_ip": "185.180.13.28", "initiator_port": 49756, "responder_port": 443, "initiator_bytes": 1900, "last_seen_epoch": "1533964990.233498", "responder_bytes": 4464, "first_seen_epoch": "1533964967.907275" }, { "bytes": 4269, "stream": 601, "flow_id": "flow-c9e011584dd6e31eec83a56c", "packets": 20, "transport": "tcp", "last_frame": 23231, "first_frame": 21944, "initiator_ip": "192.168.1.95", "responder_ip": "104.254.150.77", "initiator_port": 49757, "responder_port": 443, "initiator_bytes": 2332, "last_seen_epoch": "1533964997.136575", "responder_bytes": 1937, "first_seen_epoch": "1533964979.964306" }, { "bytes": 4268, "stream": 602, "flow_id": "flow-186a17b0312bdc5eb9582071", "packets": 20, "transport": "tcp", "last_frame": 23228, "first_frame": 21945, "initiator_ip": "192.168.1.95", "responder_ip": "104.254.150.77", "initiator_port": 49758, "responder_port": 443, "initiator_bytes": 2332, "last_seen_epoch": "1533964997.136289", "responder_bytes": 1936, "first_seen_epoch": "1533964979.964514" }, { "bytes": 4492, "stream": 603, "flow_id": "flow-6d549f60f13e73aeb3b053f9", "packets": 23, "transport": "tcp", "last_frame": 24289, "first_frame": 22008, "initiator_ip": "192.168.1.95", "responder_ip": "34.213.12.32", "initiator_port": 49759, "responder_port": 443, "initiator_bytes": 3063, "last_seen_epoch": "1533965002.685392", "responder_bytes": 1429, "first_seen_epoch": "1533964981.223563" }, { "bytes": 4427, "stream": 604, "flow_id": "flow-c9f080551c48bd8bbacce040", "packets": 19, "transport": "tcp", "last_frame": 26220, "first_frame": 22867, "initiator_ip": "192.168.1.95", "responder_ip": "104.254.150.77", "initiator_port": 49760, "responder_port": 443, "initiator_bytes": 2909, "last_seen_epoch": "1533965030.288122", "responder_bytes": 1518, "first_seen_epoch": "1533964994.324517" }, { "bytes": 7284, "stream": 605, "flow_id": "flow-77d75f267c63d1e83df3bb1a", "packets": 24, "transport": "tcp", "last_frame": 26217, "first_frame": 22868, "initiator_ip": "192.168.1.95", "responder_ip": "104.254.150.77", "initiator_port": 49761, "responder_port": 443, "initiator_bytes": 4994, "last_seen_epoch": "1533965030.287606", "responder_bytes": 2290, "first_seen_epoch": "1533964994.324669" }, { "bytes": 7674, "stream": 606, "flow_id": "flow-9e36742f69bc4677ab3dc6e7", "packets": 22, "transport": "tcp", "last_frame": 26270, "first_frame": 22911, "initiator_ip": "192.168.1.95", "responder_ip": "104.254.150.69", "initiator_port": 49763, "responder_port": 443, "initiator_bytes": 3074, "last_seen_epoch": "1533965032.296872", "responder_bytes": 4600, "first_seen_epoch": "1533964996.035887" }, { "bytes": 9225, "stream": 607, "flow_id": "flow-737381580717701e774f4f26", "packets": 29, "transport": "tcp", "last_frame": 26273, "first_frame": 22912, "initiator_ip": "192.168.1.95", "responder_ip": "104.254.150.69", "initiator_port": 49762, "responder_port": 443, "initiator_bytes": 3659, "last_seen_epoch": "1533965032.297328", "responder_bytes": 5566, "first_seen_epoch": "1533964996.035889" }, { "bytes": 2693, "stream": 608, "flow_id": "flow-78c844f52adaf009cf3c8bc7", "packets": 15, "transport": "tcp", "last_frame": 23142, "first_frame": 22919, "initiator_ip": "192.168.1.95", "responder_ip": "207.244.102.143", "initiator_port": 49764, "responder_port": 443, "initiator_bytes": 1314, "last_seen_epoch": "1533964996.889587", "responder_bytes": 1379, "first_seen_epoch": "1533964996.040055" }, { "bytes": 1421, "stream": 609, "flow_id": "flow-d48b1252c6e80a294d78f3a6", "packets": 16, "transport": "tcp", "last_frame": 26287, "first_frame": 22920, "initiator_ip": "192.168.1.95", "responder_ip": "207.244.102.143", "initiator_port": 49765, "responder_port": 443, "initiator_bytes": 799, "last_seen_epoch": "1533965032.301006", "responder_bytes": 622, "first_seen_epoch": "1533964996.040118" }, { "bytes": 3952, "stream": 610, "flow_id": "flow-02160d31639f2150c2ccee14", "packets": 22, "transport": "tcp", "last_frame": 29344, "first_frame": 22966, "initiator_ip": "192.168.1.95", "responder_ip": "35.185.244.37", "initiator_port": 49767, "responder_port": 443, "initiator_bytes": 2128, "last_seen_epoch": "1533965095.255567", "responder_bytes": 1824, "first_seen_epoch": "1533964996.225475" }, { "bytes": 4072, "stream": 611, "flow_id": "flow-bbda5e21cd57ce58fc957709", "packets": 24, "transport": "tcp", "last_frame": 29341, "first_frame": 22967, "initiator_ip": "192.168.1.95", "responder_ip": "35.185.244.37", "initiator_port": 49766, "responder_port": 443, "initiator_bytes": 2124, "last_seen_epoch": "1533965095.255189", "responder_bytes": 1948, "first_seen_epoch": "1533964996.225499" }, { "bytes": 1482, "stream": 612, "flow_id": "flow-70a33406bd94caf2338743e7", "packets": 16, "transport": "tcp", "last_frame": 29301, "first_frame": 22984, "initiator_ip": "192.168.1.95", "responder_ip": "52.9.78.114", "initiator_port": 49768, "responder_port": 443, "initiator_bytes": 820, "last_seen_epoch": "1533965095.250787", "responder_bytes": 662, "first_seen_epoch": "1533964996.335147" }, { "bytes": 2712, "stream": 613, "flow_id": "flow-edd98962f2861e83a1a5ebb6", "packets": 20, "transport": "tcp", "last_frame": 29298, "first_frame": 22985, "initiator_ip": "192.168.1.95", "responder_ip": "52.9.78.114", "initiator_port": 49769, "responder_port": 443, "initiator_bytes": 1467, "last_seen_epoch": "1533965095.250465", "responder_bytes": 1245, "first_seen_epoch": "1533964996.33528" }, { "bytes": 337, "stream": 222, "flow_id": "flow-ac753502f42c5b3614bce1f4", "packets": 2, "transport": "udp", "last_frame": 23033, "first_frame": 22986, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 62101, "responder_port": 53, "initiator_bytes": 71, "last_seen_epoch": "1533964996.474799", "responder_bytes": 266, "first_seen_epoch": "1533964996.335466" }, { "bytes": 281, "stream": 223, "flow_id": "flow-8d84cf90d49f3cb7cd6cf89b", "packets": 2, "transport": "udp", "last_frame": 23086, "first_frame": 22987, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 57318, "responder_port": 53, "initiator_bytes": 73, "last_seen_epoch": "1533964996.618558", "responder_bytes": 208, "first_seen_epoch": "1533964996.337677" }, { "bytes": 166, "stream": 224, "flow_id": "flow-383e7927db5799b82bf9db43", "packets": 2, "transport": "udp", "last_frame": 23034, "first_frame": 22988, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 56506, "responder_port": 53, "initiator_bytes": 75, "last_seen_epoch": "1533964996.474895", "responder_bytes": 91, "first_seen_epoch": "1533964996.338424" }, { "bytes": 1347, "stream": 614, "flow_id": "flow-ad9a78bf6ca896d7c35b9bbc", "packets": 14, "transport": "tcp", "last_frame": 29297, "first_frame": 22989, "initiator_ip": "192.168.1.95", "responder_ip": "34.211.69.152", "initiator_port": 49770, "responder_port": 443, "initiator_bytes": 753, "last_seen_epoch": "1533965095.250267", "responder_bytes": 594, "first_seen_epoch": "1533964996.338654" }, { "bytes": 2689, "stream": 615, "flow_id": "flow-dca2f477a286aa2a226457ce", "packets": 18, "transport": "tcp", "last_frame": 29294, "first_frame": 22990, "initiator_ip": "192.168.1.95", "responder_ip": "34.211.69.152", "initiator_port": 49771, "responder_port": 443, "initiator_bytes": 1592, "last_seen_epoch": "1533965095.249937", "responder_bytes": 1097, "first_seen_epoch": "1533964996.338862" }, { "bytes": 8648, "stream": 616, "flow_id": "flow-ff4af56602646b08777e0dbf", "packets": 25, "transport": "tcp", "last_frame": 29469, "first_frame": 23036, "initiator_ip": "192.168.1.95", "responder_ip": "4.78.226.233", "initiator_port": 49772, "responder_port": 443, "initiator_bytes": 1560, "last_seen_epoch": "1533965095.515732", "responder_bytes": 7088, "first_seen_epoch": "1533964996.4758" }, { "bytes": 7900, "stream": 617, "flow_id": "flow-9294ede74834eb7fa399cca8", "packets": 24, "transport": "tcp", "last_frame": 29474, "first_frame": 23037, "initiator_ip": "192.168.1.95", "responder_ip": "4.78.226.233", "initiator_port": 49773, "responder_port": 443, "initiator_bytes": 1484, "last_seen_epoch": "1533965095.516211", "responder_bytes": 6416, "first_seen_epoch": "1533964996.475801" }, { "bytes": 8364, "stream": 618, "flow_id": "flow-923e2e0b3e23ec63ce695b33", "packets": 28, "transport": "tcp", "last_frame": 36635, "first_frame": 23039, "initiator_ip": "192.168.1.95", "responder_ip": "52.39.151.69", "initiator_port": 49774, "responder_port": 443, "initiator_bytes": 1724, "last_seen_epoch": "1533965205.070439", "responder_bytes": 6640, "first_seen_epoch": "1533964996.476257" }, { "bytes": 8296, "stream": 619, "flow_id": "flow-d0cb6e9bef9e54c6a3809e19", "packets": 24, "transport": "tcp", "last_frame": 29106, "first_frame": 23040, "initiator_ip": "192.168.1.95", "responder_ip": "52.39.151.69", "initiator_port": 49775, "responder_port": 443, "initiator_bytes": 1668, "last_seen_epoch": "1533965095.229477", "responder_bytes": 6628, "first_seen_epoch": "1533964996.476585" }, { "bytes": 7766, "stream": 620, "flow_id": "flow-8ad7b00b09a44ef1294d5292", "packets": 25, "transport": "tcp", "last_frame": 29103, "first_frame": 23087, "initiator_ip": "192.168.1.95", "responder_ip": "209.58.136.30", "initiator_port": 49776, "responder_port": 443, "initiator_bytes": 1494, "last_seen_epoch": "1533965095.229097", "responder_bytes": 6272, "first_seen_epoch": "1533964996.619396" }, { "bytes": 7912, "stream": 621, "flow_id": "flow-551f5cb7b4474c0e3e3c1661", "packets": 26, "transport": "tcp", "last_frame": 29100, "first_frame": 23088, "initiator_ip": "192.168.1.95", "responder_ip": "209.58.136.30", "initiator_port": 49777, "responder_port": 443, "initiator_bytes": 1586, "last_seen_epoch": "1533965095.228715", "responder_bytes": 6326, "first_seen_epoch": "1533964996.61961" }, { "bytes": 210, "stream": 225, "flow_id": "flow-520b66b449bbcade136404fa", "packets": 2, "transport": "udp", "last_frame": 23149, "first_frame": 23095, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 59274, "responder_port": 53, "initiator_bytes": 81, "last_seen_epoch": "1533964996.948203", "responder_bytes": 129, "first_seen_epoch": "1533964996.653876" }, { "bytes": 7656, "stream": 622, "flow_id": "flow-de11dafc98b1c9f66aa233ae", "packets": 19, "transport": "tcp", "last_frame": 29545, "first_frame": 23150, "initiator_ip": "192.168.1.95", "responder_ip": "52.74.108.147", "initiator_port": 49778, "responder_port": 443, "initiator_bytes": 1386, "last_seen_epoch": "1533965095.522621", "responder_bytes": 6270, "first_seen_epoch": "1533964996.948924" }, { "bytes": 6508, "stream": 623, "flow_id": "flow-128e8d82102cda4c64d97194", "packets": 17, "transport": "tcp", "last_frame": 29546, "first_frame": 23151, "initiator_ip": "192.168.1.95", "responder_ip": "52.74.108.147", "initiator_port": 49779, "responder_port": 443, "initiator_bytes": 863, "last_seen_epoch": "1533965095.522622", "responder_bytes": 5645, "first_seen_epoch": "1533964996.949063" }, { "bytes": 206, "stream": 226, "flow_id": "flow-4686419cc668403321edeac8", "packets": 2, "transport": "udp", "last_frame": 23216, "first_frame": 23164, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 55703, "responder_port": 53, "initiator_bytes": 74, "last_seen_epoch": "1533964997.081499", "responder_bytes": 132, "first_seen_epoch": "1533964996.955481" }, { "bytes": 22480, "stream": 624, "flow_id": "flow-216972a382abd21ee0dc43e6", "packets": 39, "transport": "tcp", "last_frame": 29381, "first_frame": 23217, "initiator_ip": "192.168.1.95", "responder_ip": "151.101.41.108", "initiator_port": 49781, "responder_port": 443, "initiator_bytes": 2427, "last_seen_epoch": "1533965095.509632", "responder_bytes": 20053, "first_seen_epoch": "1533964997.082428" }, { "bytes": 4983, "stream": 625, "flow_id": "flow-1b0bde0ae0a08075f017d4bc", "packets": 17, "transport": "tcp", "last_frame": 29410, "first_frame": 23218, "initiator_ip": "192.168.1.95", "responder_ip": "151.101.41.108", "initiator_port": 49780, "responder_port": 443, "initiator_bytes": 856, "last_seen_epoch": "1533965095.511445", "responder_bytes": 4127, "first_seen_epoch": "1533964997.08245" }, { "bytes": 8369, "stream": 626, "flow_id": "flow-4fc530ca020d40953b76e47c", "packets": 28, "transport": "tcp", "last_frame": 24404, "first_frame": 23232, "initiator_ip": "192.168.1.95", "responder_ip": "104.254.150.77", "initiator_port": 49782, "responder_port": 443, "initiator_bytes": 4508, "last_seen_epoch": "1533965015.09123", "responder_bytes": 3861, "first_seen_epoch": "1533964997.136702" }, { "bytes": 9832, "stream": 627, "flow_id": "flow-42f6b4767838da28c407725f", "packets": 28, "transport": "tcp", "last_frame": 24407, "first_frame": 23233, "initiator_ip": "192.168.1.95", "responder_ip": "104.254.150.77", "initiator_port": 49783, "responder_port": 443, "initiator_bytes": 4445, "last_seen_epoch": "1533965015.091719", "responder_bytes": 5387, "first_seen_epoch": "1533964997.136859" }, { "bytes": 5975, "stream": 628, "flow_id": "flow-f27670c3ec2b900dc32a18d6", "packets": 20, "transport": "tcp", "last_frame": 29395, "first_frame": 23245, "initiator_ip": "192.168.1.95", "responder_ip": "198.23.90.60", "initiator_port": 49784, "responder_port": 443, "initiator_bytes": 1505, "last_seen_epoch": "1533965095.510487", "responder_bytes": 4470, "first_seen_epoch": "1533964997.1879" }, { "bytes": 5761, "stream": 629, "flow_id": "flow-005b17f1e61c53d63c2c9f07", "packets": 19, "transport": "tcp", "last_frame": 29391, "first_frame": 23246, "initiator_ip": "192.168.1.95", "responder_ip": "198.23.90.60", "initiator_port": 49785, "responder_port": 443, "initiator_bytes": 1377, "last_seen_epoch": "1533965095.510341", "responder_bytes": 4384, "first_seen_epoch": "1533964997.18803" }, { "bytes": 1471, "stream": 630, "flow_id": "flow-4511d931d6c70d74a9159228", "packets": 16, "transport": "tcp", "last_frame": 29289, "first_frame": 23247, "initiator_ip": "192.168.1.95", "responder_ip": "54.186.237.130", "initiator_port": 49786, "responder_port": 443, "initiator_bytes": 809, "last_seen_epoch": "1533965095.249528", "responder_bytes": 662, "first_seen_epoch": "1533964997.188207" }, { "bytes": 2989, "stream": 631, "flow_id": "flow-ef2c53b366ad0bd73ed5ee56", "packets": 20, "transport": "tcp", "last_frame": 29284, "first_frame": 23248, "initiator_ip": "192.168.1.95", "responder_ip": "54.186.237.130", "initiator_port": 49787, "responder_port": 443, "initiator_bytes": 1504, "last_seen_epoch": "1533965095.249192", "responder_bytes": 1485, "first_seen_epoch": "1533964997.18836" }, { "bytes": 288, "stream": 227, "flow_id": "flow-ef12bcc49a381f72349cca39", "packets": 2, "transport": "udp", "last_frame": 23293, "first_frame": 23249, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 65067, "responder_port": 53, "initiator_bytes": 80, "last_seen_epoch": "1533964997.291196", "responder_bytes": 208, "first_seen_epoch": "1533964997.188987" }, { "bytes": 178, "stream": 228, "flow_id": "flow-d879ada551c9c70453a36c1e", "packets": 2, "transport": "udp", "last_frame": 23321, "first_frame": 23250, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 54121, "responder_port": 53, "initiator_bytes": 81, "last_seen_epoch": "1533964997.328339", "responder_bytes": 97, "first_seen_epoch": "1533964997.189399" }, { "bytes": 274, "stream": 229, "flow_id": "flow-3416ad7ad29562fc732c8771", "packets": 2, "transport": "udp", "last_frame": 23322, "first_frame": 23251, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 50088, "responder_port": 53, "initiator_bytes": 87, "last_seen_epoch": "1533964997.328492", "responder_bytes": 187, "first_seen_epoch": "1533964997.190207" }, { "bytes": 1418, "stream": 632, "flow_id": "flow-c6036a84c85e1023a7c6300c", "packets": 16, "transport": "tcp", "last_frame": 26367, "first_frame": 23257, "initiator_ip": "192.168.1.95", "responder_ip": "185.167.164.37", "initiator_port": 49788, "responder_port": 443, "initiator_bytes": 796, "last_seen_epoch": "1533965032.573398", "responder_bytes": 622, "first_seen_epoch": "1533964997.191261" }, { "bytes": 2392, "stream": 633, "flow_id": "flow-31da2bf19f7a67d503c19661", "packets": 20, "transport": "tcp", "last_frame": 26364, "first_frame": 23258, "initiator_ip": "192.168.1.95", "responder_ip": "185.167.164.37", "initiator_port": 49789, "responder_port": 443, "initiator_bytes": 1379, "last_seen_epoch": "1533965032.573091", "responder_bytes": 1013, "first_seen_epoch": "1533964997.191262" }, { "bytes": 166, "stream": 230, "flow_id": "flow-ca2c531d91ef8d3008a7ab01", "packets": 2, "transport": "udp", "last_frame": 23300, "first_frame": 23262, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 56749, "responder_port": 53, "initiator_bytes": 75, "last_seen_epoch": "1533964997.294014", "responder_bytes": 91, "first_seen_epoch": "1533964997.192053" }, { "bytes": 4563, "stream": 634, "flow_id": "flow-34add8a1a2522d0c8ed60a6e", "packets": 19, "transport": "tcp", "last_frame": 29081, "first_frame": 23298, "initiator_ip": "192.168.1.95", "responder_ip": "52.206.38.25", "initiator_port": 49790, "responder_port": 443, "initiator_bytes": 922, "last_seen_epoch": "1533965095.226592", "responder_bytes": 3641, "first_seen_epoch": "1533964997.292463" }, { "bytes": 5755, "stream": 635, "flow_id": "flow-5e76abfeae630962fd09ff63", "packets": 22, "transport": "tcp", "last_frame": 29078, "first_frame": 23299, "initiator_ip": "192.168.1.95", "responder_ip": "52.206.38.25", "initiator_port": 49791, "responder_port": 443, "initiator_bytes": 1553, "last_seen_epoch": "1533965095.226166", "responder_bytes": 4202, "first_seen_epoch": "1533964997.292701" }, { "bytes": 8378, "stream": 636, "flow_id": "flow-21b4903e7ebf53c28fa99b9f", "packets": 22, "transport": "tcp", "last_frame": 29453, "first_frame": 23302, "initiator_ip": "192.168.1.95", "responder_ip": "4.78.226.234", "initiator_port": 49792, "responder_port": 443, "initiator_bytes": 1440, "last_seen_epoch": "1533965095.514865", "responder_bytes": 6938, "first_seen_epoch": "1533964997.294806" }, { "bytes": 6840, "stream": 637, "flow_id": "flow-089f5a0541b3d41875315e0d", "packets": 19, "transport": "tcp", "last_frame": 29439, "first_frame": 23303, "initiator_ip": "192.168.1.95", "responder_ip": "4.78.226.234", "initiator_port": 49793, "responder_port": 443, "initiator_bytes": 901, "last_seen_epoch": "1533965095.513501", "responder_bytes": 5939, "first_seen_epoch": "1533964997.294808" }, { "bytes": 6718, "stream": 638, "flow_id": "flow-65380e1a956b67edc69fae29", "packets": 23, "transport": "tcp", "last_frame": 29419, "first_frame": 23325, "initiator_ip": "192.168.1.95", "responder_ip": "149.174.66.131", "initiator_port": 49795, "responder_port": 443, "initiator_bytes": 1800, "last_seen_epoch": "1533965095.51198", "responder_bytes": 4918, "first_seen_epoch": "1533964997.329381" }, { "bytes": 4782, "stream": 639, "flow_id": "flow-ebddc5bd22f12fcd87ee49a9", "packets": 17, "transport": "tcp", "last_frame": 29429, "first_frame": 23326, "initiator_ip": "192.168.1.95", "responder_ip": "149.174.66.131", "initiator_port": 49794, "responder_port": 443, "initiator_bytes": 1045, "last_seen_epoch": "1533965095.512648", "responder_bytes": 3737, "first_seen_epoch": "1533964997.329382" }, { "bytes": 4944, "stream": 640, "flow_id": "flow-bb4df8de738f46df7b95e560", "packets": 19, "transport": "tcp", "last_frame": 29075, "first_frame": 23327, "initiator_ip": "192.168.1.95", "responder_ip": "69.174.248.224", "initiator_port": 49796, "responder_port": 443, "initiator_bytes": 907, "last_seen_epoch": "1533965095.225801", "responder_bytes": 4037, "first_seen_epoch": "1533964997.329929" }, { "bytes": 5859, "stream": 641, "flow_id": "flow-30501414a6d410acad669a5f", "packets": 22, "transport": "tcp", "last_frame": 29072, "first_frame": 23328, "initiator_ip": "192.168.1.95", "responder_ip": "69.174.248.224", "initiator_port": 49797, "responder_port": 443, "initiator_bytes": 1490, "last_seen_epoch": "1533965095.225414", "responder_bytes": 4369, "first_seen_epoch": "1533964997.330242" }, { "bytes": 22333, "stream": 642, "flow_id": "flow-96fb9d5dccf4dbadf351d6a4", "packets": 41, "transport": "tcp", "last_frame": 29445, "first_frame": 23511, "initiator_ip": "192.168.1.95", "responder_ip": "8.39.36.143", "initiator_port": 49798, "responder_port": 443, "initiator_bytes": 9146, "last_seen_epoch": "1533965095.513657", "responder_bytes": 13187, "first_seen_epoch": "1533964997.592178" }, { "bytes": 17050, "stream": 643, "flow_id": "flow-f64367ae84cd83aac9c92297", "packets": 36, "transport": "tcp", "last_frame": 29447, "first_frame": 23512, "initiator_ip": "192.168.1.95", "responder_ip": "8.39.36.143", "initiator_port": 49799, "responder_port": 443, "initiator_bytes": 6555, "last_seen_epoch": "1533965095.513822", "responder_bytes": 10495, "first_seen_epoch": "1533964997.592349" }, { "bytes": 17128, "stream": 644, "flow_id": "flow-cbbef5d55cd425b552a43243", "packets": 34, "transport": "tcp", "last_frame": 29446, "first_frame": 23546, "initiator_ip": "192.168.1.95", "responder_ip": "8.39.36.143", "initiator_port": 49800, "responder_port": 443, "initiator_bytes": 6463, "last_seen_epoch": "1533965095.51382", "responder_bytes": 10665, "first_seen_epoch": "1533964997.6791" }, { "bytes": 461, "stream": 231, "flow_id": "flow-20868a70000f39fa5e0da073", "packets": 2, "transport": "udp", "last_frame": 23599, "first_frame": 23547, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 55513, "responder_port": 53, "initiator_bytes": 78, "last_seen_epoch": "1533964997.757167", "responder_bytes": 383, "first_seen_epoch": "1533964997.685605" }, { "bytes": 2214, "stream": 645, "flow_id": "flow-381fe35652fde3ee48260a08", "packets": 14, "transport": "tcp", "last_frame": 24372, "first_frame": 23549, "initiator_ip": "192.168.1.95", "responder_ip": "74.119.117.94", "initiator_port": 49801, "responder_port": 443, "initiator_bytes": 1220, "last_seen_epoch": "1533965012.654601", "responder_bytes": 994, "first_seen_epoch": "1533964997.691065" }, { "bytes": 1048, "stream": 646, "flow_id": "flow-907efac7cd814a33f4fe09d4", "packets": 10, "transport": "tcp", "last_frame": 24367, "first_frame": 23550, "initiator_ip": "192.168.1.95", "responder_ip": "74.119.117.94", "initiator_port": 49802, "responder_port": 443, "initiator_bytes": 573, "last_seen_epoch": "1533965011.595474", "responder_bytes": 475, "first_seen_epoch": "1533964997.69108" }, { "bytes": 4383, "stream": 647, "flow_id": "flow-33d657bfca15f0b291fd4e7e", "packets": 19, "transport": "tcp", "last_frame": 26695, "first_frame": 23556, "initiator_ip": "192.168.1.95", "responder_ip": "199.38.167.128", "initiator_port": 49803, "responder_port": 443, "initiator_bytes": 1138, "last_seen_epoch": "1533965033.399584", "responder_bytes": 3245, "first_seen_epoch": "1533964997.703578" }, { "bytes": 6203, "stream": 648, "flow_id": "flow-22d1f87a1763214576b971cd", "packets": 21, "transport": "tcp", "last_frame": 26693, "first_frame": 23557, "initiator_ip": "192.168.1.95", "responder_ip": "199.38.167.128", "initiator_port": 49804, "responder_port": 443, "initiator_bytes": 1869, "last_seen_epoch": "1533965033.39931", "responder_bytes": 4334, "first_seen_epoch": "1533964997.703731" }, { "bytes": 13205, "stream": 649, "flow_id": "flow-dd497fa4886aa000629b4b24", "packets": 30, "transport": "tcp", "last_frame": 29473, "first_frame": 23564, "initiator_ip": "192.168.1.95", "responder_ip": "8.39.36.143", "initiator_port": 49805, "responder_port": 443, "initiator_bytes": 5000, "last_seen_epoch": "1533965095.516079", "responder_bytes": 8205, "first_seen_epoch": "1533964997.719217" }, { "bytes": 236, "stream": 232, "flow_id": "flow-aaa49b9e525d27a6fd1f18a8", "packets": 2, "transport": "udp", "last_frame": 23638, "first_frame": 23567, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 49240, "responder_port": 53, "initiator_bytes": 73, "last_seen_epoch": "1533964997.826472", "responder_bytes": 163, "first_seen_epoch": "1533964997.73616" }, { "bytes": 162, "stream": 233, "flow_id": "flow-464bd5fe14e7fb407d2ff937", "packets": 2, "transport": "udp", "last_frame": 23633, "first_frame": 23568, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 56729, "responder_port": 53, "initiator_bytes": 73, "last_seen_epoch": "1533964997.811829", "responder_bytes": 89, "first_seen_epoch": "1533964997.737064" }, { "bytes": 327, "stream": 234, "flow_id": "flow-76f09acca390a56decd6fc43", "packets": 2, "transport": "udp", "last_frame": 23623, "first_frame": 23569, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 56042, "responder_port": 53, "initiator_bytes": 73, "last_seen_epoch": "1533964997.803829", "responder_bytes": 254, "first_seen_epoch": "1533964997.744678" }, { "bytes": 266, "stream": 235, "flow_id": "flow-9af52089dd0685712ab1d774", "packets": 2, "transport": "udp", "last_frame": 23649, "first_frame": 23570, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 61650, "responder_port": 53, "initiator_bytes": 73, "last_seen_epoch": "1533964997.831687", "responder_bytes": 193, "first_seen_epoch": "1533964997.745243" }, { "bytes": 14071, "stream": 650, "flow_id": "flow-03d131c5fba713f8f953638c", "packets": 32, "transport": "tcp", "last_frame": 29449, "first_frame": 23597, "initiator_ip": "192.168.1.95", "responder_ip": "8.39.36.143", "initiator_port": 49806, "responder_port": 443, "initiator_bytes": 5076, "last_seen_epoch": "1533965095.514015", "responder_bytes": 8995, "first_seen_epoch": "1533964997.756512" }, { "bytes": 6379, "stream": 651, "flow_id": "flow-37ce7abd5a4a7571092c87f0", "packets": 24, "transport": "tcp", "last_frame": 29060, "first_frame": 23600, "initiator_ip": "192.168.1.95", "responder_ip": "54.69.70.7", "initiator_port": 49807, "responder_port": 443, "initiator_bytes": 1100, "last_seen_epoch": "1533965095.224203", "responder_bytes": 5279, "first_seen_epoch": "1533964997.758667" }, { "bytes": 7433, "stream": 652, "flow_id": "flow-2a315b617ab8989ea21d3e7b", "packets": 23, "transport": "tcp", "last_frame": 29057, "first_frame": 23603, "initiator_ip": "192.168.1.95", "responder_ip": "54.69.70.7", "initiator_port": 49808, "responder_port": 443, "initiator_bytes": 1551, "last_seen_epoch": "1533965095.223847", "responder_bytes": 5882, "first_seen_epoch": "1533964997.759582" }, { "bytes": 14735, "stream": 653, "flow_id": "flow-5e7579417a1c6a21fa89da4b", "packets": 35, "transport": "tcp", "last_frame": 29470, "first_frame": 23604, "initiator_ip": "192.168.1.95", "responder_ip": "8.39.36.143", "initiator_port": 49809, "responder_port": 443, "initiator_bytes": 5456, "last_seen_epoch": "1533965095.515827", "responder_bytes": 9279, "first_seen_epoch": "1533964997.760765" }, { "bytes": 6245, "stream": 654, "flow_id": "flow-84d1101a63e0bb2fcb883b4d", "packets": 24, "transport": "tcp", "last_frame": 29046, "first_frame": 23629, "initiator_ip": "192.168.1.95", "responder_ip": "52.20.63.23", "initiator_port": 49810, "responder_port": 443, "initiator_bytes": 1670, "last_seen_epoch": "1533965095.222599", "responder_bytes": 4575, "first_seen_epoch": "1533964997.80587" }, { "bytes": 5015, "stream": 655, "flow_id": "flow-9c6424feecb93e3f2c41dba2", "packets": 20, "transport": "tcp", "last_frame": 29049, "first_frame": 23630, "initiator_ip": "192.168.1.95", "responder_ip": "52.20.63.23", "initiator_port": 49811, "responder_port": 443, "initiator_bytes": 975, "last_seen_epoch": "1533965095.222956", "responder_bytes": 4040, "first_seen_epoch": "1533964997.805872" }, { "bytes": 4200, "stream": 656, "flow_id": "flow-a68a5426012feeee2a6ce9c6", "packets": 17, "transport": "tcp", "last_frame": 24364, "first_frame": 23636, "initiator_ip": "192.168.1.95", "responder_ip": "54.196.242.147", "initiator_port": 49812, "responder_port": 443, "initiator_bytes": 1386, "last_seen_epoch": "1533965009.476495", "responder_bytes": 2814, "first_seen_epoch": "1533964997.81269" }, { "bytes": 4111, "stream": 657, "flow_id": "flow-64d3587e5c676e7a5813a51c", "packets": 19, "transport": "tcp", "last_frame": 24366, "first_frame": 23637, "initiator_ip": "192.168.1.95", "responder_ip": "54.196.242.147", "initiator_port": 49813, "responder_port": 443, "initiator_bytes": 1446, "last_seen_epoch": "1533965009.484657", "responder_bytes": 2665, "first_seen_epoch": "1533964997.812691" }, { "bytes": 6409, "stream": 658, "flow_id": "flow-3777889ca0be1acb0887f578", "packets": 19, "transport": "tcp", "last_frame": 29054, "first_frame": 23643, "initiator_ip": "192.168.1.95", "responder_ip": "23.54.21.179", "initiator_port": 49814, "responder_port": 443, "initiator_bytes": 975, "last_seen_epoch": "1533965095.223467", "responder_bytes": 5434, "first_seen_epoch": "1533964997.827407" }, { "bytes": 7465, "stream": 659, "flow_id": "flow-cbe86c216dbd15c6594a091a", "packets": 21, "transport": "tcp", "last_frame": 29378, "first_frame": 23645, "initiator_ip": "192.168.1.95", "responder_ip": "23.54.21.179", "initiator_port": 49815, "responder_port": 443, "initiator_bytes": 1406, "last_seen_epoch": "1533965095.509312", "responder_bytes": 6059, "first_seen_epoch": "1533964997.827639" }, { "bytes": 5626, "stream": 660, "flow_id": "flow-960166335be942accaea286a", "packets": 18, "transport": "tcp", "last_frame": 29039, "first_frame": 23650, "initiator_ip": "192.168.1.95", "responder_ip": "37.157.2.234", "initiator_port": 49816, "responder_port": 443, "initiator_bytes": 899, "last_seen_epoch": "1533965095.221647", "responder_bytes": 4727, "first_seen_epoch": "1533964997.832397" }, { "bytes": 6794, "stream": 661, "flow_id": "flow-aa2c8f97687c9acc23ea1ee0", "packets": 24, "transport": "tcp", "last_frame": 29036, "first_frame": 23652, "initiator_ip": "192.168.1.95", "responder_ip": "37.157.2.234", "initiator_port": 49817, "responder_port": 443, "initiator_bytes": 1558, "last_seen_epoch": "1533965095.221387", "responder_bytes": 5236, "first_seen_epoch": "1533964997.832677" }, { "bytes": 8140, "stream": 662, "flow_id": "flow-ab7f0b12f5de4528344c1361", "packets": 26, "transport": "tcp", "last_frame": 29042, "first_frame": 23690, "initiator_ip": "192.168.1.95", "responder_ip": "52.21.201.75", "initiator_port": 49818, "responder_port": 443, "initiator_bytes": 1684, "last_seen_epoch": "1533965095.221969", "responder_bytes": 6456, "first_seen_epoch": "1533964997.891654" }, { "bytes": 7688, "stream": 663, "flow_id": "flow-a6e8ec0d8b63a3c6d2d5f21f", "packets": 22, "transport": "tcp", "last_frame": 29043, "first_frame": 23691, "initiator_ip": "192.168.1.95", "responder_ip": "52.21.201.75", "initiator_port": 49819, "responder_port": 443, "initiator_bytes": 1484, "last_seen_epoch": "1533965095.222286", "responder_bytes": 6204, "first_seen_epoch": "1533964997.891656" }, { "bytes": 270, "stream": 236, "flow_id": "flow-4b78cb98b2e9a61df001d5af", "packets": 2, "transport": "udp", "last_frame": 23971, "first_frame": 23933, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 64308, "responder_port": 53, "initiator_bytes": 80, "last_seen_epoch": "1533964998.468958", "responder_bytes": 190, "first_seen_epoch": "1533964998.322007" }, { "bytes": 281, "stream": 237, "flow_id": "flow-72d9eafbd5922dac9a683666", "packets": 2, "transport": "udp", "last_frame": 23970, "first_frame": 23938, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 54782, "responder_port": 53, "initiator_bytes": 80, "last_seen_epoch": "1533964998.46879", "responder_bytes": 201, "first_seen_epoch": "1533964998.332011" }, { "bytes": 2523, "stream": 664, "flow_id": "flow-2e61b1e792d8d393ed2488fd", "packets": 12, "transport": "tcp", "last_frame": 28115, "first_frame": 23972, "initiator_ip": "192.168.1.95", "responder_ip": "104.16.240.184", "initiator_port": 49820, "responder_port": 80, "initiator_bytes": 510, "last_seen_epoch": "1533965044.773445", "responder_bytes": 2013, "first_seen_epoch": "1533964998.469747" }, { "bytes": 2469, "stream": 665, "flow_id": "flow-bb0b858b79608f2166e682e3", "packets": 11, "transport": "tcp", "last_frame": 28118, "first_frame": 23973, "initiator_ip": "192.168.1.95", "responder_ip": "104.16.240.184", "initiator_port": 49821, "responder_port": 80, "initiator_bytes": 510, "last_seen_epoch": "1533965044.773927", "responder_bytes": 1959, "first_seen_epoch": "1533964998.470305" }, { "bytes": 4227, "stream": 666, "flow_id": "flow-822a55f2a70ed4d23c93da00", "packets": 16, "transport": "tcp", "last_frame": 29250, "first_frame": 24023, "initiator_ip": "192.168.1.95", "responder_ip": "8.39.36.172", "initiator_port": 49822, "responder_port": 443, "initiator_bytes": 1030, "last_seen_epoch": "1533965095.244676", "responder_bytes": 3197, "first_seen_epoch": "1533964999.377098" }, { "bytes": 6943, "stream": 667, "flow_id": "flow-d69445e3a2907bb99c39bb8d", "packets": 23, "transport": "tcp", "last_frame": 29475, "first_frame": 24024, "initiator_ip": "192.168.1.95", "responder_ip": "8.39.36.172", "initiator_port": 49823, "responder_port": 443, "initiator_bytes": 3001, "last_seen_epoch": "1533965095.516233", "responder_bytes": 3942, "first_seen_epoch": "1533964999.377247" }, { "bytes": 271, "stream": 238, "flow_id": "flow-51e9046b2bac5ff8cc9874db", "packets": 2, "transport": "udp", "last_frame": 24043, "first_frame": 24025, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 57447, "responder_port": 53, "initiator_bytes": 74, "last_seen_epoch": "1533964999.497119", "responder_bytes": 197, "first_seen_epoch": "1533964999.378086" }, { "bytes": 366, "stream": 239, "flow_id": "flow-5adb3f6f0f693460ff9e5030", "packets": 2, "transport": "udp", "last_frame": 24037, "first_frame": 24026, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 51522, "responder_port": 53, "initiator_bytes": 71, "last_seen_epoch": "1533964999.457617", "responder_bytes": 295, "first_seen_epoch": "1533964999.378273" }, { "bytes": 236, "stream": 240, "flow_id": "flow-dc74093b512bf059b03b7881", "packets": 2, "transport": "udp", "last_frame": 24040, "first_frame": 24027, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 60472, "responder_port": 53, "initiator_bytes": 70, "last_seen_epoch": "1533964999.467395", "responder_bytes": 166, "first_seen_epoch": "1533964999.378366" }, { "bytes": 244, "stream": 241, "flow_id": "flow-27b5143b5dd344e6989e3b54", "packets": 2, "transport": "udp", "last_frame": 24044, "first_frame": 24028, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 64173, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1533964999.506406", "responder_bytes": 168, "first_seen_epoch": "1533964999.378484" }, { "bytes": 5959, "stream": 668, "flow_id": "flow-22c8ddf884d62e08c1403480", "packets": 22, "transport": "tcp", "last_frame": 29025, "first_frame": 24038, "initiator_ip": "192.168.1.95", "responder_ip": "54.191.223.36", "initiator_port": 49824, "responder_port": 443, "initiator_bytes": 1720, "last_seen_epoch": "1533965095.220181", "responder_bytes": 4239, "first_seen_epoch": "1533964999.45839" }, { "bytes": 4777, "stream": 669, "flow_id": "flow-3ac09202d5e4b8b338130d7a", "packets": 18, "transport": "tcp", "last_frame": 29028, "first_frame": 24039, "initiator_ip": "192.168.1.95", "responder_ip": "54.191.223.36", "initiator_port": 49825, "responder_port": 443, "initiator_bytes": 913, "last_seen_epoch": "1533965095.220538", "responder_bytes": 3864, "first_seen_epoch": "1533964999.458577" }, { "bytes": 8752, "stream": 670, "flow_id": "flow-277976454f9352ba390c126b", "packets": 24, "transport": "tcp", "last_frame": 29020, "first_frame": 24041, "initiator_ip": "192.168.1.95", "responder_ip": "54.84.105.44", "initiator_port": 49826, "responder_port": 443, "initiator_bytes": 1715, "last_seen_epoch": "1533965095.219738", "responder_bytes": 7037, "first_seen_epoch": "1533964999.468186" }, { "bytes": 8608, "stream": 671, "flow_id": "flow-4b94c68cc15728fdab9d6b86", "packets": 24, "transport": "tcp", "last_frame": 29018, "first_frame": 24042, "initiator_ip": "192.168.1.95", "responder_ip": "54.84.105.44", "initiator_port": 49827, "responder_port": 443, "initiator_bytes": 1891, "last_seen_epoch": "1533965095.219373", "responder_bytes": 6717, "first_seen_epoch": "1533964999.468283" }, { "bytes": 6365, "stream": 672, "flow_id": "flow-82df664acecdf60ef4114b57", "packets": 20, "transport": "tcp", "last_frame": 29388, "first_frame": 24045, "initiator_ip": "192.168.1.95", "responder_ip": "23.55.114.34", "initiator_port": 49829, "responder_port": 443, "initiator_bytes": 1468, "last_seen_epoch": "1533965095.509897", "responder_bytes": 4897, "first_seen_epoch": "1533964999.51303" }, { "bytes": 4959, "stream": 673, "flow_id": "flow-89a5af96480ba4bcee4c1d9e", "packets": 18, "transport": "tcp", "last_frame": 29033, "first_frame": 24046, "initiator_ip": "192.168.1.95", "responder_ip": "23.55.114.34", "initiator_port": 49828, "responder_port": 443, "initiator_bytes": 876, "last_seen_epoch": "1533965095.221054", "responder_bytes": 4083, "first_seen_epoch": "1533964999.513032" }, { "bytes": 5285, "stream": 674, "flow_id": "flow-52d33463ac69929ab111bf44", "packets": 19, "transport": "tcp", "last_frame": 29420, "first_frame": 24047, "initiator_ip": "192.168.1.95", "responder_ip": "104.110.128.239", "initiator_port": 49830, "responder_port": 443, "initiator_bytes": 1508, "last_seen_epoch": "1533965095.512031", "responder_bytes": 3777, "first_seen_epoch": "1533964999.516719" }, { "bytes": 3931, "stream": 675, "flow_id": "flow-0e81b141432556d9a9f980db", "packets": 16, "transport": "tcp", "last_frame": 29014, "first_frame": 24048, "initiator_ip": "192.168.1.95", "responder_ip": "104.110.128.239", "initiator_port": 49831, "responder_port": 443, "initiator_bytes": 818, "last_seen_epoch": "1533965095.21908", "responder_bytes": 3113, "first_seen_epoch": "1533964999.516721" }, { "bytes": 416, "stream": 242, "flow_id": "flow-b1b2c86d7633a999167eae24", "packets": 3, "transport": "udp", "last_frame": 24228, "first_frame": 24211, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 56968, "responder_port": 53, "initiator_bytes": 156, "last_seen_epoch": "1533965001.681775", "responder_bytes": 260, "first_seen_epoch": "1533965000.652945" }, { "bytes": 8521, "stream": 676, "flow_id": "flow-5e5dec2d8a6a778bcad3b8cf", "packets": 26, "transport": "tcp", "last_frame": 29006, "first_frame": 24229, "initiator_ip": "192.168.1.95", "responder_ip": "52.52.136.196", "initiator_port": 49832, "responder_port": 443, "initiator_bytes": 2071, "last_seen_epoch": "1533965095.218187", "responder_bytes": 6450, "first_seen_epoch": "1533965001.683247" }, { "bytes": 6927, "stream": 677, "flow_id": "flow-413918ca3701545987e92309", "packets": 21, "transport": "tcp", "last_frame": 29009, "first_frame": 24230, "initiator_ip": "192.168.1.95", "responder_ip": "52.52.136.196", "initiator_port": 49833, "responder_port": 443, "initiator_bytes": 980, "last_seen_epoch": "1533965095.218477", "responder_bytes": 5947, "first_seen_epoch": "1533965001.688248" }, { "bytes": 4372, "stream": 678, "flow_id": "flow-1f451dab08080871a119407c", "packets": 21, "transport": "tcp", "last_frame": 24460, "first_frame": 24290, "initiator_ip": "192.168.1.95", "responder_ip": "34.213.12.32", "initiator_port": 49834, "responder_port": 443, "initiator_bytes": 3003, "last_seen_epoch": "1533965016.361245", "responder_bytes": 1369, "first_seen_epoch": "1533965002.685784" }, { "bytes": 4413, "stream": 679, "flow_id": "flow-c79191c4deb361ba4c5474de", "packets": 20, "transport": "tcp", "last_frame": 27160, "first_frame": 24408, "initiator_ip": "192.168.1.95", "responder_ip": "104.254.150.77", "initiator_port": 49835, "responder_port": 443, "initiator_bytes": 2477, "last_seen_epoch": "1533965034.833371", "responder_bytes": 1936, "first_seen_epoch": "1533965015.092065" }, { "bytes": 4533, "stream": 680, "flow_id": "flow-4433752d45773ff6ff4c163c", "packets": 22, "transport": "tcp", "last_frame": 27163, "first_frame": 24409, "initiator_ip": "192.168.1.95", "responder_ip": "104.254.150.77", "initiator_port": 49836, "responder_port": 443, "initiator_bytes": 2537, "last_seen_epoch": "1533965034.833866", "responder_bytes": 1996, "first_seen_epoch": "1533965015.093514" }, { "bytes": 4492, "stream": 681, "flow_id": "flow-641f84e056c6b3df3e76f160", "packets": 23, "transport": "tcp", "last_frame": 27934, "first_frame": 24461, "initiator_ip": "192.168.1.95", "responder_ip": "34.213.12.32", "initiator_port": 49837, "responder_port": 443, "initiator_bytes": 3063, "last_seen_epoch": "1533965036.262048", "responder_bytes": 1429, "first_seen_epoch": "1533965016.361246" }, { "bytes": 54534, "stream": 682, "flow_id": "flow-49b260380ac00b46bdfc0f94", "packets": 34, "transport": "tcp", "last_frame": 28735, "first_frame": 24551, "initiator_ip": "192.168.1.95", "responder_ip": "192.229.210.158", "initiator_port": 49838, "responder_port": 443, "initiator_bytes": 1993, "last_seen_epoch": "1533965094.679942", "responder_bytes": 52541, "first_seen_epoch": "1533965019.85068" }, { "bytes": 1799290, "stream": 683, "flow_id": "flow-c8bfd5b6e16621683a6aa10b", "packets": 1486, "transport": "tcp", "last_frame": 28736, "first_frame": 24552, "initiator_ip": "192.168.1.95", "responder_ip": "192.229.210.158", "initiator_port": 49839, "responder_port": 443, "initiator_bytes": 42657, "last_seen_epoch": "1533965094.679944", "responder_bytes": 1756633, "first_seen_epoch": "1533965019.850683" }, { "bytes": 2523, "stream": 684, "flow_id": "flow-3901344eb01c5f939316be08", "packets": 17, "transport": "tcp", "last_frame": 29467, "first_frame": 25029, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.192.2", "initiator_port": 49840, "responder_port": 443, "initiator_bytes": 1301, "last_seen_epoch": "1533965095.515454", "responder_bytes": 1222, "first_seen_epoch": "1533965022.800174" }, { "bytes": 2523, "stream": 685, "flow_id": "flow-0b4bff448f42eaed780885f6", "packets": 17, "transport": "tcp", "last_frame": 29455, "first_frame": 25030, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.192.2", "initiator_port": 49841, "responder_port": 443, "initiator_bytes": 1301, "last_seen_epoch": "1533965095.515014", "responder_bytes": 1222, "first_seen_epoch": "1533965022.800392" }, { "bytes": 8131, "stream": 686, "flow_id": "flow-e9fd42cb5af2feb9d28c5672", "packets": 25, "transport": "tcp", "last_frame": 28729, "first_frame": 26219, "initiator_ip": "192.168.1.95", "responder_ip": "104.254.150.77", "initiator_port": 49842, "responder_port": 443, "initiator_bytes": 5553, "last_seen_epoch": "1533965094.658908", "responder_bytes": 2578, "first_seen_epoch": "1533965030.288007" }, { "bytes": 10030, "stream": 687, "flow_id": "flow-2bee1ac2ac79310d5a6ba072", "packets": 29, "transport": "tcp", "last_frame": 28726, "first_frame": 26221, "initiator_ip": "192.168.1.95", "responder_ip": "104.254.150.77", "initiator_port": 49843, "responder_port": 443, "initiator_bytes": 6857, "last_seen_epoch": "1533965094.658399", "responder_bytes": 3173, "first_seen_epoch": "1533965030.288249" }, { "bytes": 13841, "stream": 688, "flow_id": "flow-9fc7d2356469cf63d1029859", "packets": 30, "transport": "tcp", "last_frame": 29213, "first_frame": 26274, "initiator_ip": "192.168.1.95", "responder_ip": "104.254.150.69", "initiator_port": 49844, "responder_port": 443, "initiator_bytes": 5256, "last_seen_epoch": "1533965095.240283", "responder_bytes": 8585, "first_seen_epoch": "1533965032.298159" }, { "bytes": 15555, "stream": 689, "flow_id": "flow-9a54f61e2d18ff3c85c82253", "packets": 33, "transport": "tcp", "last_frame": 29210, "first_frame": 26276, "initiator_ip": "192.168.1.95", "responder_ip": "104.254.150.69", "initiator_port": 49845, "responder_port": 443, "initiator_bytes": 6531, "last_seen_epoch": "1533965095.239945", "responder_bytes": 9024, "first_seen_epoch": "1533965032.29852" }, { "bytes": 1421, "stream": 690, "flow_id": "flow-4371ffe05c9013b7f9513c7c", "packets": 16, "transport": "tcp", "last_frame": 29200, "first_frame": 26288, "initiator_ip": "192.168.1.95", "responder_ip": "207.244.102.143", "initiator_port": 49846, "responder_port": 443, "initiator_bytes": 799, "last_seen_epoch": "1533965095.238913", "responder_bytes": 622, "first_seen_epoch": "1533965032.301279" }, { "bytes": 2867, "stream": 691, "flow_id": "flow-dc2fd964fc71193fd559a7a2", "packets": 18, "transport": "tcp", "last_frame": 26572, "first_frame": 26289, "initiator_ip": "192.168.1.95", "responder_ip": "207.244.102.143", "initiator_port": 49847, "responder_port": 443, "initiator_bytes": 1434, "last_seen_epoch": "1533965032.952408", "responder_bytes": 1433, "first_seen_epoch": "1533965032.301518" }, { "bytes": 5220, "stream": 692, "flow_id": "flow-08b1686dd298cf83f01be4a8", "packets": 20, "transport": "tcp", "last_frame": 29269, "first_frame": 26332, "initiator_ip": "192.168.1.95", "responder_ip": "69.194.244.11", "initiator_port": 49848, "responder_port": 443, "initiator_bytes": 1531, "last_seen_epoch": "1533965095.247388", "responder_bytes": 3689, "first_seen_epoch": "1533965032.445619" }, { "bytes": 5366, "stream": 693, "flow_id": "flow-44c1dbad126939af11d826dc", "packets": 22, "transport": "tcp", "last_frame": 29272, "first_frame": 26333, "initiator_ip": "192.168.1.95", "responder_ip": "69.194.244.11", "initiator_port": 49849, "responder_port": 443, "initiator_bytes": 1572, "last_seen_epoch": "1533965095.247857", "responder_bytes": 3794, "first_seen_epoch": "1533965032.445879" }, { "bytes": 579, "stream": 243, "flow_id": "flow-acc8d378e5c47ec4eb60cb9b", "packets": 4, "transport": "udp", "last_frame": 35522, "first_frame": 26358, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 49792, "responder_port": 53, "initiator_bytes": 147, "last_seen_epoch": "1533965160.354549", "responder_bytes": 432, "first_seen_epoch": "1533965032.569139" }, { "bytes": 204, "stream": 244, "flow_id": "flow-8517210ec66c83df3723cc44", "packets": 2, "transport": "udp", "last_frame": 26411, "first_frame": 26359, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 63504, "responder_port": 53, "initiator_bytes": 78, "last_seen_epoch": "1533965032.677118", "responder_bytes": 126, "first_seen_epoch": "1533965032.570113" }, { "bytes": 7337, "stream": 694, "flow_id": "flow-f0b1012a9c9008819426ef69", "packets": 21, "transport": "tcp", "last_frame": 29347, "first_frame": 26368, "initiator_ip": "192.168.1.95", "responder_ip": "185.167.164.37", "initiator_port": 49850, "responder_port": 443, "initiator_bytes": 1630, "last_seen_epoch": "1533965095.255806", "responder_bytes": 5707, "first_seen_epoch": "1533965032.573523" }, { "bytes": 6373, "stream": 695, "flow_id": "flow-e2bf616d4f7aa9812c50b200", "packets": 21, "transport": "tcp", "last_frame": 29350, "first_frame": 26369, "initiator_ip": "192.168.1.95", "responder_ip": "185.167.164.37", "initiator_port": 49851, "responder_port": 443, "initiator_bytes": 991, "last_seen_epoch": "1533965095.256126", "responder_bytes": 5382, "first_seen_epoch": "1533965032.573524" }, { "bytes": 245, "stream": 245, "flow_id": "flow-95f276435ad9a53a97bc1a53", "packets": 2, "transport": "udp", "last_frame": 26408, "first_frame": 26370, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 62925, "responder_port": 53, "initiator_bytes": 80, "last_seen_epoch": "1533965032.676936", "responder_bytes": 165, "first_seen_epoch": "1533965032.574941" }, { "bytes": 264, "stream": 246, "flow_id": "flow-f1ba0d350dc7926b7e1b9f9d", "packets": 2, "transport": "udp", "last_frame": 26420, "first_frame": 26371, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 63866, "responder_port": 53, "initiator_bytes": 77, "last_seen_epoch": "1533965032.696494", "responder_bytes": 187, "first_seen_epoch": "1533965032.57651" }, { "bytes": 4467, "stream": 696, "flow_id": "flow-ff90ca9e769327f54f344310", "packets": 19, "transport": "tcp", "last_frame": 29506, "first_frame": 26406, "initiator_ip": "192.168.1.95", "responder_ip": "104.36.113.17", "initiator_port": 49852, "responder_port": 443, "initiator_bytes": 3105, "last_seen_epoch": "1533965095.518657", "responder_bytes": 1362, "first_seen_epoch": "1533965032.664195" }, { "bytes": 4605, "stream": 697, "flow_id": "flow-41902c72ac517691b2a19d79", "packets": 18, "transport": "tcp", "last_frame": 29516, "first_frame": 26407, "initiator_ip": "192.168.1.95", "responder_ip": "104.36.113.17", "initiator_port": 49853, "responder_port": 443, "initiator_bytes": 3057, "last_seen_epoch": "1533965095.519278", "responder_bytes": 1548, "first_seen_epoch": "1533965032.664288" }, { "bytes": 7894, "stream": 698, "flow_id": "flow-5c4fadb361e682235a6b642e", "packets": 24, "transport": "tcp", "last_frame": 28996, "first_frame": 26413, "initiator_ip": "192.168.1.95", "responder_ip": "52.42.116.214", "initiator_port": 49854, "responder_port": 443, "initiator_bytes": 1515, "last_seen_epoch": "1533965095.217109", "responder_bytes": 6379, "first_seen_epoch": "1533965032.677679" }, { "bytes": 7958, "stream": 699, "flow_id": "flow-1c5aebf15ba957f6637a8d78", "packets": 24, "transport": "tcp", "last_frame": 29000, "first_frame": 26415, "initiator_ip": "192.168.1.95", "responder_ip": "52.42.116.214", "initiator_port": 49855, "responder_port": 443, "initiator_bytes": 1499, "last_seen_epoch": "1533965095.217461", "responder_bytes": 6459, "first_seen_epoch": "1533965032.677887" }, { "bytes": 5674, "stream": 700, "flow_id": "flow-24c762c65a18bde4d67d6bfc", "packets": 18, "transport": "tcp", "last_frame": 28994, "first_frame": 26416, "initiator_ip": "192.168.1.95", "responder_ip": "104.24.246.16", "initiator_port": 49856, "responder_port": 443, "initiator_bytes": 906, "last_seen_epoch": "1533965095.216754", "responder_bytes": 4768, "first_seen_epoch": "1533965032.678228" }, { "bytes": 7061, "stream": 701, "flow_id": "flow-1763beb81f1d31f25c6c87d4", "packets": 24, "transport": "tcp", "last_frame": 29404, "first_frame": 26417, "initiator_ip": "192.168.1.95", "responder_ip": "104.24.246.16", "initiator_port": 49857, "responder_port": 443, "initiator_bytes": 1505, "last_seen_epoch": "1533965095.511028", "responder_bytes": 5556, "first_seen_epoch": "1533965032.678338" }, { "bytes": 7529, "stream": 702, "flow_id": "flow-349c34f79cf6bc1e87ecbfe8", "packets": 25, "transport": "tcp", "last_frame": 29389, "first_frame": 26418, "initiator_ip": "192.168.1.95", "responder_ip": "23.73.231.65", "initiator_port": 49858, "responder_port": 443, "initiator_bytes": 1974, "last_seen_epoch": "1533965095.509988", "responder_bytes": 5555, "first_seen_epoch": "1533965032.678846" }, { "bytes": 5813, "stream": 703, "flow_id": "flow-a618b7648ac82edc210c4d4d", "packets": 21, "transport": "tcp", "last_frame": 29400, "first_frame": 26419, "initiator_ip": "192.168.1.95", "responder_ip": "23.73.231.65", "initiator_port": 49859, "responder_port": 443, "initiator_bytes": 1491, "last_seen_epoch": "1533965095.510782", "responder_bytes": 4322, "first_seen_epoch": "1533965032.67897" }, { "bytes": 6778, "stream": 704, "flow_id": "flow-2eced25f04ae0b6ea8b7259e", "packets": 21, "transport": "tcp", "last_frame": 29407, "first_frame": 26421, "initiator_ip": "192.168.1.95", "responder_ip": "151.101.0.166", "initiator_port": 49860, "responder_port": 443, "initiator_bytes": 1506, "last_seen_epoch": "1533965095.511442", "responder_bytes": 5272, "first_seen_epoch": "1533965032.700887" }, { "bytes": 4874, "stream": 705, "flow_id": "flow-8698735218691145722d51a9", "packets": 15, "transport": "tcp", "last_frame": 29406, "first_frame": 26422, "initiator_ip": "192.168.1.95", "responder_ip": "151.101.0.166", "initiator_port": 49861, "responder_port": 443, "initiator_bytes": 799, "last_seen_epoch": "1533965095.511172", "responder_bytes": 4075, "first_seen_epoch": "1533965032.701077" }, { "bytes": 338, "stream": 247, "flow_id": "flow-0ed0e47b34c550daff6faf1e", "packets": 2, "transport": "udp", "last_frame": 26644, "first_frame": 26598, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 57749, "responder_port": 53, "initiator_bytes": 91, "last_seen_epoch": "1533965033.203044", "responder_bytes": 247, "first_seen_epoch": "1533965032.986172" }, { "bytes": 6208, "stream": 706, "flow_id": "flow-e08f1cb2f0c37f04d9606bc0", "packets": 22, "transport": "tcp", "last_frame": 29380, "first_frame": 26645, "initiator_ip": "192.168.1.95", "responder_ip": "152.195.14.112", "initiator_port": 49862, "responder_port": 443, "initiator_bytes": 1664, "last_seen_epoch": "1533965095.509491", "responder_bytes": 4544, "first_seen_epoch": "1533965033.203672" }, { "bytes": 4925, "stream": 707, "flow_id": "flow-11b87661bd70fd12379bfedd", "packets": 18, "transport": "tcp", "last_frame": 28985, "first_frame": 26646, "initiator_ip": "192.168.1.95", "responder_ip": "152.195.14.112", "initiator_port": 49863, "responder_port": 443, "initiator_bytes": 873, "last_seen_epoch": "1533965095.215759", "responder_bytes": 4052, "first_seen_epoch": "1533965033.203711" }, { "bytes": 1318, "stream": 708, "flow_id": "flow-6f5e658def813338eb26c366", "packets": 15, "transport": "tcp", "last_frame": 29489, "first_frame": 26649, "initiator_ip": "192.168.1.95", "responder_ip": "104.36.113.17", "initiator_port": 49864, "responder_port": 443, "initiator_bytes": 743, "last_seen_epoch": "1533965095.517203", "responder_bytes": 575, "first_seen_epoch": "1533965033.210108" }, { "bytes": 4203, "stream": 709, "flow_id": "flow-d2c4767c2912e620a16a1158", "packets": 16, "transport": "tcp", "last_frame": 28112, "first_frame": 26696, "initiator_ip": "192.168.1.95", "responder_ip": "199.38.167.128", "initiator_port": 49865, "responder_port": 443, "initiator_bytes": 1018, "last_seen_epoch": "1533965044.773117", "responder_bytes": 3185, "first_seen_epoch": "1533965033.399586" }, { "bytes": 6073, "stream": 710, "flow_id": "flow-98886f929185b0b0c85db760", "packets": 20, "transport": "tcp", "last_frame": 28113, "first_frame": 26697, "initiator_ip": "192.168.1.95", "responder_ip": "199.38.167.128", "initiator_port": 49866, "responder_port": 443, "initiator_bytes": 1953, "last_seen_epoch": "1533965044.773117", "responder_bytes": 4120, "first_seen_epoch": "1533965033.399873" }, { "bytes": 370, "stream": 248, "flow_id": "flow-42988ba92a9248d2bf2313f2", "packets": 2, "transport": "udp", "last_frame": 26728, "first_frame": 26698, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 58904, "responder_port": 53, "initiator_bytes": 80, "last_seen_epoch": "1533965033.48151", "responder_bytes": 290, "first_seen_epoch": "1533965033.400951" }, { "bytes": 286, "stream": 249, "flow_id": "flow-f4c5403b84cfc948492a9e6c", "packets": 2, "transport": "udp", "last_frame": 26802, "first_frame": 26699, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 51545, "responder_port": 53, "initiator_bytes": 84, "last_seen_epoch": "1533965033.625618", "responder_bytes": 202, "first_seen_epoch": "1533965033.401595" }, { "bytes": 310, "stream": 250, "flow_id": "flow-a7618e86d5ef5d74159fa342", "packets": 2, "transport": "udp", "last_frame": 26727, "first_frame": 26700, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 58467, "responder_port": 53, "initiator_bytes": 74, "last_seen_epoch": "1533965033.48128", "responder_bytes": 236, "first_seen_epoch": "1533965033.402325" }, { "bytes": 166, "stream": 251, "flow_id": "flow-6ca2c2c8f2c845d2d8aed073", "packets": 2, "transport": "udp", "last_frame": 26729, "first_frame": 26701, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 50059, "responder_port": 53, "initiator_bytes": 75, "last_seen_epoch": "1533965033.481704", "responder_bytes": 91, "first_seen_epoch": "1533965033.40278" }, { "bytes": 285, "stream": 252, "flow_id": "flow-5fddff04a111931be1517cf0", "packets": 2, "transport": "udp", "last_frame": 26736, "first_frame": 26702, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 65195, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1533965033.496493", "responder_bytes": 209, "first_seen_epoch": "1533965033.403252" }, { "bytes": 6822, "stream": 711, "flow_id": "flow-d03fc72eab941be629e61cf7", "packets": 21, "transport": "tcp", "last_frame": 29369, "first_frame": 26730, "initiator_ip": "192.168.1.95", "responder_ip": "35.190.74.53", "initiator_port": 49867, "responder_port": 443, "initiator_bytes": 1284, "last_seen_epoch": "1533965095.502873", "responder_bytes": 5538, "first_seen_epoch": "1533965033.483011" }, { "bytes": 7070, "stream": 712, "flow_id": "flow-37e25455ea6e4cf76ab161b2", "packets": 23, "transport": "tcp", "last_frame": 29373, "first_frame": 26731, "initiator_ip": "192.168.1.95", "responder_ip": "35.190.74.53", "initiator_port": 49868, "responder_port": 443, "initiator_bytes": 1452, "last_seen_epoch": "1533965095.503116", "responder_bytes": 5618, "first_seen_epoch": "1533965033.483165" }, { "bytes": 8114, "stream": 713, "flow_id": "flow-c757288172e8e592be2e39c3", "packets": 24, "transport": "tcp", "last_frame": 28979, "first_frame": 26732, "initiator_ip": "192.168.1.95", "responder_ip": "34.236.230.194", "initiator_port": 49869, "responder_port": 443, "initiator_bytes": 1501, "last_seen_epoch": "1533965095.214655", "responder_bytes": 6613, "first_seen_epoch": "1533965033.483449" }, { "bytes": 6872, "stream": 714, "flow_id": "flow-e2aa6fe7b0873289a872ca01", "packets": 19, "transport": "tcp", "last_frame": 28981, "first_frame": 26733, "initiator_ip": "192.168.1.95", "responder_ip": "34.236.230.194", "initiator_port": 49870, "responder_port": 443, "initiator_bytes": 922, "last_seen_epoch": "1533965095.215086", "responder_bytes": 5950, "first_seen_epoch": "1533965033.483543" }, { "bytes": 8497, "stream": 715, "flow_id": "flow-3a099bdece486c355002631e", "packets": 22, "transport": "tcp", "last_frame": 28973, "first_frame": 26734, "initiator_ip": "192.168.1.95", "responder_ip": "54.236.177.89", "initiator_port": 49871, "responder_port": 443, "initiator_bytes": 1451, "last_seen_epoch": "1533965095.213752", "responder_bytes": 7046, "first_seen_epoch": "1533965033.483919" }, { "bytes": 7345, "stream": 716, "flow_id": "flow-87289ef08668f2c7579965a4", "packets": 22, "transport": "tcp", "last_frame": 28976, "first_frame": 26735, "initiator_ip": "192.168.1.95", "responder_ip": "54.236.177.89", "initiator_port": 49872, "responder_port": 443, "initiator_bytes": 976, "last_seen_epoch": "1533965095.214209", "responder_bytes": 6369, "first_seen_epoch": "1533965033.483938" }, { "bytes": 7812, "stream": 717, "flow_id": "flow-562b38ec75e82b110f766a0a", "packets": 20, "transport": "tcp", "last_frame": 28966, "first_frame": 26737, "initiator_ip": "192.168.1.95", "responder_ip": "52.11.229.48", "initiator_port": 49873, "responder_port": 443, "initiator_bytes": 1409, "last_seen_epoch": "1533965095.21293", "responder_bytes": 6403, "first_seen_epoch": "1533965033.497082" }, { "bytes": 7866, "stream": 718, "flow_id": "flow-b43311c5e83661a77236f5a9", "packets": 21, "transport": "tcp", "last_frame": 28963, "first_frame": 26738, "initiator_ip": "192.168.1.95", "responder_ip": "52.11.229.48", "initiator_port": 49874, "responder_port": 443, "initiator_bytes": 1409, "last_seen_epoch": "1533965095.212572", "responder_bytes": 6457, "first_seen_epoch": "1533965033.497167" }, { "bytes": 164, "stream": 253, "flow_id": "flow-a33364a78b5a3e052a710e5d", "packets": 2, "transport": "udp", "last_frame": 26821, "first_frame": 26769, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 64876, "responder_port": 53, "initiator_bytes": 74, "last_seen_epoch": "1533965033.693499", "responder_bytes": 90, "first_seen_epoch": "1533965033.590617" }, { "bytes": 5820, "stream": 719, "flow_id": "flow-95ed0a3671ab9d48306580cf", "packets": 17, "transport": "tcp", "last_frame": 26984, "first_frame": 26807, "initiator_ip": "192.168.1.95", "responder_ip": "205.180.87.204", "initiator_port": 49875, "responder_port": 443, "initiator_bytes": 1249, "last_seen_epoch": "1533965034.037631", "responder_bytes": 4571, "first_seen_epoch": "1533965033.629919" }, { "bytes": 6112, "stream": 720, "flow_id": "flow-1e1c49dddba9dfbb007cf56a", "packets": 21, "transport": "tcp", "last_frame": 27020, "first_frame": 26808, "initiator_ip": "192.168.1.95", "responder_ip": "205.180.87.204", "initiator_port": 49876, "responder_port": 443, "initiator_bytes": 1433, "last_seen_epoch": "1533965034.119881", "responder_bytes": 4679, "first_seen_epoch": "1533965033.630041" }, { "bytes": 7781, "stream": 721, "flow_id": "flow-dbb6101eb14b041de9a24c86", "packets": 21, "transport": "tcp", "last_frame": 29372, "first_frame": 26822, "initiator_ip": "192.168.1.95", "responder_ip": "72.5.64.63", "initiator_port": 49877, "responder_port": 443, "initiator_bytes": 1379, "last_seen_epoch": "1533965095.503081", "responder_bytes": 6402, "first_seen_epoch": "1533965033.69587" }, { "bytes": 8011, "stream": 722, "flow_id": "flow-17ca40af67f11a39c449dc13", "packets": 22, "transport": "tcp", "last_frame": 29375, "first_frame": 26823, "initiator_ip": "192.168.1.95", "responder_ip": "72.5.64.63", "initiator_port": 49878, "responder_port": 443, "initiator_bytes": 1427, "last_seen_epoch": "1533965095.505577", "responder_bytes": 6584, "first_seen_epoch": "1533965033.695976" }, { "bytes": 7092, "stream": 723, "flow_id": "flow-dc4fd27a1da472ea2208f327", "packets": 23, "transport": "tcp", "last_frame": 29179, "first_frame": 26954, "initiator_ip": "192.168.1.95", "responder_ip": "185.167.164.39", "initiator_port": 49879, "responder_port": 443, "initiator_bytes": 2670, "last_seen_epoch": "1533965095.236936", "responder_bytes": 4422, "first_seen_epoch": "1533965033.939872" }, { "bytes": 6316, "stream": 724, "flow_id": "flow-f5c8a400bca7b96e4770eb8f", "packets": 26, "transport": "tcp", "last_frame": 29176, "first_frame": 26956, "initiator_ip": "192.168.1.95", "responder_ip": "185.167.164.39", "initiator_port": 49880, "responder_port": 443, "initiator_bytes": 3189, "last_seen_epoch": "1533965095.236665", "responder_bytes": 3127, "first_seen_epoch": "1533965033.940074" }, { "bytes": 380, "stream": 254, "flow_id": "flow-6bf388ed74f163c397bc3bf4", "packets": 2, "transport": "udp", "last_frame": 27021, "first_frame": 26990, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 56210, "responder_port": 53, "initiator_bytes": 85, "last_seen_epoch": "1533965034.135661", "responder_bytes": 295, "first_seen_epoch": "1533965034.039742" }, { "bytes": 8165, "stream": 725, "flow_id": "flow-c087db6b260febfe74313242", "packets": 23, "transport": "tcp", "last_frame": 28952, "first_frame": 27022, "initiator_ip": "192.168.1.95", "responder_ip": "52.203.231.138", "initiator_port": 49881, "responder_port": 443, "initiator_bytes": 1622, "last_seen_epoch": "1533965095.210959", "responder_bytes": 6543, "first_seen_epoch": "1533965034.136295" }, { "bytes": 6931, "stream": 726, "flow_id": "flow-c9ab6f9a4b8fc16a8192542c", "packets": 20, "transport": "tcp", "last_frame": 28955, "first_frame": 27023, "initiator_ip": "192.168.1.95", "responder_ip": "52.203.231.138", "initiator_port": 49882, "responder_port": 443, "initiator_bytes": 927, "last_seen_epoch": "1533965095.211455", "responder_bytes": 6004, "first_seen_epoch": "1533965034.136381" }, { "bytes": 3360, "stream": 727, "flow_id": "flow-20044e55e97559e2bd187984", "packets": 16, "transport": "tcp", "last_frame": 27543, "first_frame": 27147, "initiator_ip": "192.168.1.95", "responder_ip": "109.232.197.110", "initiator_port": 49884, "responder_port": 443, "initiator_bytes": 1566, "last_seen_epoch": "1533965035.699129", "responder_bytes": 1794, "first_seen_epoch": "1533965034.718755" }, { "bytes": 1198, "stream": 728, "flow_id": "flow-7fe63cb9eb57e2052f111db5", "packets": 13, "transport": "tcp", "last_frame": 29166, "first_frame": 27148, "initiator_ip": "192.168.1.95", "responder_ip": "109.232.197.110", "initiator_port": 49883, "responder_port": 443, "initiator_bytes": 675, "last_seen_epoch": "1533965095.23569", "responder_bytes": 523, "first_seen_epoch": "1533965034.718891" }, { "bytes": 239, "stream": 255, "flow_id": "flow-e91b0d11ddcf6594b87a2824", "packets": 2, "transport": "udp", "last_frame": 27166, "first_frame": 27153, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 58225, "responder_port": 53, "initiator_bytes": 75, "last_seen_epoch": "1533965034.849432", "responder_bytes": 164, "first_seen_epoch": "1533965034.720415" }, { "bytes": 10038, "stream": 729, "flow_id": "flow-06fcadc72f0bf65c2fc3ef7f", "packets": 30, "transport": "tcp", "last_frame": 28196, "first_frame": 27164, "initiator_ip": "192.168.1.95", "responder_ip": "104.254.150.77", "initiator_port": 49885, "responder_port": 443, "initiator_bytes": 4901, "last_seen_epoch": "1533965055.075348", "responder_bytes": 5137, "first_seen_epoch": "1533965034.833867" }, { "bytes": 10753, "stream": 730, "flow_id": "flow-3d5079a010df818fcf7c7a9d", "packets": 32, "transport": "tcp", "last_frame": 28201, "first_frame": 27165, "initiator_ip": "192.168.1.95", "responder_ip": "104.254.150.77", "initiator_port": 49886, "responder_port": 443, "initiator_bytes": 5002, "last_seen_epoch": "1533965055.075743", "responder_bytes": 5751, "first_seen_epoch": "1533965034.834779" }, { "bytes": 5883, "stream": 731, "flow_id": "flow-8e5c0235f0a907ef2e21335a", "packets": 18, "transport": "tcp", "last_frame": 28950, "first_frame": 27167, "initiator_ip": "192.168.1.95", "responder_ip": "185.167.164.37", "initiator_port": 49887, "responder_port": 443, "initiator_bytes": 901, "last_seen_epoch": "1533965095.210472", "responder_bytes": 4982, "first_seen_epoch": "1533965034.85407" }, { "bytes": 7345, "stream": 732, "flow_id": "flow-b7fe910a5322949a1c71d867", "packets": 25, "transport": "tcp", "last_frame": 28946, "first_frame": 27168, "initiator_ip": "192.168.1.95", "responder_ip": "185.167.164.37", "initiator_port": 49888, "responder_port": 443, "initiator_bytes": 1544, "last_seen_epoch": "1533965095.209996", "responder_bytes": 5801, "first_seen_epoch": "1533965034.854202" }, { "bytes": 10394, "stream": 733, "flow_id": "flow-b7da5a295db1b7fef839fce0", "packets": 30, "transport": "tcp", "last_frame": 28203, "first_frame": 27178, "initiator_ip": "192.168.1.95", "responder_ip": "104.254.150.77", "initiator_port": 49889, "responder_port": 443, "initiator_bytes": 4431, "last_seen_epoch": "1533965055.076104", "responder_bytes": 5963, "first_seen_epoch": "1533965034.900505" }, { "bytes": 2412, "stream": 734, "flow_id": "flow-3e9412d2af6e9df28aa3248a", "packets": 15, "transport": "tcp", "last_frame": 27484, "first_frame": 27292, "initiator_ip": "192.168.1.95", "responder_ip": "151.101.2.49", "initiator_port": 49890, "responder_port": 443, "initiator_bytes": 1305, "last_seen_epoch": "1533965035.665708", "responder_bytes": 1107, "first_seen_epoch": "1533965035.295114" }, { "bytes": 1296, "stream": 735, "flow_id": "flow-9a73072a41f396477d0a54f8", "packets": 13, "transport": "tcp", "last_frame": 36803, "first_frame": 27293, "initiator_ip": "192.168.1.95", "responder_ip": "151.101.2.49", "initiator_port": 49891, "responder_port": 443, "initiator_bytes": 702, "last_seen_epoch": "1533965205.193275", "responder_bytes": 594, "first_seen_epoch": "1533965035.30128" }, { "bytes": 267, "stream": 256, "flow_id": "flow-e00f9f5a1439239dd723472e", "packets": 2, "transport": "udp", "last_frame": 27329, "first_frame": 27296, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 64986, "responder_port": 53, "initiator_bytes": 84, "last_seen_epoch": "1533965035.426932", "responder_bytes": 183, "first_seen_epoch": "1533965035.302382" }, { "bytes": 352, "stream": 257, "flow_id": "flow-619201c5d717b42f40b32ff0", "packets": 2, "transport": "udp", "last_frame": 27357, "first_frame": 27300, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 54746, "responder_port": 53, "initiator_bytes": 79, "last_seen_epoch": "1533965035.496495", "responder_bytes": 273, "first_seen_epoch": "1533965035.315723" }, { "bytes": 368, "stream": 258, "flow_id": "flow-ed23eb5315973f8b15c9e9de", "packets": 2, "transport": "udp", "last_frame": 27323, "first_frame": 27302, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 63190, "responder_port": 53, "initiator_bytes": 91, "last_seen_epoch": "1533965035.406624", "responder_bytes": 277, "first_seen_epoch": "1533965035.335814" }, { "bytes": 295, "stream": 259, "flow_id": "flow-5ab2c224e0d4facc4c97913f", "packets": 2, "transport": "udp", "last_frame": 27332, "first_frame": 27303, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 64652, "responder_port": 53, "initiator_bytes": 73, "last_seen_epoch": "1533965035.434545", "responder_bytes": 222, "first_seen_epoch": "1533965035.335816" }, { "bytes": 237, "stream": 260, "flow_id": "flow-7770b519edd32472b5c251e7", "packets": 2, "transport": "udp", "last_frame": 27324, "first_frame": 27304, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 53507, "responder_port": 53, "initiator_bytes": 78, "last_seen_epoch": "1533965035.406855", "responder_bytes": 159, "first_seen_epoch": "1533965035.353563" }, { "bytes": 346, "stream": 261, "flow_id": "flow-a43c222fe78fff8beeee253c", "packets": 2, "transport": "udp", "last_frame": 27339, "first_frame": 27305, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 64924, "responder_port": 53, "initiator_bytes": 78, "last_seen_epoch": "1533965035.445254", "responder_bytes": 268, "first_seen_epoch": "1533965035.353791" }, { "bytes": 281, "stream": 262, "flow_id": "flow-5ceb05b9c679c33c53091976", "packets": 2, "transport": "udp", "last_frame": 27340, "first_frame": 27306, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 60951, "responder_port": 53, "initiator_bytes": 84, "last_seen_epoch": "1533965035.44536", "responder_bytes": 197, "first_seen_epoch": "1533965035.354027" }, { "bytes": 8262, "stream": 736, "flow_id": "flow-48a3a6807acf6205f58d326e", "packets": 25, "transport": "tcp", "last_frame": 36591, "first_frame": 27325, "initiator_ip": "192.168.1.95", "responder_ip": "34.236.123.105", "initiator_port": 49893, "responder_port": 443, "initiator_bytes": 1468, "last_seen_epoch": "1533965205.06653", "responder_bytes": 6794, "first_seen_epoch": "1533965035.407165" }, { "bytes": 7070, "stream": 737, "flow_id": "flow-707fc7bfb62f46185a3b9292", "packets": 21, "transport": "tcp", "last_frame": 36594, "first_frame": 27326, "initiator_ip": "192.168.1.95", "responder_ip": "34.236.123.105", "initiator_port": 49892, "responder_port": 443, "initiator_bytes": 993, "last_seen_epoch": "1533965205.066808", "responder_bytes": 6077, "first_seen_epoch": "1533965035.407236" }, { "bytes": 7396, "stream": 738, "flow_id": "flow-cd994a52913b2c08bdf7a52a", "packets": 23, "transport": "tcp", "last_frame": 36581, "first_frame": 27327, "initiator_ip": "192.168.1.95", "responder_ip": "54.241.31.242", "initiator_port": 49894, "responder_port": 443, "initiator_bytes": 1583, "last_seen_epoch": "1533965205.063729", "responder_bytes": 5813, "first_seen_epoch": "1533965035.407827" }, { "bytes": 7166, "stream": 739, "flow_id": "flow-c1876e4d7af2efce8cecb666", "packets": 22, "transport": "tcp", "last_frame": 36582, "first_frame": 27328, "initiator_ip": "192.168.1.95", "responder_ip": "54.241.31.242", "initiator_port": 49895, "responder_port": 443, "initiator_bytes": 1455, "last_seen_epoch": "1533965205.063976", "responder_bytes": 5711, "first_seen_epoch": "1533965035.408063" }, { "bytes": 7225, "stream": 740, "flow_id": "flow-456aca9c15bbe30a65567c9c", "packets": 21, "transport": "tcp", "last_frame": 36779, "first_frame": 27330, "initiator_ip": "192.168.1.95", "responder_ip": "23.54.22.27", "initiator_port": 49896, "responder_port": 443, "initiator_bytes": 1449, "last_seen_epoch": "1533965205.178675", "responder_bytes": 5776, "first_seen_epoch": "1533965035.427984" }, { "bytes": 6969, "stream": 741, "flow_id": "flow-e2a0f6ccddfcc2de247f3b50", "packets": 21, "transport": "tcp", "last_frame": 36776, "first_frame": 27331, "initiator_ip": "192.168.1.95", "responder_ip": "23.54.22.27", "initiator_port": 49897, "responder_port": 443, "initiator_bytes": 1401, "last_seen_epoch": "1533965205.178572", "responder_bytes": 5568, "first_seen_epoch": "1533965035.428088" }, { "bytes": 8128, "stream": 742, "flow_id": "flow-488075a58b1c178955b31cf2", "packets": 24, "transport": "tcp", "last_frame": 36588, "first_frame": 27333, "initiator_ip": "192.168.1.95", "responder_ip": "52.22.112.153", "initiator_port": 49898, "responder_port": 443, "initiator_bytes": 1526, "last_seen_epoch": "1533965205.066188", "responder_bytes": 6602, "first_seen_epoch": "1533965035.435396" }, { "bytes": 8328, "stream": 743, "flow_id": "flow-99edb05b3406af984a552dae", "packets": 27, "transport": "tcp", "last_frame": 36585, "first_frame": 27334, "initiator_ip": "192.168.1.95", "responder_ip": "52.22.112.153", "initiator_port": 49899, "responder_port": 443, "initiator_bytes": 1634, "last_seen_epoch": "1533965205.066091", "responder_bytes": 6694, "first_seen_epoch": "1533965035.435549" }, { "bytes": 6881, "stream": 744, "flow_id": "flow-fc88394480ae84f758e51b11", "packets": 19, "transport": "tcp", "last_frame": 36574, "first_frame": 27343, "initiator_ip": "192.168.1.95", "responder_ip": "52.58.174.155", "initiator_port": 49900, "responder_port": 443, "initiator_bytes": 980, "last_seen_epoch": "1533965205.062958", "responder_bytes": 5901, "first_seen_epoch": "1533965035.447468" }, { "bytes": 8850, "stream": 745, "flow_id": "flow-83da1b2725b7155b6520f4c5", "packets": 21, "transport": "tcp", "last_frame": 36578, "first_frame": 27345, "initiator_ip": "192.168.1.95", "responder_ip": "54.193.113.6", "initiator_port": 49901, "responder_port": 443, "initiator_bytes": 1401, "last_seen_epoch": "1533965205.063222", "responder_bytes": 7449, "first_seen_epoch": "1533965035.448363" }, { "bytes": 7552, "stream": 746, "flow_id": "flow-e5ded90cd3e069191b929e63", "packets": 19, "transport": "tcp", "last_frame": 36580, "first_frame": 27347, "initiator_ip": "192.168.1.95", "responder_ip": "54.193.113.6", "initiator_port": 49902, "responder_port": 443, "initiator_bytes": 926, "last_seen_epoch": "1533965205.063513", "responder_bytes": 6626, "first_seen_epoch": "1533965035.44986" }, { "bytes": 8119, "stream": 747, "flow_id": "flow-adf0eab4fee6ee67081d9f0d", "packets": 26, "transport": "tcp", "last_frame": 36572, "first_frame": 27350, "initiator_ip": "192.168.1.95", "responder_ip": "52.58.174.155", "initiator_port": 49903, "responder_port": 443, "initiator_bytes": 1591, "last_seen_epoch": "1533965205.062737", "responder_bytes": 6528, "first_seen_epoch": "1533965035.452445" }, { "bytes": 4492, "stream": 748, "flow_id": "flow-0f85ef5a8e91b4c818c50e34", "packets": 16, "transport": "tcp", "last_frame": 36597, "first_frame": 27361, "initiator_ip": "192.168.1.95", "responder_ip": "38.106.34.105", "initiator_port": 49905, "responder_port": 443, "initiator_bytes": 861, "last_seen_epoch": "1533965205.067048", "responder_bytes": 3631, "first_seen_epoch": "1533965035.498711" }, { "bytes": 5744, "stream": 749, "flow_id": "flow-d35008d793d64bd8742e1588", "packets": 21, "transport": "tcp", "last_frame": 28942, "first_frame": 27362, "initiator_ip": "192.168.1.95", "responder_ip": "38.106.34.105", "initiator_port": 49904, "responder_port": 443, "initiator_bytes": 1428, "last_seen_epoch": "1533965095.209425", "responder_bytes": 4316, "first_seen_epoch": "1533965035.498795" }, { "bytes": 176, "stream": 263, "flow_id": "flow-0b4b0a5511b891f751038ed2", "packets": 2, "transport": "udp", "last_frame": 27526, "first_frame": 27451, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 59597, "responder_port": 53, "initiator_bytes": 80, "last_seen_epoch": "1533965035.690931", "responder_bytes": 96, "first_seen_epoch": "1533965035.621107" }, { "bytes": 366, "stream": 264, "flow_id": "flow-eb87897a0d3f49a242d63db4", "packets": 2, "transport": "udp", "last_frame": 27522, "first_frame": 27454, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 59072, "responder_port": 53, "initiator_bytes": 71, "last_seen_epoch": "1533965035.69034", "responder_bytes": 295, "first_seen_epoch": "1533965035.627357" }, { "bytes": 4760, "stream": 750, "flow_id": "flow-adca791b1e1b4f9ebe8d9acc", "packets": 17, "transport": "tcp", "last_frame": 33919, "first_frame": 27455, "initiator_ip": "192.168.1.95", "responder_ip": "74.6.34.27", "initiator_port": 49906, "responder_port": 443, "initiator_bytes": 893, "last_seen_epoch": "1533965157.844353", "responder_bytes": 3867, "first_seen_epoch": "1533965035.628827" }, { "bytes": 7352, "stream": 751, "flow_id": "flow-4ba5455d7d456ce1a3a33cb1", "packets": 24, "transport": "tcp", "last_frame": 29234, "first_frame": 27456, "initiator_ip": "192.168.1.95", "responder_ip": "74.6.34.27", "initiator_port": 49907, "responder_port": 443, "initiator_bytes": 1564, "last_seen_epoch": "1533965095.242788", "responder_bytes": 5788, "first_seen_epoch": "1533965035.631184" }, { "bytes": 321, "stream": 265, "flow_id": "flow-3f4ba3f27809437354cc7365", "packets": 2, "transport": "udp", "last_frame": 27532, "first_frame": 27457, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 61326, "responder_port": 53, "initiator_bytes": 87, "last_seen_epoch": "1533965035.693277", "responder_bytes": 234, "first_seen_epoch": "1533965035.633952" }, { "bytes": 274, "stream": 266, "flow_id": "flow-3558b3be6476234cd1b003e5", "packets": 2, "transport": "udp", "last_frame": 27558, "first_frame": 27458, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 58648, "responder_port": 53, "initiator_bytes": 73, "last_seen_epoch": "1533965035.720501", "responder_bytes": 201, "first_seen_epoch": "1533965035.636894" }, { "bytes": 5132, "stream": 752, "flow_id": "flow-798386858591f9862541d39f", "packets": 19, "transport": "tcp", "last_frame": 36809, "first_frame": 27459, "initiator_ip": "192.168.1.95", "responder_ip": "104.110.128.239", "initiator_port": 49908, "responder_port": 443, "initiator_bytes": 1328, "last_seen_epoch": "1533965205.193726", "responder_bytes": 3804, "first_seen_epoch": "1533965035.639198" }, { "bytes": 4198, "stream": 753, "flow_id": "flow-205531fadebc8f80c97606ae", "packets": 20, "transport": "tcp", "last_frame": 29314, "first_frame": 27460, "initiator_ip": "192.168.1.95", "responder_ip": "104.110.128.239", "initiator_port": 49909, "responder_port": 443, "initiator_bytes": 971, "last_seen_epoch": "1533965095.252331", "responder_bytes": 3227, "first_seen_epoch": "1533965035.639347" }, { "bytes": 280, "stream": 267, "flow_id": "flow-5071eabe348ca42c0c7cc59e", "packets": 2, "transport": "udp", "last_frame": 27573, "first_frame": 27461, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 64038, "responder_port": 53, "initiator_bytes": 81, "last_seen_epoch": "1533965035.747066", "responder_bytes": 199, "first_seen_epoch": "1533965035.641721" }, { "bytes": 170, "stream": 268, "flow_id": "flow-a4882357f666711398b68f04", "packets": 2, "transport": "udp", "last_frame": 27576, "first_frame": 27462, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 56863, "responder_port": 53, "initiator_bytes": 77, "last_seen_epoch": "1533965035.747687", "responder_bytes": 93, "first_seen_epoch": "1533965035.643053" }, { "bytes": 210, "stream": 269, "flow_id": "flow-2949af8957b27be7b7ad981e", "packets": 2, "transport": "udp", "last_frame": 27577, "first_frame": 27493, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 50162, "responder_port": 53, "initiator_bytes": 73, "last_seen_epoch": "1533965035.747708", "responder_bytes": 137, "first_seen_epoch": "1533965035.666698" }, { "bytes": 4777, "stream": 754, "flow_id": "flow-ffa5d46169b68c7bfeac0bcb", "packets": 18, "transport": "tcp", "last_frame": 36564, "first_frame": 27529, "initiator_ip": "192.168.1.95", "responder_ip": "54.148.146.218", "initiator_port": 49910, "responder_port": 443, "initiator_bytes": 913, "last_seen_epoch": "1533965205.062083", "responder_bytes": 3864, "first_seen_epoch": "1533965035.692125" }, { "bytes": 6052, "stream": 755, "flow_id": "flow-a92ea7b9917e3960256dafa4", "packets": 22, "transport": "tcp", "last_frame": 36822, "first_frame": 27535, "initiator_ip": "192.168.1.95", "responder_ip": "185.86.137.43", "initiator_port": 49911, "responder_port": 443, "initiator_bytes": 1404, "last_seen_epoch": "1533965205.317518", "responder_bytes": 4648, "first_seen_epoch": "1533965035.693875" }, { "bytes": 4796, "stream": 756, "flow_id": "flow-23d2676fca5582810c582a77", "packets": 19, "transport": "tcp", "last_frame": 36821, "first_frame": 27536, "initiator_ip": "192.168.1.95", "responder_ip": "185.86.137.43", "initiator_port": 49912, "responder_port": 443, "initiator_bytes": 853, "last_seen_epoch": "1533965205.317452", "responder_bytes": 3943, "first_seen_epoch": "1533965035.69406" }, { "bytes": 7586, "stream": 757, "flow_id": "flow-a2c4a9a205cd06233781ec46", "packets": 19, "transport": "tcp", "last_frame": 36789, "first_frame": 27537, "initiator_ip": "192.168.1.95", "responder_ip": "35.186.202.217", "initiator_port": 49913, "responder_port": 443, "initiator_bytes": 1289, "last_seen_epoch": "1533965205.179179", "responder_bytes": 6297, "first_seen_epoch": "1533965035.694361" }, { "bytes": 6112, "stream": 758, "flow_id": "flow-9a8563490c6868d6c5940f1e", "packets": 16, "transport": "tcp", "last_frame": 36780, "first_frame": 27538, "initiator_ip": "192.168.1.95", "responder_ip": "35.186.202.217", "initiator_port": 49914, "responder_port": 443, "initiator_bytes": 846, "last_seen_epoch": "1533965205.178761", "responder_bytes": 5266, "first_seen_epoch": "1533965035.694363" }, { "bytes": 5911, "stream": 759, "flow_id": "flow-f35527492286fdf1a53254e8", "packets": 22, "transport": "tcp", "last_frame": 36561, "first_frame": 27539, "initiator_ip": "192.168.1.95", "responder_ip": "54.148.146.218", "initiator_port": 49915, "responder_port": 443, "initiator_bytes": 1464, "last_seen_epoch": "1533965205.061871", "responder_bytes": 4447, "first_seen_epoch": "1533965035.694615" }, { "bytes": 5196, "stream": 760, "flow_id": "flow-476955dbf4bae2ae311d228d", "packets": 22, "transport": "tcp", "last_frame": 29149, "first_frame": 27544, "initiator_ip": "192.168.1.95", "responder_ip": "34.237.234.13", "initiator_port": 49916, "responder_port": 443, "initiator_bytes": 2461, "last_seen_epoch": "1533965095.234163", "responder_bytes": 2735, "first_seen_epoch": "1533965035.700254" }, { "bytes": 1484, "stream": 761, "flow_id": "flow-687771157c697cbc0bc866c6", "packets": 16, "transport": "tcp", "last_frame": 29152, "first_frame": 27545, "initiator_ip": "192.168.1.95", "responder_ip": "34.237.234.13", "initiator_port": 49917, "responder_port": 443, "initiator_bytes": 822, "last_seen_epoch": "1533965095.234469", "responder_bytes": 662, "first_seen_epoch": "1533965035.700255" }, { "bytes": 6566, "stream": 762, "flow_id": "flow-ec1c03a4ca6e34fbd495fedd", "packets": 20, "transport": "tcp", "last_frame": 36554, "first_frame": 27566, "initiator_ip": "192.168.1.95", "responder_ip": "34.198.191.149", "initiator_port": 49918, "responder_port": 443, "initiator_bytes": 975, "last_seen_epoch": "1533965205.06126", "responder_bytes": 5591, "first_seen_epoch": "1533965035.727015" }, { "bytes": 7474, "stream": 763, "flow_id": "flow-166c91afa7257251f4b2b9a9", "packets": 22, "transport": "tcp", "last_frame": 36549, "first_frame": 27567, "initiator_ip": "192.168.1.95", "responder_ip": "34.198.191.149", "initiator_port": 49919, "responder_port": 443, "initiator_bytes": 1434, "last_seen_epoch": "1533965205.061017", "responder_bytes": 6040, "first_seen_epoch": "1533965035.72721" }, { "bytes": 6104, "stream": 764, "flow_id": "flow-2a43362256d630fa080f3cdb", "packets": 22, "transport": "tcp", "last_frame": 28936, "first_frame": 27588, "initiator_ip": "192.168.1.95", "responder_ip": "5.39.44.195", "initiator_port": 49920, "responder_port": 443, "initiator_bytes": 1450, "last_seen_epoch": "1533965095.208127", "responder_bytes": 4654, "first_seen_epoch": "1533965035.750093" }, { "bytes": 6351, "stream": 765, "flow_id": "flow-300fff60fcee6a5694f4e3c8", "packets": 23, "transport": "tcp", "last_frame": 27874, "first_frame": 27589, "initiator_ip": "192.168.1.95", "responder_ip": "205.180.87.204", "initiator_port": 49921, "responder_port": 443, "initiator_bytes": 1522, "last_seen_epoch": "1533965036.127055", "responder_bytes": 4829, "first_seen_epoch": "1533965035.750536" }, { "bytes": 6280, "stream": 766, "flow_id": "flow-6b8c91ab6a26dc1b5012af1e", "packets": 22, "transport": "tcp", "last_frame": 28933, "first_frame": 27590, "initiator_ip": "192.168.1.95", "responder_ip": "5.39.44.195", "initiator_port": 49922, "responder_port": 443, "initiator_bytes": 1498, "last_seen_epoch": "1533965095.207627", "responder_bytes": 4782, "first_seen_epoch": "1533965035.750694" }, { "bytes": 6227, "stream": 767, "flow_id": "flow-aeb2d5c79bf6fec7746e8e2b", "packets": 22, "transport": "tcp", "last_frame": 27918, "first_frame": 27591, "initiator_ip": "192.168.1.95", "responder_ip": "205.180.87.204", "initiator_port": 49923, "responder_port": 443, "initiator_bytes": 1494, "last_seen_epoch": "1533965036.218732", "responder_bytes": 4733, "first_seen_epoch": "1533965035.750839" }, { "bytes": 6869, "stream": 768, "flow_id": "flow-f67b3468bbf5418d32346946", "packets": 20, "transport": "tcp", "last_frame": 36548, "first_frame": 27599, "initiator_ip": "192.168.1.95", "responder_ip": "38.106.10.132", "initiator_port": 49924, "responder_port": 443, "initiator_bytes": 979, "last_seen_epoch": "1533965205.060748", "responder_bytes": 5890, "first_seen_epoch": "1533965035.759295" }, { "bytes": 8247, "stream": 769, "flow_id": "flow-fcd724a5ec4946f94fd3102e", "packets": 23, "transport": "tcp", "last_frame": 28939, "first_frame": 27601, "initiator_ip": "192.168.1.95", "responder_ip": "38.106.10.132", "initiator_port": 49925, "responder_port": 443, "initiator_bytes": 1438, "last_seen_epoch": "1533965095.208682", "responder_bytes": 6809, "first_seen_epoch": "1533965035.760005" }, { "bytes": 347, "stream": 270, "flow_id": "flow-ed68e5ca4f4b97f36c1de515", "packets": 2, "transport": "udp", "last_frame": 27927, "first_frame": 27879, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 65108, "responder_port": 53, "initiator_bytes": 77, "last_seen_epoch": "1533965036.249006", "responder_bytes": 270, "first_seen_epoch": "1533965036.16631" }, { "bytes": 6617, "stream": 770, "flow_id": "flow-731de6d8faedc7a22eb5f035", "packets": 24, "transport": "tcp", "last_frame": 28927, "first_frame": 27930, "initiator_ip": "192.168.1.95", "responder_ip": "54.187.167.76", "initiator_port": 49926, "responder_port": 443, "initiator_bytes": 1642, "last_seen_epoch": "1533965095.206285", "responder_bytes": 4975, "first_seen_epoch": "1533965036.25643" }, { "bytes": 4896, "stream": 771, "flow_id": "flow-c5182c4352f9ab9cc3b3fc2d", "packets": 20, "transport": "tcp", "last_frame": 28930, "first_frame": 27931, "initiator_ip": "192.168.1.95", "responder_ip": "54.187.167.76", "initiator_port": 49927, "responder_port": 443, "initiator_bytes": 979, "last_seen_epoch": "1533965095.207013", "responder_bytes": 3917, "first_seen_epoch": "1533965036.256601" }, { "bytes": 4492, "stream": 772, "flow_id": "flow-0b0543b2cd0747cf2e44a396", "packets": 23, "transport": "tcp", "last_frame": 28260, "first_frame": 27935, "initiator_ip": "192.168.1.95", "responder_ip": "34.213.12.32", "initiator_port": 49928, "responder_port": 443, "initiator_bytes": 3063, "last_seen_epoch": "1533965056.387156", "responder_bytes": 1429, "first_seen_epoch": "1533965036.26224" }, { "bytes": 318, "stream": 271, "flow_id": "flow-70fc686061acc6991f8fbac9", "packets": 2, "transport": "udp", "last_frame": 27995, "first_frame": 27969, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 53210, "responder_port": 53, "initiator_bytes": 90, "last_seen_epoch": "1533965036.569468", "responder_bytes": 228, "first_seen_epoch": "1533965036.476052" }, { "bytes": 329, "stream": 272, "flow_id": "flow-8a58e5e445aa4639323421cd", "packets": 2, "transport": "udp", "last_frame": 27994, "first_frame": 27970, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 49213, "responder_port": 53, "initiator_bytes": 90, "last_seen_epoch": "1533965036.569466", "responder_bytes": 239, "first_seen_epoch": "1533965036.476055" }, { "bytes": 2026, "stream": 773, "flow_id": "flow-3f8b1d55452612a25e6b8a59", "packets": 8, "transport": "tcp", "last_frame": 29650, "first_frame": 27996, "initiator_ip": "192.168.1.95", "responder_ip": "13.107.4.50", "initiator_port": 49929, "responder_port": 80, "initiator_bytes": 514, "last_seen_epoch": "1533965096.955478", "responder_bytes": 1512, "first_seen_epoch": "1533965036.570975" }, { "bytes": 2026, "stream": 774, "flow_id": "flow-0b4df5bdb40812e43125b59f", "packets": 8, "transport": "tcp", "last_frame": 29651, "first_frame": 27997, "initiator_ip": "192.168.1.95", "responder_ip": "13.107.4.50", "initiator_port": 49930, "responder_port": 80, "initiator_bytes": 514, "last_seen_epoch": "1533965096.955614", "responder_bytes": 1512, "first_seen_epoch": "1533965036.570977" }, { "bytes": 2026, "stream": 775, "flow_id": "flow-638ec68470f4289d98b6be63", "packets": 8, "transport": "tcp", "last_frame": 29652, "first_frame": 28004, "initiator_ip": "192.168.1.95", "responder_ip": "13.107.4.50", "initiator_port": 49931, "responder_port": 80, "initiator_bytes": 514, "last_seen_epoch": "1533965096.955615", "responder_bytes": 1512, "first_seen_epoch": "1533965036.627959" }, { "bytes": 2026, "stream": 776, "flow_id": "flow-627397399219addaf6fd2c6b", "packets": 8, "transport": "tcp", "last_frame": 29653, "first_frame": 28009, "initiator_ip": "192.168.1.95", "responder_ip": "13.107.4.50", "initiator_port": 49932, "responder_port": 80, "initiator_bytes": 514, "last_seen_epoch": "1533965096.955615", "responder_bytes": 1512, "first_seen_epoch": "1533965036.659976" }, { "bytes": 4613, "stream": 777, "flow_id": "flow-3e34a8be25b6643bf0d7c237", "packets": 20, "transport": "tcp", "last_frame": 28456, "first_frame": 28202, "initiator_ip": "192.168.1.95", "responder_ip": "104.254.150.77", "initiator_port": 49933, "responder_port": 443, "initiator_bytes": 2677, "last_seen_epoch": "1533965075.760652", "responder_bytes": 1936, "first_seen_epoch": "1533965055.075744" }, { "bytes": 4733, "stream": 778, "flow_id": "flow-c4bbee14e592b509843dc29a", "packets": 22, "transport": "tcp", "last_frame": 28453, "first_frame": 28204, "initiator_ip": "192.168.1.95", "responder_ip": "104.254.150.77", "initiator_port": 49934, "responder_port": 443, "initiator_bytes": 2737, "last_seen_epoch": "1533965075.760084", "responder_bytes": 1996, "first_seen_epoch": "1533965055.076575" }, { "bytes": 4492, "stream": 779, "flow_id": "flow-661875117b04d5e6029d53dd", "packets": 23, "transport": "tcp", "last_frame": 28497, "first_frame": 28261, "initiator_ip": "192.168.1.95", "responder_ip": "34.213.12.32", "initiator_port": 49935, "responder_port": 443, "initiator_bytes": 3063, "last_seen_epoch": "1533965076.721842", "responder_bytes": 1429, "first_seen_epoch": "1533965056.387468" }, { "bytes": 4733, "stream": 780, "flow_id": "flow-79c42b33433862dd3b8efee1", "packets": 22, "transport": "tcp", "last_frame": 28589, "first_frame": 28457, "initiator_ip": "192.168.1.95", "responder_ip": "104.254.150.77", "initiator_port": 49936, "responder_port": 443, "initiator_bytes": 2737, "last_seen_epoch": "1533965090.024997", "responder_bytes": 1996, "first_seen_epoch": "1533965075.760754" }, { "bytes": 4734, "stream": 781, "flow_id": "flow-32b194a81cc5b6a7dbb1b1d9", "packets": 22, "transport": "tcp", "last_frame": 28586, "first_frame": 28458, "initiator_ip": "192.168.1.95", "responder_ip": "104.254.150.77", "initiator_port": 49937, "responder_port": 443, "initiator_bytes": 2737, "last_seen_epoch": "1533965090.024594", "responder_bytes": 1997, "first_seen_epoch": "1533965075.761525" }, { "bytes": 4372, "stream": 782, "flow_id": "flow-6fe38df7f9ad9623ac472b09", "packets": 21, "transport": "tcp", "last_frame": 28642, "first_frame": 28498, "initiator_ip": "192.168.1.95", "responder_ip": "34.213.12.32", "initiator_port": 49938, "responder_port": 443, "initiator_bytes": 3003, "last_seen_epoch": "1533965091.363122", "responder_bytes": 1369, "first_seen_epoch": "1533965076.72206" }, { "bytes": 14937, "stream": 783, "flow_id": "flow-c2860c1afadd02c7e9795a58", "packets": 35, "transport": "tcp", "last_frame": 32560, "first_frame": 28590, "initiator_ip": "192.168.1.95", "responder_ip": "104.254.150.77", "initiator_port": 49939, "responder_port": 443, "initiator_bytes": 7442, "last_seen_epoch": "1533965130.494641", "responder_bytes": 7495, "first_seen_epoch": "1533965090.025014" }, { "bytes": 4733, "stream": 784, "flow_id": "flow-9506c4362180259c3bd194c6", "packets": 22, "transport": "tcp", "last_frame": 32151, "first_frame": 28591, "initiator_ip": "192.168.1.95", "responder_ip": "104.254.150.77", "initiator_port": 49940, "responder_port": 443, "initiator_bytes": 2737, "last_seen_epoch": "1533965101.704296", "responder_bytes": 1996, "first_seen_epoch": "1533965090.027674" }, { "bytes": 4492, "stream": 785, "flow_id": "flow-bfbd2f23976f861ee7453f85", "packets": 23, "transport": "tcp", "last_frame": 32425, "first_frame": 28643, "initiator_ip": "192.168.1.95", "responder_ip": "34.213.12.32", "initiator_port": 49941, "responder_port": 443, "initiator_bytes": 3063, "last_seen_epoch": "1533965111.322988", "responder_bytes": 1429, "first_seen_epoch": "1533965091.363493" }, { "bytes": 6102, "stream": 786, "flow_id": "flow-969c22fe6bedb6ba66f71fd5", "packets": 20, "transport": "tcp", "last_frame": 33624, "first_frame": 28715, "initiator_ip": "192.168.1.95", "responder_ip": "13.33.78.101", "initiator_port": 49942, "responder_port": 443, "initiator_bytes": 990, "last_seen_epoch": "1533965156.923878", "responder_bytes": 5112, "first_seen_epoch": "1533965094.602074" }, { "bytes": 31495, "stream": 787, "flow_id": "flow-74514b5c7704b8f171170578", "packets": 38, "transport": "tcp", "last_frame": 33668, "first_frame": 28716, "initiator_ip": "192.168.1.95", "responder_ip": "13.33.78.101", "initiator_port": 49943, "responder_port": 443, "initiator_bytes": 1993, "last_seen_epoch": "1533965157.319242", "responder_bytes": 29502, "first_seen_epoch": "1533965094.602398" }, { "bytes": 1714449, "stream": 788, "flow_id": "flow-4fa04e2e93c11778a1f40aff", "packets": 1236, "transport": "tcp", "last_frame": 33660, "first_frame": 28720, "initiator_ip": "192.168.1.95", "responder_ip": "192.229.210.158", "initiator_port": 49945, "responder_port": 443, "initiator_bytes": 36303, "last_seen_epoch": "1533965157.051319", "responder_bytes": 1678146, "first_seen_epoch": "1533965094.617374" }, { "bytes": 152619, "stream": 789, "flow_id": "flow-4a09cd7154b7ed9d8bbf110e", "packets": 130, "transport": "tcp", "last_frame": 29608, "first_frame": 28721, "initiator_ip": "192.168.1.95", "responder_ip": "192.229.210.158", "initiator_port": 49944, "responder_port": 443, "initiator_bytes": 4925, "last_seen_epoch": "1533965096.82076", "responder_bytes": 147694, "first_seen_epoch": "1533965094.617375" }, { "bytes": 7606, "stream": 790, "flow_id": "flow-f60cc6639a9b4dbbd0b16768", "packets": 25, "transport": "tcp", "last_frame": 33593, "first_frame": 28728, "initiator_ip": "192.168.1.95", "responder_ip": "104.254.150.77", "initiator_port": 49946, "responder_port": 443, "initiator_bytes": 5143, "last_seen_epoch": "1533965155.398944", "responder_bytes": 2463, "first_seen_epoch": "1533965094.658799" }, { "bytes": 7374, "stream": 791, "flow_id": "flow-9f6492a5ab60e91be6a44bb1", "packets": 26, "transport": "tcp", "last_frame": 33589, "first_frame": 28730, "initiator_ip": "192.168.1.95", "responder_ip": "104.254.150.77", "initiator_port": 49947, "responder_port": 443, "initiator_bytes": 5025, "last_seen_epoch": "1533965155.398557", "responder_bytes": 2349, "first_seen_epoch": "1533965094.658997" }, { "bytes": 7513, "stream": 792, "flow_id": "flow-641e2eb80918f5e3b0897c9d", "packets": 22, "transport": "tcp", "last_frame": 34397, "first_frame": 29582, "initiator_ip": "192.168.1.95", "responder_ip": "185.167.164.39", "initiator_port": 49948, "responder_port": 443, "initiator_bytes": 1658, "last_seen_epoch": "1533965158.316545", "responder_bytes": 5855, "first_seen_epoch": "1533965096.730754" }, { "bytes": 7633, "stream": 793, "flow_id": "flow-afc4a41818c47a517b815275", "packets": 24, "transport": "tcp", "last_frame": 34394, "first_frame": 29583, "initiator_ip": "192.168.1.95", "responder_ip": "185.167.164.39", "initiator_port": 49949, "responder_port": 443, "initiator_bytes": 1718, "last_seen_epoch": "1533965158.316201", "responder_bytes": 5915, "first_seen_epoch": "1533965096.730757" }, { "bytes": 16246, "stream": 794, "flow_id": "flow-f726bd475f8a36980cd6ca4e", "packets": 43, "transport": "tcp", "last_frame": 39391, "first_frame": 29597, "initiator_ip": "192.168.1.95", "responder_ip": "52.44.165.199", "initiator_port": 49951, "responder_port": 443, "initiator_bytes": 4560, "last_seen_epoch": "1533965249.299943", "responder_bytes": 11686, "first_seen_epoch": "1533965096.81693" }, { "bytes": 16308, "stream": 795, "flow_id": "flow-df4d166fedb4195c29d85144", "packets": 41, "transport": "tcp", "last_frame": 39403, "first_frame": 29598, "initiator_ip": "192.168.1.95", "responder_ip": "52.44.165.199", "initiator_port": 49950, "responder_port": 443, "initiator_bytes": 4692, "last_seen_epoch": "1533965249.301136", "responder_bytes": 11616, "first_seen_epoch": "1533965096.816932" }, { "bytes": 6766, "stream": 796, "flow_id": "flow-fda279d7284325c34dd86654", "packets": 24, "transport": "tcp", "last_frame": 33688, "first_frame": 29723, "initiator_ip": "192.168.1.95", "responder_ip": "104.254.150.69", "initiator_port": 49952, "responder_port": 443, "initiator_bytes": 3478, "last_seen_epoch": "1533965157.355254", "responder_bytes": 3288, "first_seen_epoch": "1533965097.458299" }, { "bytes": 12285, "stream": 797, "flow_id": "flow-b6343eef1cd7c3953bcbb212", "packets": 30, "transport": "tcp", "last_frame": 33691, "first_frame": 29724, "initiator_ip": "192.168.1.95", "responder_ip": "104.254.150.69", "initiator_port": 49953, "responder_port": 443, "initiator_bytes": 4629, "last_seen_epoch": "1533965157.355673", "responder_bytes": 7656, "first_seen_epoch": "1533965097.458457" }, { "bytes": 2423, "stream": 798, "flow_id": "flow-e3501e5cbaf8e2942e7293da", "packets": 20, "transport": "tcp", "last_frame": 36675, "first_frame": 29727, "initiator_ip": "192.168.1.95", "responder_ip": "52.26.87.58", "initiator_port": 49954, "responder_port": 443, "initiator_bytes": 1402, "last_seen_epoch": "1533965205.073968", "responder_bytes": 1021, "first_seen_epoch": "1533965097.460872" }, { "bytes": 2303, "stream": 799, "flow_id": "flow-9e2fc9af0ffecc474d38dd9c", "packets": 18, "transport": "tcp", "last_frame": 39420, "first_frame": 29728, "initiator_ip": "192.168.1.95", "responder_ip": "52.26.87.58", "initiator_port": 49955, "responder_port": 443, "initiator_bytes": 1342, "last_seen_epoch": "1533965249.302863", "responder_bytes": 961, "first_seen_epoch": "1533965097.46101" }, { "bytes": 9316, "stream": 800, "flow_id": "flow-fe59e8cb5ef75c0145628fe9", "packets": 24, "transport": "tcp", "last_frame": 39419, "first_frame": 29729, "initiator_ip": "192.168.1.95", "responder_ip": "8.41.222.241", "initiator_port": 49956, "responder_port": 443, "initiator_bytes": 2339, "last_seen_epoch": "1533965249.302643", "responder_bytes": 6977, "first_seen_epoch": "1533965097.461823" }, { "bytes": 9094, "stream": 801, "flow_id": "flow-06d7f5fc9f9f102121802278", "packets": 26, "transport": "tcp", "last_frame": 39417, "first_frame": 29730, "initiator_ip": "192.168.1.95", "responder_ip": "8.41.222.241", "initiator_port": 49957, "responder_port": 443, "initiator_bytes": 2543, "last_seen_epoch": "1533965249.302551", "responder_bytes": 6551, "first_seen_epoch": "1533965097.461934" }, { "bytes": 550, "stream": 802, "flow_id": "flow-63b1870fa01060d695739947", "packets": 6, "transport": "tcp", "last_frame": 32314, "first_frame": 29731, "initiator_ip": "192.168.1.95", "responder_ip": "207.244.102.143", "initiator_port": 49958, "responder_port": 443, "initiator_bytes": 370, "last_seen_epoch": "1533965107.407289", "responder_bytes": 180, "first_seen_epoch": "1533965097.462845" }, { "bytes": 2759, "stream": 803, "flow_id": "flow-ce7bef7faad1eb16625baa47", "packets": 16, "transport": "tcp", "last_frame": 32269, "first_frame": 29732, "initiator_ip": "192.168.1.95", "responder_ip": "207.244.102.143", "initiator_port": 49959, "responder_port": 443, "initiator_bytes": 1380, "last_seen_epoch": "1533965106.375284", "responder_bytes": 1379, "first_seen_epoch": "1533965097.4631" }, { "bytes": 5685, "stream": 804, "flow_id": "flow-eac513f4530d7f8d28206206", "packets": 21, "transport": "tcp", "last_frame": 39421, "first_frame": 29733, "initiator_ip": "192.168.1.95", "responder_ip": "54.186.116.83", "initiator_port": 49960, "responder_port": 443, "initiator_bytes": 2485, "last_seen_epoch": "1533965249.30295", "responder_bytes": 3200, "first_seen_epoch": "1533965097.463931" }, { "bytes": 5033, "stream": 805, "flow_id": "flow-40ce64b9bb7aeabed4f1ae45", "packets": 19, "transport": "tcp", "last_frame": 36707, "first_frame": 29734, "initiator_ip": "192.168.1.95", "responder_ip": "54.186.116.83", "initiator_port": 49961, "responder_port": 443, "initiator_bytes": 2010, "last_seen_epoch": "1533965205.076905", "responder_bytes": 3023, "first_seen_epoch": "1533965097.464129" }, { "bytes": 5476, "stream": 806, "flow_id": "flow-013082d8a39f20ca75fa3fac", "packets": 26, "transport": "tcp", "last_frame": 39406, "first_frame": 29738, "initiator_ip": "192.168.1.95", "responder_ip": "54.183.95.126", "initiator_port": 49962, "responder_port": 443, "initiator_bytes": 2973, "last_seen_epoch": "1533965249.301571", "responder_bytes": 2503, "first_seen_epoch": "1533965097.472154" }, { "bytes": 4486, "stream": 807, "flow_id": "flow-13df2a82ec64da4b272ac48b", "packets": 22, "transport": "tcp", "last_frame": 39414, "first_frame": 29739, "initiator_ip": "192.168.1.95", "responder_ip": "54.183.95.126", "initiator_port": 49963, "responder_port": 443, "initiator_bytes": 2342, "last_seen_epoch": "1533965249.302371", "responder_bytes": 2144, "first_seen_epoch": "1533965097.472249" }, { "bytes": 6543, "stream": 808, "flow_id": "flow-59c670837db8aba2363c1862", "packets": 20, "transport": "tcp", "last_frame": 36815, "first_frame": 29744, "initiator_ip": "192.168.1.95", "responder_ip": "104.36.113.23", "initiator_port": 49965, "responder_port": 443, "initiator_bytes": 3341, "last_seen_epoch": "1533965205.197736", "responder_bytes": 3202, "first_seen_epoch": "1533965097.49802" }, { "bytes": 6075, "stream": 809, "flow_id": "flow-5951f5c8bf9ee197e7b37ca4", "packets": 17, "transport": "tcp", "last_frame": 39429, "first_frame": 29745, "initiator_ip": "192.168.1.95", "responder_ip": "104.36.113.23", "initiator_port": 49964, "responder_port": 443, "initiator_bytes": 3425, "last_seen_epoch": "1533965249.303903", "responder_bytes": 2650, "first_seen_epoch": "1533965097.498022" }, { "bytes": 7603, "stream": 810, "flow_id": "flow-00ff93cfe446de33651d5b7d", "packets": 24, "transport": "tcp", "last_frame": 36818, "first_frame": 30079, "initiator_ip": "192.168.1.95", "responder_ip": "208.185.50.80", "initiator_port": 49966, "responder_port": 443, "initiator_bytes": 3405, "last_seen_epoch": "1533965205.243195", "responder_bytes": 4198, "first_seen_epoch": "1533965097.987178" }, { "bytes": 7847, "stream": 811, "flow_id": "flow-05c366897fe505f271327ff7", "packets": 24, "transport": "tcp", "last_frame": 39431, "first_frame": 30080, "initiator_ip": "192.168.1.95", "responder_ip": "208.185.50.80", "initiator_port": 49967, "responder_port": 443, "initiator_bytes": 3661, "last_seen_epoch": "1533965249.304452", "responder_bytes": 4186, "first_seen_epoch": "1533965097.987322" }, { "bytes": 6243, "stream": 812, "flow_id": "flow-c4508f182a6f034093ea20f1", "packets": 24, "transport": "tcp", "last_frame": 36712, "first_frame": 30384, "initiator_ip": "192.168.1.95", "responder_ip": "52.9.78.114", "initiator_port": 49968, "responder_port": 443, "initiator_bytes": 1550, "last_seen_epoch": "1533965205.077298", "responder_bytes": 4693, "first_seen_epoch": "1533965098.613451" }, { "bytes": 5125, "stream": 813, "flow_id": "flow-cebd95ebd626ae6739ad3b99", "packets": 20, "transport": "tcp", "last_frame": 36715, "first_frame": 30385, "initiator_ip": "192.168.1.95", "responder_ip": "52.9.78.114", "initiator_port": 49969, "responder_port": 443, "initiator_bytes": 1015, "last_seen_epoch": "1533965205.077597", "responder_bytes": 4110, "first_seen_epoch": "1533965098.613592" }, { "bytes": 6297, "stream": 814, "flow_id": "flow-7614101c03fc987bbe303977", "packets": 22, "transport": "tcp", "last_frame": 36626, "first_frame": 30387, "initiator_ip": "192.168.1.95", "responder_ip": "54.69.70.7", "initiator_port": 49970, "responder_port": 443, "initiator_bytes": 1072, "last_seen_epoch": "1533965205.06962", "responder_bytes": 5225, "first_seen_epoch": "1533965098.615101" }, { "bytes": 7525, "stream": 815, "flow_id": "flow-a792c877f006657001d691b5", "packets": 24, "transport": "tcp", "last_frame": 36623, "first_frame": 30388, "initiator_ip": "192.168.1.95", "responder_ip": "54.69.70.7", "initiator_port": 49971, "responder_port": 443, "initiator_bytes": 1627, "last_seen_epoch": "1533965205.069408", "responder_bytes": 5898, "first_seen_epoch": "1533965098.615302" }, { "bytes": 282, "stream": 273, "flow_id": "flow-c93888299d4ab249f70261ef", "packets": 2, "transport": "udp", "last_frame": 30652, "first_frame": 30390, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 50453, "responder_port": 53, "initiator_bytes": 77, "last_seen_epoch": "1533965099.045919", "responder_bytes": 205, "first_seen_epoch": "1533965098.616151" }, { "bytes": 8089, "stream": 816, "flow_id": "flow-6112cab9e02f58ff0315f45e", "packets": 21, "transport": "tcp", "last_frame": 36795, "first_frame": 30391, "initiator_ip": "192.168.1.95", "responder_ip": "204.11.109.68", "initiator_port": 49973, "responder_port": 443, "initiator_bytes": 1859, "last_seen_epoch": "1533965205.179526", "responder_bytes": 6230, "first_seen_epoch": "1533965098.617156" }, { "bytes": 6621, "stream": 817, "flow_id": "flow-3c77da2f7a0ab5a52dc7fb85", "packets": 19, "transport": "tcp", "last_frame": 36531, "first_frame": 30392, "initiator_ip": "192.168.1.95", "responder_ip": "204.11.109.68", "initiator_port": 49972, "responder_port": 443, "initiator_bytes": 1144, "last_seen_epoch": "1533965205.059461", "responder_bytes": 5477, "first_seen_epoch": "1533965098.617157" }, { "bytes": 274, "stream": 274, "flow_id": "flow-776c21f5b99dcfa4515d2414", "packets": 2, "transport": "udp", "last_frame": 30691, "first_frame": 30393, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 65481, "responder_port": 53, "initiator_bytes": 84, "last_seen_epoch": "1533965099.093757", "responder_bytes": 190, "first_seen_epoch": "1533965098.617525" }, { "bytes": 2659, "stream": 818, "flow_id": "flow-5eaad0c8588cbee02ef55fe2", "packets": 20, "transport": "tcp", "last_frame": 36604, "first_frame": 30394, "initiator_ip": "192.168.1.95", "responder_ip": "52.11.229.48", "initiator_port": 49975, "responder_port": 443, "initiator_bytes": 1366, "last_seen_epoch": "1533965205.067572", "responder_bytes": 1293, "first_seen_epoch": "1533965098.61825" }, { "bytes": 2643, "stream": 819, "flow_id": "flow-126882c4db7f9d41b7dc288a", "packets": 20, "transport": "tcp", "last_frame": 36607, "first_frame": 30395, "initiator_ip": "192.168.1.95", "responder_ip": "52.11.229.48", "initiator_port": 49974, "responder_port": 443, "initiator_bytes": 1350, "last_seen_epoch": "1533965205.067808", "responder_bytes": 1293, "first_seen_epoch": "1533965098.618381" }, { "bytes": 1290, "stream": 820, "flow_id": "flow-cfd44e73bbd0760b228c2901", "packets": 13, "transport": "tcp", "last_frame": 36772, "first_frame": 30396, "initiator_ip": "192.168.1.95", "responder_ip": "151.101.0.166", "initiator_port": 49977, "responder_port": 443, "initiator_bytes": 696, "last_seen_epoch": "1533965205.177736", "responder_bytes": 594, "first_seen_epoch": "1533965098.618956" }, { "bytes": 3000, "stream": 821, "flow_id": "flow-cb1fcf0ff5a90ecfe41dc5dc", "packets": 17, "transport": "tcp", "last_frame": 36773, "first_frame": 30397, "initiator_ip": "192.168.1.95", "responder_ip": "151.101.0.166", "initiator_port": 49976, "responder_port": 443, "initiator_bytes": 1423, "last_seen_epoch": "1533965205.177738", "responder_bytes": 1577, "first_seen_epoch": "1533965098.618957" }, { "bytes": 158, "stream": 275, "flow_id": "flow-245885ab59ffb6dc9f2e781a", "packets": 2, "transport": "udp", "last_frame": 30649, "first_frame": 30402, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 64067, "responder_port": 53, "initiator_bytes": 71, "last_seen_epoch": "1533965099.045804", "responder_bytes": 87, "first_seen_epoch": "1533965098.634262" }, { "bytes": 1481, "stream": 822, "flow_id": "flow-2d02c5b17c5c6002f7555b01", "packets": 16, "transport": "tcp", "last_frame": 35487, "first_frame": 30488, "initiator_ip": "192.168.1.95", "responder_ip": "52.206.38.25", "initiator_port": 49979, "responder_port": 443, "initiator_bytes": 819, "last_seen_epoch": "1533965160.268256", "responder_bytes": 662, "first_seen_epoch": "1533965098.781764" }, { "bytes": 2839, "stream": 823, "flow_id": "flow-30455d216b538fb6a817891a", "packets": 20, "transport": "tcp", "last_frame": 35483, "first_frame": 30489, "initiator_ip": "192.168.1.95", "responder_ip": "52.206.38.25", "initiator_port": 49978, "responder_port": 443, "initiator_bytes": 1498, "last_seen_epoch": "1533965160.267951", "responder_bytes": 1341, "first_seen_epoch": "1533965098.781911" }, { "bytes": 178, "stream": 276, "flow_id": "flow-1de45f52c56e7ca65141e5ad", "packets": 2, "transport": "udp", "last_frame": 30803, "first_frame": 30492, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 64828, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1533965099.278838", "responder_bytes": 106, "first_seen_epoch": "1533965098.783727" }, { "bytes": 276, "stream": 277, "flow_id": "flow-9a5dade4410f025475bae4fb", "packets": 2, "transport": "udp", "last_frame": 30810, "first_frame": 30493, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 57379, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1533965099.289135", "responder_bytes": 200, "first_seen_epoch": "1533965098.783956" }, { "bytes": 12014, "stream": 824, "flow_id": "flow-6f2ff490e4d05d40272f8bbd", "packets": 25, "transport": "tcp", "last_frame": 39437, "first_frame": 30494, "initiator_ip": "192.168.1.95", "responder_ip": "104.36.113.17", "initiator_port": 49980, "responder_port": 443, "initiator_bytes": 8564, "last_seen_epoch": "1533965249.305187", "responder_bytes": 3450, "first_seen_epoch": "1533965098.785246" }, { "bytes": 9824, "stream": 825, "flow_id": "flow-81a396230aa0d378637c9836", "packets": 22, "transport": "tcp", "last_frame": 31718, "first_frame": 30495, "initiator_ip": "192.168.1.95", "responder_ip": "104.36.113.17", "initiator_port": 49981, "responder_port": 443, "initiator_bytes": 5961, "last_seen_epoch": "1533965100.832887", "responder_bytes": 3863, "first_seen_epoch": "1533965098.785247" }, { "bytes": 166, "stream": 278, "flow_id": "flow-86f9f0250c27eea317110810", "packets": 2, "transport": "udp", "last_frame": 30782, "first_frame": 30496, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 65175, "responder_port": 53, "initiator_bytes": 75, "last_seen_epoch": "1533965099.269249", "responder_bytes": 91, "first_seen_epoch": "1533965098.787226" }, { "bytes": 8713, "stream": 826, "flow_id": "flow-5ce20c66a64665b0700def73", "packets": 27, "transport": "tcp", "last_frame": 36505, "first_frame": 30497, "initiator_ip": "192.168.1.95", "responder_ip": "52.44.44.54", "initiator_port": 49982, "responder_port": 443, "initiator_bytes": 2901, "last_seen_epoch": "1533965205.057152", "responder_bytes": 5812, "first_seen_epoch": "1533965098.789244" }, { "bytes": 8163, "stream": 827, "flow_id": "flow-fffaf54b7c896525b0f87e17", "packets": 26, "transport": "tcp", "last_frame": 36502, "first_frame": 30498, "initiator_ip": "192.168.1.95", "responder_ip": "52.44.44.54", "initiator_port": 49983, "responder_port": 443, "initiator_bytes": 2709, "last_seen_epoch": "1533965205.056813", "responder_bytes": 5454, "first_seen_epoch": "1533965098.789402" }, { "bytes": 7113, "stream": 828, "flow_id": "flow-e538c41d9dc8940e64f56f99", "packets": 17, "transport": "tcp", "last_frame": 36525, "first_frame": 30667, "initiator_ip": "192.168.1.95", "responder_ip": "64.38.119.27", "initiator_port": 49984, "responder_port": 443, "initiator_bytes": 1045, "last_seen_epoch": "1533965205.059065", "responder_bytes": 6068, "first_seen_epoch": "1533965099.047537" }, { "bytes": 8613, "stream": 829, "flow_id": "flow-f4810f77f77a8c4ddabd9311", "packets": 19, "transport": "tcp", "last_frame": 36782, "first_frame": 30668, "initiator_ip": "192.168.1.95", "responder_ip": "64.38.119.27", "initiator_port": 49985, "responder_port": 443, "initiator_bytes": 1552, "last_seen_epoch": "1533965205.178762", "responder_bytes": 7061, "first_seen_epoch": "1533965099.047715" }, { "bytes": 7852, "stream": 830, "flow_id": "flow-739452c913cafbdd8ebe03af", "packets": 26, "transport": "tcp", "last_frame": 36540, "first_frame": 30669, "initiator_ip": "192.168.1.95", "responder_ip": "34.234.149.11", "initiator_port": 49986, "responder_port": 443, "initiator_bytes": 1590, "last_seen_epoch": "1533965205.060209", "responder_bytes": 6262, "first_seen_epoch": "1533965099.047942" }, { "bytes": 6880, "stream": 831, "flow_id": "flow-a8183c168cf5abd7bc68d9e6", "packets": 24, "transport": "tcp", "last_frame": 36545, "first_frame": 30673, "initiator_ip": "192.168.1.95", "responder_ip": "34.234.149.11", "initiator_port": 49987, "responder_port": 443, "initiator_bytes": 1099, "last_seen_epoch": "1533965205.060492", "responder_bytes": 5781, "first_seen_epoch": "1533965099.048225" }, { "bytes": 7799, "stream": 832, "flow_id": "flow-e7d1950c393414cce44015c7", "packets": 26, "transport": "tcp", "last_frame": 36537, "first_frame": 30692, "initiator_ip": "192.168.1.95", "responder_ip": "52.8.226.99", "initiator_port": 49988, "responder_port": 443, "initiator_bytes": 1505, "last_seen_epoch": "1533965205.059852", "responder_bytes": 6294, "first_seen_epoch": "1533965099.094739" }, { "bytes": 8367, "stream": 833, "flow_id": "flow-cd8fba3987490114a8d906b2", "packets": 28, "transport": "tcp", "last_frame": 36534, "first_frame": 30693, "initiator_ip": "192.168.1.95", "responder_ip": "52.8.226.99", "initiator_port": 49989, "responder_port": 443, "initiator_bytes": 1705, "last_seen_epoch": "1533965205.059592", "responder_bytes": 6662, "first_seen_epoch": "1533965099.094741" }, { "bytes": 5835, "stream": 834, "flow_id": "flow-266e1901f3e3bc4dcdcbc013", "packets": 21, "transport": "tcp", "last_frame": 36813, "first_frame": 30705, "initiator_ip": "192.168.1.95", "responder_ip": "216.200.232.221", "initiator_port": 49991, "responder_port": 443, "initiator_bytes": 1697, "last_seen_epoch": "1533965205.19727", "responder_bytes": 4138, "first_seen_epoch": "1533965099.108373" }, { "bytes": 4478, "stream": 835, "flow_id": "flow-ee60e9f99a107d68f86cfec1", "packets": 18, "transport": "tcp", "last_frame": 36499, "first_frame": 30706, "initiator_ip": "192.168.1.95", "responder_ip": "216.200.232.221", "initiator_port": 49990, "responder_port": 443, "initiator_bytes": 934, "last_seen_epoch": "1533965205.056528", "responder_bytes": 3544, "first_seen_epoch": "1533965099.108374" }, { "bytes": 6738, "stream": 836, "flow_id": "flow-23b26b4eb1c7c52107b7e103", "packets": 18, "transport": "tcp", "last_frame": 36511, "first_frame": 30783, "initiator_ip": "192.168.1.95", "responder_ip": "74.217.250.126", "initiator_port": 49992, "responder_port": 443, "initiator_bytes": 917, "last_seen_epoch": "1533965205.057669", "responder_bytes": 5821, "first_seen_epoch": "1533965099.270448" }, { "bytes": 7992, "stream": 837, "flow_id": "flow-90ced3ea25bf0c80ceb3d4a3", "packets": 24, "transport": "tcp", "last_frame": 36508, "first_frame": 30784, "initiator_ip": "192.168.1.95", "responder_ip": "74.217.250.126", "initiator_port": 49993, "responder_port": 443, "initiator_bytes": 1624, "last_seen_epoch": "1533965205.057456", "responder_bytes": 6368, "first_seen_epoch": "1533965099.27045" }, { "bytes": 8336, "stream": 838, "flow_id": "flow-ef523d8666850115871c5020", "packets": 21, "transport": "tcp", "last_frame": 36521, "first_frame": 30804, "initiator_ip": "192.168.1.95", "responder_ip": "216.52.31.73", "initiator_port": 49994, "responder_port": 443, "initiator_bytes": 1581, "last_seen_epoch": "1533965205.058759", "responder_bytes": 6755, "first_seen_epoch": "1533965099.27953" }, { "bytes": 8660, "stream": 839, "flow_id": "flow-c18f17060bdcf996bec11581", "packets": 25, "transport": "tcp", "last_frame": 36518, "first_frame": 30805, "initiator_ip": "192.168.1.95", "responder_ip": "216.52.31.73", "initiator_port": 49995, "responder_port": 443, "initiator_bytes": 1749, "last_seen_epoch": "1533965205.058483", "responder_bytes": 6911, "first_seen_epoch": "1533965099.279531" }, { "bytes": 6558, "stream": 840, "flow_id": "flow-495e8af7e3063995125ce570", "packets": 16, "transport": "tcp", "last_frame": 36767, "first_frame": 30814, "initiator_ip": "192.168.1.95", "responder_ip": "52.9.59.235", "initiator_port": 49996, "responder_port": 443, "initiator_bytes": 798, "last_seen_epoch": "1533965205.168219", "responder_bytes": 5760, "first_seen_epoch": "1533965099.291353" }, { "bytes": 8380, "stream": 841, "flow_id": "flow-340ca46ef53948e9bbcfab1f", "packets": 25, "transport": "tcp", "last_frame": 36755, "first_frame": 30815, "initiator_ip": "192.168.1.95", "responder_ip": "52.9.59.235", "initiator_port": 49997, "responder_port": 443, "initiator_bytes": 1513, "last_seen_epoch": "1533965205.167368", "responder_bytes": 6867, "first_seen_epoch": "1533965099.291473" }, { "bytes": 7760, "stream": 842, "flow_id": "flow-ff16df0045b71debf1ba17d9", "packets": 30, "transport": "tcp", "last_frame": 39444, "first_frame": 31114, "initiator_ip": "192.168.1.95", "responder_ip": "52.44.165.199", "initiator_port": 49998, "responder_port": 443, "initiator_bytes": 3370, "last_seen_epoch": "1533965249.305908", "responder_bytes": 4390, "first_seen_epoch": "1533965099.903022" }, { "bytes": 4732, "stream": 843, "flow_id": "flow-5608e2c9d33c4f02adddab63", "packets": 17, "transport": "tcp", "last_frame": 36757, "first_frame": 31524, "initiator_ip": "192.168.1.95", "responder_ip": "35.227.197.177", "initiator_port": 49999, "responder_port": 443, "initiator_bytes": 873, "last_seen_epoch": "1533965205.16748", "responder_bytes": 3859, "first_seen_epoch": "1533965100.551851" }, { "bytes": 5770, "stream": 844, "flow_id": "flow-636293fb3e1727dbcd306cb5", "packets": 21, "transport": "tcp", "last_frame": 36766, "first_frame": 31525, "initiator_ip": "192.168.1.95", "responder_ip": "35.227.197.177", "initiator_port": 50000, "responder_port": 443, "initiator_bytes": 1488, "last_seen_epoch": "1533965205.168172", "responder_bytes": 4282, "first_seen_epoch": "1533965100.552113" }, { "bytes": 10782, "stream": 845, "flow_id": "flow-fa32c76fec0016c38de91b57", "packets": 22, "transport": "tcp", "last_frame": 36805, "first_frame": 31528, "initiator_ip": "192.168.1.95", "responder_ip": "8.39.36.143", "initiator_port": 50001, "responder_port": 443, "initiator_bytes": 4009, "last_seen_epoch": "1533965205.193426", "responder_bytes": 6773, "first_seen_epoch": "1533965100.565794" }, { "bytes": 17461, "stream": 846, "flow_id": "flow-a95ae625b6f91725cdfa3e9a", "packets": 30, "transport": "tcp", "last_frame": 36794, "first_frame": 31529, "initiator_ip": "192.168.1.95", "responder_ip": "8.39.36.143", "initiator_port": 50002, "responder_port": 443, "initiator_bytes": 7036, "last_seen_epoch": "1533965205.17945", "responder_bytes": 10425, "first_seen_epoch": "1533965100.565797" }, { "bytes": 11016, "stream": 847, "flow_id": "flow-cad79ecdb67835e88856f51b", "packets": 27, "transport": "tcp", "last_frame": 36804, "first_frame": 31534, "initiator_ip": "192.168.1.95", "responder_ip": "8.39.36.143", "initiator_port": 50003, "responder_port": 443, "initiator_bytes": 4145, "last_seen_epoch": "1533965205.193424", "responder_bytes": 6871, "first_seen_epoch": "1533965100.601203" }, { "bytes": 10768, "stream": 848, "flow_id": "flow-2765961b8a016504d95ccdd5", "packets": 24, "transport": "tcp", "last_frame": 36806, "first_frame": 31535, "initiator_ip": "192.168.1.95", "responder_ip": "8.39.36.143", "initiator_port": 50004, "responder_port": 443, "initiator_bytes": 4085, "last_seen_epoch": "1533965205.19352", "responder_bytes": 6683, "first_seen_epoch": "1533965100.601358" }, { "bytes": 255, "stream": 279, "flow_id": "flow-302182fe4532489d536a4f50", "packets": 2, "transport": "udp", "last_frame": 31673, "first_frame": 31566, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 62396, "responder_port": 53, "initiator_bytes": 75, "last_seen_epoch": "1533965100.796418", "responder_bytes": 180, "first_seen_epoch": "1533965100.651079" }, { "bytes": 5840, "stream": 849, "flow_id": "flow-5b3cc9e8aac1375af34e9180", "packets": 21, "transport": "tcp", "last_frame": 36760, "first_frame": 31591, "initiator_ip": "192.168.1.95", "responder_ip": "23.8.170.84", "initiator_port": 50005, "responder_port": 443, "initiator_bytes": 1509, "last_seen_epoch": "1533965205.167953", "responder_bytes": 4331, "first_seen_epoch": "1533965100.69259" }, { "bytes": 4620, "stream": 850, "flow_id": "flow-f714ca82d4f6f595be8f9867", "packets": 16, "transport": "tcp", "last_frame": 36480, "first_frame": 31592, "initiator_ip": "192.168.1.95", "responder_ip": "23.8.170.84", "initiator_port": 50006, "responder_port": 443, "initiator_bytes": 878, "last_seen_epoch": "1533965205.054665", "responder_bytes": 3742, "first_seen_epoch": "1533965100.692675" }, { "bytes": 11046, "stream": 851, "flow_id": "flow-b08af2e35c312e75ba8d6777", "packets": 25, "transport": "tcp", "last_frame": 36793, "first_frame": 31595, "initiator_ip": "192.168.1.95", "responder_ip": "8.39.36.143", "initiator_port": 50007, "responder_port": 443, "initiator_bytes": 4053, "last_seen_epoch": "1533965205.179449", "responder_bytes": 6993, "first_seen_epoch": "1533965100.692991" }, { "bytes": 4359, "stream": 852, "flow_id": "flow-45d7b4d7d8912c3e4e452561", "packets": 22, "transport": "tcp", "last_frame": 36620, "first_frame": 31596, "initiator_ip": "192.168.1.95", "responder_ip": "23.73.231.65", "initiator_port": 50008, "responder_port": 443, "initiator_bytes": 2047, "last_seen_epoch": "1533965205.069167", "responder_bytes": 2312, "first_seen_epoch": "1533965100.693128" }, { "bytes": 1307, "stream": 853, "flow_id": "flow-290564dbd9ac47bdac654b70", "packets": 14, "transport": "tcp", "last_frame": 33780, "first_frame": 31597, "initiator_ip": "192.168.1.95", "responder_ip": "23.73.231.65", "initiator_port": 50009, "responder_port": 443, "initiator_bytes": 737, "last_seen_epoch": "1533965157.579632", "responder_bytes": 570, "first_seen_epoch": "1533965100.693129" }, { "bytes": 322, "stream": 280, "flow_id": "flow-351b69b6756c8904d8ab7647", "packets": 2, "transport": "udp", "last_frame": 31704, "first_frame": 31606, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 54660, "responder_port": 53, "initiator_bytes": 82, "last_seen_epoch": "1533965100.817951", "responder_bytes": 240, "first_seen_epoch": "1533965100.694552" }, { "bytes": 154, "stream": 281, "flow_id": "flow-e5598f887ff91ae7d781f9f4", "packets": 2, "transport": "udp", "last_frame": 31703, "first_frame": 31607, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 55294, "responder_port": 53, "initiator_bytes": 69, "last_seen_epoch": "1533965100.814252", "responder_bytes": 85, "first_seen_epoch": "1533965100.694974" }, { "bytes": 186, "stream": 282, "flow_id": "flow-32e4769e5b0582028c354098", "packets": 2, "transport": "udp", "last_frame": 31833, "first_frame": 31608, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 55284, "responder_port": 53, "initiator_bytes": 77, "last_seen_epoch": "1533965100.973117", "responder_bytes": 109, "first_seen_epoch": "1533965100.695068" }, { "bytes": 168, "stream": 283, "flow_id": "flow-731efc67ee85c55772960ed7", "packets": 2, "transport": "udp", "last_frame": 31670, "first_frame": 31609, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 57899, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1533965100.795818", "responder_bytes": 92, "first_seen_epoch": "1533965100.695251" }, { "bytes": 210, "stream": 284, "flow_id": "flow-775dd870d3ea4afeadceba5b", "packets": 2, "transport": "udp", "last_frame": 31672, "first_frame": 31610, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 59026, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1533965100.795928", "responder_bytes": 138, "first_seen_epoch": "1533965100.695463" }, { "bytes": 288, "stream": 285, "flow_id": "flow-79964cf312c3f4f568bfb114", "packets": 2, "transport": "udp", "last_frame": 31674, "first_frame": 31611, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 64297, "responder_port": 53, "initiator_bytes": 80, "last_seen_epoch": "1533965100.796522", "responder_bytes": 208, "first_seen_epoch": "1533965100.695737" }, { "bytes": 166, "stream": 286, "flow_id": "flow-0ea072d15f082f497ec5d44e", "packets": 2, "transport": "udp", "last_frame": 31668, "first_frame": 31612, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 51951, "responder_port": 53, "initiator_bytes": 75, "last_seen_epoch": "1533965100.795644", "responder_bytes": 91, "first_seen_epoch": "1533965100.69574" }, { "bytes": 4826, "stream": 854, "flow_id": "flow-4a4c4375006f7701c14fb16f", "packets": 15, "transport": "tcp", "last_frame": 39449, "first_frame": 31617, "initiator_ip": "192.168.1.95", "responder_ip": "104.36.113.17", "initiator_port": 50010, "responder_port": 443, "initiator_bytes": 3414, "last_seen_epoch": "1533965249.306554", "responder_bytes": 1412, "first_seen_epoch": "1533965100.698844" }, { "bytes": 4255, "stream": 855, "flow_id": "flow-3b0d89a3903110a616dd5f3f", "packets": 17, "transport": "tcp", "last_frame": 36807, "first_frame": 31622, "initiator_ip": "192.168.1.95", "responder_ip": "8.39.36.143", "initiator_port": 50011, "responder_port": 443, "initiator_bytes": 1058, "last_seen_epoch": "1533965205.193539", "responder_bytes": 3197, "first_seen_epoch": "1533965100.702256" }, { "bytes": 4791, "stream": 856, "flow_id": "flow-320cb06d6c161ac18df0d184", "packets": 22, "transport": "tcp", "last_frame": 36797, "first_frame": 31648, "initiator_ip": "192.168.1.95", "responder_ip": "104.36.113.24", "initiator_port": 50012, "responder_port": 443, "initiator_bytes": 3322, "last_seen_epoch": "1533965205.179767", "responder_bytes": 1469, "first_seen_epoch": "1533965100.785699" }, { "bytes": 4883, "stream": 857, "flow_id": "flow-d297bf00c5c8d7ec2133f0b3", "packets": 19, "transport": "tcp", "last_frame": 39450, "first_frame": 31677, "initiator_ip": "192.168.1.95", "responder_ip": "104.36.113.24", "initiator_port": 50013, "responder_port": 443, "initiator_bytes": 3534, "last_seen_epoch": "1533965249.306575", "responder_bytes": 1349, "first_seen_epoch": "1533965100.797044" }, { "bytes": 7310, "stream": 858, "flow_id": "flow-c6785f35f321e474a31df0ca", "packets": 21, "transport": "tcp", "last_frame": 36816, "first_frame": 31679, "initiator_ip": "192.168.1.95", "responder_ip": "173.239.42.221", "initiator_port": 50014, "responder_port": 443, "initiator_bytes": 1573, "last_seen_epoch": "1533965205.219618", "responder_bytes": 5737, "first_seen_epoch": "1533965100.797631" }, { "bytes": 8672, "stream": 859, "flow_id": "flow-71e7485e7cd08d32f715a667", "packets": 25, "transport": "tcp", "last_frame": 36751, "first_frame": 31680, "initiator_ip": "192.168.1.95", "responder_ip": "107.178.242.85", "initiator_port": 50015, "responder_port": 443, "initiator_bytes": 1480, "last_seen_epoch": "1533965205.149955", "responder_bytes": 7192, "first_seen_epoch": "1533965100.798014" }, { "bytes": 6161, "stream": 860, "flow_id": "flow-29e91f8ca227340e2ed2a695", "packets": 18, "transport": "tcp", "last_frame": 36463, "first_frame": 31683, "initiator_ip": "192.168.1.95", "responder_ip": "173.239.42.221", "initiator_port": 50016, "responder_port": 443, "initiator_bytes": 1110, "last_seen_epoch": "1533965205.053314", "responder_bytes": 5051, "first_seen_epoch": "1533965100.798711" }, { "bytes": 7908, "stream": 861, "flow_id": "flow-981f59615e9c0a699750e9ba", "packets": 21, "transport": "tcp", "last_frame": 36466, "first_frame": 31684, "initiator_ip": "192.168.1.95", "responder_ip": "209.191.163.209", "initiator_port": 50017, "responder_port": 443, "initiator_bytes": 1405, "last_seen_epoch": "1533965205.053479", "responder_bytes": 6503, "first_seen_epoch": "1533965100.798951" }, { "bytes": 8104, "stream": 862, "flow_id": "flow-b103e56efc9728edc3911b0b", "packets": 25, "transport": "tcp", "last_frame": 36469, "first_frame": 31685, "initiator_ip": "192.168.1.95", "responder_ip": "209.191.163.209", "initiator_port": 50019, "responder_port": 443, "initiator_bytes": 1417, "last_seen_epoch": "1533965205.053843", "responder_bytes": 6687, "first_seen_epoch": "1533965100.799077" }, { "bytes": 7404, "stream": 863, "flow_id": "flow-4b1b893cd6b90b9510ae6956", "packets": 20, "transport": "tcp", "last_frame": 36752, "first_frame": 31686, "initiator_ip": "192.168.1.95", "responder_ip": "107.178.242.85", "initiator_port": 50018, "responder_port": 443, "initiator_bytes": 961, "last_seen_epoch": "1533965205.149957", "responder_bytes": 6443, "first_seen_epoch": "1533965100.799099" }, { "bytes": 8352, "stream": 864, "flow_id": "flow-47628f98c1d482372095da66", "packets": 21, "transport": "tcp", "last_frame": 36765, "first_frame": 31688, "initiator_ip": "192.168.1.95", "responder_ip": "151.101.2.2", "initiator_port": 50020, "responder_port": 443, "initiator_bytes": 1408, "last_seen_epoch": "1533965205.168084", "responder_bytes": 6944, "first_seen_epoch": "1533965100.799362" }, { "bytes": 6946, "stream": 865, "flow_id": "flow-badb31ca6936a5c28c6d5e60", "packets": 17, "transport": "tcp", "last_frame": 36764, "first_frame": 31689, "initiator_ip": "192.168.1.95", "responder_ip": "151.101.2.2", "initiator_port": 50021, "responder_port": 443, "initiator_bytes": 857, "last_seen_epoch": "1533965205.168082", "responder_bytes": 6089, "first_seen_epoch": "1533965100.799515" }, { "bytes": 8972, "stream": 866, "flow_id": "flow-76fdea7cc00e46d593c9272b", "packets": 26, "transport": "tcp", "last_frame": 36449, "first_frame": 31691, "initiator_ip": "192.168.1.95", "responder_ip": "54.217.217.143", "initiator_port": 50022, "responder_port": 443, "initiator_bytes": 2088, "last_seen_epoch": "1533965205.051929", "responder_bytes": 6884, "first_seen_epoch": "1533965100.799756" }, { "bytes": 8074, "stream": 867, "flow_id": "flow-88052d94740cf2222a61be64", "packets": 23, "transport": "tcp", "last_frame": 36452, "first_frame": 31692, "initiator_ip": "192.168.1.95", "responder_ip": "54.217.217.143", "initiator_port": 50023, "responder_port": 443, "initiator_bytes": 1597, "last_seen_epoch": "1533965205.052304", "responder_bytes": 6477, "first_seen_epoch": "1533965100.800282" }, { "bytes": 6894, "stream": 868, "flow_id": "flow-8e48912a23a76e65f16ec985", "packets": 19, "transport": "tcp", "last_frame": 36475, "first_frame": 31705, "initiator_ip": "192.168.1.95", "responder_ip": "70.42.132.5", "initiator_port": 50024, "responder_port": 443, "initiator_bytes": 1043, "last_seen_epoch": "1533965205.054295", "responder_bytes": 5851, "first_seen_epoch": "1533965100.819138" }, { "bytes": 8098, "stream": 869, "flow_id": "flow-d8201fd657972dc38b48f87d", "packets": 22, "transport": "tcp", "last_frame": 36473, "first_frame": 31706, "initiator_ip": "192.168.1.95", "responder_ip": "70.42.132.5", "initiator_port": 50025, "responder_port": 443, "initiator_bytes": 1654, "last_seen_epoch": "1533965205.054129", "responder_bytes": 6444, "first_seen_epoch": "1533965100.81914" }, { "bytes": 6886, "stream": 870, "flow_id": "flow-05fa6672591c4a619ebd4820", "packets": 20, "transport": "tcp", "last_frame": 36486, "first_frame": 31707, "initiator_ip": "192.168.1.95", "responder_ip": "52.201.177.113", "initiator_port": 50026, "responder_port": 443, "initiator_bytes": 984, "last_seen_epoch": "1533965205.05519", "responder_bytes": 5902, "first_seen_epoch": "1533965100.819514" }, { "bytes": 7880, "stream": 871, "flow_id": "flow-5da42d7e6829c61470869794", "packets": 23, "transport": "tcp", "last_frame": 36483, "first_frame": 31708, "initiator_ip": "192.168.1.95", "responder_ip": "52.201.177.113", "initiator_port": 50027, "responder_port": 443, "initiator_bytes": 1507, "last_seen_epoch": "1533965205.054953", "responder_bytes": 6373, "first_seen_epoch": "1533965100.819666" }, { "bytes": 6346, "stream": 872, "flow_id": "flow-57d44638061b43fc789aead6", "packets": 23, "transport": "tcp", "last_frame": 36455, "first_frame": 31840, "initiator_ip": "192.168.1.95", "responder_ip": "63.251.253.231", "initiator_port": 50028, "responder_port": 443, "initiator_bytes": 1518, "last_seen_epoch": "1533965205.052538", "responder_bytes": 4828, "first_seen_epoch": "1533965100.981016" }, { "bytes": 4960, "stream": 873, "flow_id": "flow-977dfa8904c0ab103b12e93d", "packets": 18, "transport": "tcp", "last_frame": 36458, "first_frame": 31841, "initiator_ip": "192.168.1.95", "responder_ip": "63.251.253.231", "initiator_port": 50029, "responder_port": 443, "initiator_bytes": 879, "last_seen_epoch": "1533965205.052799", "responder_bytes": 4081, "first_seen_epoch": "1533965100.981171" }, { "bytes": 4841, "stream": 874, "flow_id": "flow-a40700ff19d733b911cdd4f1", "packets": 15, "transport": "tcp", "last_frame": 39436, "first_frame": 32008, "initiator_ip": "192.168.1.95", "responder_ip": "104.36.113.17", "initiator_port": 50030, "responder_port": 443, "initiator_bytes": 3413, "last_seen_epoch": "1533965249.305133", "responder_bytes": 1428, "first_seen_epoch": "1533965101.359854" }, { "bytes": 5549, "stream": 875, "flow_id": "flow-236132b0994f6ed31d9a94f8", "packets": 18, "transport": "tcp", "last_frame": 36812, "first_frame": 32009, "initiator_ip": "192.168.1.95", "responder_ip": "104.36.113.17", "initiator_port": 50031, "responder_port": 443, "initiator_bytes": 3601, "last_seen_epoch": "1533965205.197179", "responder_bytes": 1948, "first_seen_epoch": "1533965101.359874" }, { "bytes": 258, "stream": 287, "flow_id": "flow-cd10eb95cc701e53c5f5b8c5", "packets": 2, "transport": "udp", "last_frame": 32144, "first_frame": 32116, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 60867, "responder_port": 53, "initiator_bytes": 77, "last_seen_epoch": "1533965101.694508", "responder_bytes": 181, "first_seen_epoch": "1533965101.584554" }, { "bytes": 6992, "stream": 876, "flow_id": "flow-7160b5981f85651f588d71a4", "packets": 18, "transport": "tcp", "last_frame": 36753, "first_frame": 32147, "initiator_ip": "192.168.1.95", "responder_ip": "151.101.2.49", "initiator_port": 50032, "responder_port": 443, "initiator_bytes": 859, "last_seen_epoch": "1533965205.150066", "responder_bytes": 6133, "first_seen_epoch": "1533965101.702089" }, { "bytes": 8106, "stream": 877, "flow_id": "flow-97c9a137dfcdd70517cefe07", "packets": 23, "transport": "tcp", "last_frame": 36747, "first_frame": 32148, "initiator_ip": "192.168.1.95", "responder_ip": "151.101.2.49", "initiator_port": 50033, "responder_port": 443, "initiator_bytes": 1534, "last_seen_epoch": "1533965205.148984", "responder_bytes": 6572, "first_seen_epoch": "1533965101.702398" }, { "bytes": 212, "stream": 288, "flow_id": "flow-a52eec78fd03624ee2b289c3", "packets": 2, "transport": "udp", "last_frame": 32219, "first_frame": 32216, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 49459, "responder_port": 53, "initiator_bytes": 85, "last_seen_epoch": "1533965102.184319", "responder_bytes": 127, "first_seen_epoch": "1533965102.093914" }, { "bytes": 6062, "stream": 878, "flow_id": "flow-caa6e6919ec3eaf741eb683e", "packets": 19, "transport": "tcp", "last_frame": 36438, "first_frame": 32220, "initiator_ip": "192.168.1.95", "responder_ip": "64.125.223.109", "initiator_port": 50034, "responder_port": 443, "initiator_bytes": 927, "last_seen_epoch": "1533965205.046088", "responder_bytes": 5135, "first_seen_epoch": "1533965102.185284" }, { "bytes": 6359, "stream": 879, "flow_id": "flow-7a11aa6b5d2916615686ca23", "packets": 18, "transport": "tcp", "last_frame": 32255, "first_frame": 32221, "initiator_ip": "192.168.1.95", "responder_ip": "64.125.223.109", "initiator_port": 50035, "responder_port": 443, "initiator_bytes": 1394, "last_seen_epoch": "1533965102.488955", "responder_bytes": 4965, "first_seen_epoch": "1533965102.185484" }, { "bytes": 9450, "stream": 880, "flow_id": "flow-0de210f4d8c1f620a4f33295", "packets": 28, "transport": "tcp", "last_frame": 36641, "first_frame": 32277, "initiator_ip": "192.168.1.95", "responder_ip": "52.8.202.139", "initiator_port": 50036, "responder_port": 443, "initiator_bytes": 2178, "last_seen_epoch": "1533965205.070857", "responder_bytes": 7272, "first_seen_epoch": "1533965106.52158" }, { "bytes": 9134, "stream": 881, "flow_id": "flow-92424356d06a49a23ca78a42", "packets": 23, "transport": "tcp", "last_frame": 39415, "first_frame": 32278, "initiator_ip": "192.168.1.95", "responder_ip": "52.8.202.139", "initiator_port": 50037, "responder_port": 443, "initiator_bytes": 1922, "last_seen_epoch": "1533965249.302372", "responder_bytes": 7212, "first_seen_epoch": "1533965106.521755" }, { "bytes": 7427, "stream": 882, "flow_id": "flow-30a11cad057f40545bbb4046", "packets": 22, "transport": "tcp", "last_frame": 33703, "first_frame": 32315, "initiator_ip": "192.168.1.95", "responder_ip": "207.244.102.143", "initiator_port": 50038, "responder_port": 443, "initiator_bytes": 920, "last_seen_epoch": "1533965157.361222", "responder_bytes": 6507, "first_seen_epoch": "1533965107.408281" }, { "bytes": 4819, "stream": 883, "flow_id": "flow-1f911b5f716128554470ad9a", "packets": 21, "transport": "tcp", "last_frame": 32563, "first_frame": 32368, "initiator_ip": "192.168.1.95", "responder_ip": "104.254.150.77", "initiator_port": 50039, "responder_port": 443, "initiator_bytes": 2822, "last_seen_epoch": "1533965130.494901", "responder_bytes": 1997, "first_seen_epoch": "1533965110.003563" }, { "bytes": 4492, "stream": 884, "flow_id": "flow-489af17667d198831e5d5e9f", "packets": 23, "transport": "tcp", "last_frame": 32604, "first_frame": 32426, "initiator_ip": "192.168.1.95", "responder_ip": "34.213.12.32", "initiator_port": 50040, "responder_port": 443, "initiator_bytes": 3063, "last_seen_epoch": "1533965131.758199", "responder_bytes": 1429, "first_seen_epoch": "1533965111.323528" }, { "bytes": 4759, "stream": 885, "flow_id": "flow-59d912a17e382f22cce9cda6", "packets": 20, "transport": "tcp", "last_frame": 33496, "first_frame": 32564, "initiator_ip": "192.168.1.95", "responder_ip": "104.254.150.77", "initiator_port": 50041, "responder_port": 443, "initiator_bytes": 2822, "last_seen_epoch": "1533965151.483996", "responder_bytes": 1937, "first_seen_epoch": "1533965130.49526" }, { "bytes": 4878, "stream": 886, "flow_id": "flow-15cd2a62f93596021acb08ec", "packets": 22, "transport": "tcp", "last_frame": 33499, "first_frame": 32565, "initiator_ip": "192.168.1.95", "responder_ip": "104.254.150.77", "initiator_port": 50042, "responder_port": 443, "initiator_bytes": 2882, "last_seen_epoch": "1533965151.485047", "responder_bytes": 1996, "first_seen_epoch": "1533965130.497158" }, { "bytes": 4492, "stream": 887, "flow_id": "flow-493dfb4e0514b6a248651da0", "packets": 23, "transport": "tcp", "last_frame": 33540, "first_frame": 32605, "initiator_ip": "192.168.1.95", "responder_ip": "34.213.12.32", "initiator_port": 50043, "responder_port": 443, "initiator_bytes": 3063, "last_seen_epoch": "1533965152.590816", "responder_bytes": 1429, "first_seen_epoch": "1533965131.758831" }, { "bytes": 250, "stream": 289, "flow_id": "flow-fc0c7423532f36a2e218a036", "packets": 2, "transport": "udp", "last_frame": 32653, "first_frame": 32650, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 55805, "responder_port": 53, "initiator_bytes": 81, "last_seen_epoch": "1533965134.234653", "responder_bytes": 169, "first_seen_epoch": "1533965134.154546" }, { "bytes": 18750, "stream": 888, "flow_id": "flow-5180b3fe8c316a27f7e96f89", "packets": 33, "transport": "tcp", "last_frame": 36792, "first_frame": 32654, "initiator_ip": "192.168.1.95", "responder_ip": "74.125.195.154", "initiator_port": 50044, "responder_port": 443, "initiator_bytes": 4499, "last_seen_epoch": "1533965205.17928", "responder_bytes": 14251, "first_seen_epoch": "1533965134.235835" }, { "bytes": 3909, "stream": 889, "flow_id": "flow-775a36f7a322fb417242ad0d", "packets": 17, "transport": "tcp", "last_frame": 36769, "first_frame": 32655, "initiator_ip": "192.168.1.95", "responder_ip": "74.125.195.154", "initiator_port": 50045, "responder_port": 443, "initiator_bytes": 823, "last_seen_epoch": "1533965205.177507", "responder_bytes": 3086, "first_seen_epoch": "1533965134.235836" }, { "bytes": 514, "stream": 290, "flow_id": "flow-8bc39a145a134ba7d5d2129f", "packets": 2, "transport": "udp", "last_frame": 32701, "first_frame": 32699, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 57107, "responder_port": 53, "initiator_bytes": 75, "last_seen_epoch": "1533965134.862529", "responder_bytes": 439, "first_seen_epoch": "1533965134.785276" }, { "bytes": 4895, "stream": 890, "flow_id": "flow-e53517853bc98b050cb896f3", "packets": 20, "transport": "tcp", "last_frame": 36431, "first_frame": 32702, "initiator_ip": "192.168.1.95", "responder_ip": "52.24.61.237", "initiator_port": 50046, "responder_port": 443, "initiator_bytes": 917, "last_seen_epoch": "1533965205.045154", "responder_bytes": 3978, "first_seen_epoch": "1533965134.867429" }, { "bytes": 8023, "stream": 891, "flow_id": "flow-825f0c055653b331174020a6", "packets": 23, "transport": "tcp", "last_frame": 36428, "first_frame": 32703, "initiator_ip": "192.168.1.95", "responder_ip": "52.24.61.237", "initiator_port": 50047, "responder_port": 443, "initiator_bytes": 1484, "last_seen_epoch": "1533965205.044721", "responder_bytes": 6539, "first_seen_epoch": "1533965134.86771" }, { "bytes": 255, "stream": 291, "flow_id": "flow-268474ee6b364fd01c325825", "packets": 2, "transport": "udp", "last_frame": 32736, "first_frame": 32735, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 63185, "responder_port": 53, "initiator_bytes": 80, "last_seen_epoch": "1533965135.439362", "responder_bytes": 175, "first_seen_epoch": "1533965135.331791" }, { "bytes": 79944, "stream": 892, "flow_id": "flow-f0907e822598a23e515b8de2", "packets": 87, "transport": "tcp", "last_frame": 36741, "first_frame": 32737, "initiator_ip": "192.168.1.95", "responder_ip": "23.54.21.240", "initiator_port": 50048, "responder_port": 443, "initiator_bytes": 3373, "last_seen_epoch": "1533965205.148642", "responder_bytes": 76571, "first_seen_epoch": "1533965135.44051" }, { "bytes": 10108, "stream": 893, "flow_id": "flow-92a88b972e176305a9667872", "packets": 24, "transport": "tcp", "last_frame": 36738, "first_frame": 32738, "initiator_ip": "192.168.1.95", "responder_ip": "23.54.21.240", "initiator_port": 50049, "responder_port": 443, "initiator_bytes": 1361, "last_seen_epoch": "1533965205.148544", "responder_bytes": 8747, "first_seen_epoch": "1533965135.440746" }, { "bytes": 259, "stream": 292, "flow_id": "flow-764f70ec5341b71f393cd499", "packets": 2, "transport": "udp", "last_frame": 32847, "first_frame": 32836, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 63648, "responder_port": 53, "initiator_bytes": 80, "last_seen_epoch": "1533965136.094373", "responder_bytes": 179, "first_seen_epoch": "1533965136.002564" }, { "bytes": 516, "stream": 293, "flow_id": "flow-1374d1cb17a7aa36b1e7a7c8", "packets": 2, "transport": "udp", "last_frame": 32841, "first_frame": 32839, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 60164, "responder_port": 53, "initiator_bytes": 73, "last_seen_epoch": "1533965136.087192", "responder_bytes": 443, "first_seen_epoch": "1533965136.010238" }, { "bytes": 6513, "stream": 894, "flow_id": "flow-71b7f32c7c7356524c3d980d", "packets": 24, "transport": "tcp", "last_frame": 36414, "first_frame": 32845, "initiator_ip": "192.168.1.95", "responder_ip": "18.218.6.11", "initiator_port": 50050, "responder_port": 443, "initiator_bytes": 1830, "last_seen_epoch": "1533965205.042665", "responder_bytes": 4683, "first_seen_epoch": "1533965136.091467" }, { "bytes": 4899, "stream": 895, "flow_id": "flow-f55a49bebf0cd83915f74c2c", "packets": 20, "transport": "tcp", "last_frame": 36417, "first_frame": 32846, "initiator_ip": "192.168.1.95", "responder_ip": "18.218.6.11", "initiator_port": 50051, "responder_port": 443, "initiator_bytes": 975, "last_seen_epoch": "1533965205.042922", "responder_bytes": 3924, "first_seen_epoch": "1533965136.091598" }, { "bytes": 86171, "stream": 896, "flow_id": "flow-aed525a0e4c45ef84aaa97b3", "packets": 86, "transport": "tcp", "last_frame": 36743, "first_frame": 32848, "initiator_ip": "192.168.1.95", "responder_ip": "23.54.20.74", "initiator_port": 50052, "responder_port": 443, "initiator_bytes": 3775, "last_seen_epoch": "1533965205.148643", "responder_bytes": 82396, "first_seen_epoch": "1533965136.095154" }, { "bytes": 41477, "stream": 897, "flow_id": "flow-0b7296d75e2e80725846d9a8", "packets": 58, "transport": "tcp", "last_frame": 36733, "first_frame": 32849, "initiator_ip": "192.168.1.95", "responder_ip": "23.54.20.74", "initiator_port": 50053, "responder_port": 443, "initiator_bytes": 3068, "last_seen_epoch": "1533965205.147031", "responder_bytes": 38409, "first_seen_epoch": "1533965136.095243" }, { "bytes": 261, "stream": 294, "flow_id": "flow-9b1461434d06003a9af4a81a", "packets": 2, "transport": "udp", "last_frame": 32947, "first_frame": 32943, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 58966, "responder_port": 53, "initiator_bytes": 81, "last_seen_epoch": "1533965136.618382", "responder_bytes": 180, "first_seen_epoch": "1533965136.507812" }, { "bytes": 266, "stream": 295, "flow_id": "flow-6f877415cc9a0060d5e14517", "packets": 2, "transport": "udp", "last_frame": 32962, "first_frame": 32944, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 55715, "responder_port": 53, "initiator_bytes": 81, "last_seen_epoch": "1533965136.678702", "responder_bytes": 185, "first_seen_epoch": "1533965136.578793" }, { "bytes": 8052, "stream": 898, "flow_id": "flow-474dd55f78d7ae100a9e7a12", "packets": 23, "transport": "tcp", "last_frame": 36727, "first_frame": 32948, "initiator_ip": "192.168.1.95", "responder_ip": "23.54.20.74", "initiator_port": 50054, "responder_port": 443, "initiator_bytes": 1366, "last_seen_epoch": "1533965205.14509", "responder_bytes": 6686, "first_seen_epoch": "1533965136.622865" }, { "bytes": 6192, "stream": 899, "flow_id": "flow-75dbd2606b7e3861f7bdae8d", "packets": 18, "transport": "tcp", "last_frame": 36411, "first_frame": 32957, "initiator_ip": "192.168.1.95", "responder_ip": "23.54.20.74", "initiator_port": 50055, "responder_port": 443, "initiator_bytes": 847, "last_seen_epoch": "1533965205.042424", "responder_bytes": 5345, "first_seen_epoch": "1533965136.652278" }, { "bytes": 10108, "stream": 900, "flow_id": "flow-07d3c3ba5c0d13735489309e", "packets": 23, "transport": "tcp", "last_frame": 33044, "first_frame": 32963, "initiator_ip": "192.168.1.95", "responder_ip": "63.251.109.87", "initiator_port": 50056, "responder_port": 443, "initiator_bytes": 2042, "last_seen_epoch": "1533965136.964705", "responder_bytes": 8066, "first_seen_epoch": "1533965136.68011" }, { "bytes": 6853, "stream": 901, "flow_id": "flow-eaf920d631f5ed06037f7e82", "packets": 21, "transport": "tcp", "last_frame": 36406, "first_frame": 32964, "initiator_ip": "192.168.1.95", "responder_ip": "63.251.109.87", "initiator_port": 50057, "responder_port": 443, "initiator_bytes": 923, "last_seen_epoch": "1533965205.041855", "responder_bytes": 5930, "first_seen_epoch": "1533965136.680456" }, { "bytes": 516, "stream": 296, "flow_id": "flow-470cecd71b47b26a33916479", "packets": 2, "transport": "udp", "last_frame": 32987, "first_frame": 32965, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 52153, "responder_port": 53, "initiator_bytes": 74, "last_seen_epoch": "1533965136.79431", "responder_bytes": 442, "first_seen_epoch": "1533965136.705665" }, { "bytes": 6172, "stream": 902, "flow_id": "flow-58d654af7eefaaddf9c7df26", "packets": 24, "transport": "tcp", "last_frame": 36400, "first_frame": 32990, "initiator_ip": "192.168.1.95", "responder_ip": "52.33.44.132", "initiator_port": 50058, "responder_port": 443, "initiator_bytes": 1771, "last_seen_epoch": "1533965205.041333", "responder_bytes": 4401, "first_seen_epoch": "1533965136.795294" }, { "bytes": 4894, "stream": 903, "flow_id": "flow-da424e18cac0a279a67b58cd", "packets": 20, "transport": "tcp", "last_frame": 36403, "first_frame": 32995, "initiator_ip": "192.168.1.95", "responder_ip": "52.33.44.132", "initiator_port": 50059, "responder_port": 443, "initiator_bytes": 916, "last_seen_epoch": "1533965205.041592", "responder_bytes": 3978, "first_seen_epoch": "1533965136.797593" }, { "bytes": 4942, "stream": 904, "flow_id": "flow-46e49a5d1eddc0e63b1cad83", "packets": 21, "transport": "tcp", "last_frame": 36744, "first_frame": 33033, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.194.162", "initiator_port": 50060, "responder_port": 443, "initiator_bytes": 2895, "last_seen_epoch": "1533965205.148814", "responder_bytes": 2047, "first_seen_epoch": "1533965136.933505" }, { "bytes": 3836, "stream": 905, "flow_id": "flow-4833babf11ae91d622945c38", "packets": 18, "transport": "tcp", "last_frame": 36730, "first_frame": 33034, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.194.162", "initiator_port": 50061, "responder_port": 443, "initiator_bytes": 2504, "last_seen_epoch": "1533965205.146829", "responder_bytes": 1332, "first_seen_epoch": "1533965136.933747" }, { "bytes": 244, "stream": 297, "flow_id": "flow-1335619b2db322402161cf8c", "packets": 2, "transport": "udp", "last_frame": 33093, "first_frame": 33067, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 62916, "responder_port": 53, "initiator_bytes": 83, "last_seen_epoch": "1533965137.114452", "responder_bytes": 161, "first_seen_epoch": "1533965137.026488" }, { "bytes": 18958, "stream": 906, "flow_id": "flow-62d2392040b804ca3232bc41", "packets": 33, "transport": "tcp", "last_frame": 36745, "first_frame": 33091, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.192.1", "initiator_port": 50063, "responder_port": 443, "initiator_bytes": 1671, "last_seen_epoch": "1533965205.148887", "responder_bytes": 17287, "first_seen_epoch": "1533965137.092572" }, { "bytes": 1209, "stream": 907, "flow_id": "flow-1ba70663ef8e1720f68edb7a", "packets": 13, "transport": "tcp", "last_frame": 36732, "first_frame": 33092, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.192.1", "initiator_port": 50062, "responder_port": 443, "initiator_bytes": 688, "last_seen_epoch": "1533965205.146948", "responder_bytes": 521, "first_seen_epoch": "1533965137.092574" }, { "bytes": 8343, "stream": 908, "flow_id": "flow-1377e72dea7bfa8660ce5fd3", "packets": 21, "transport": "tcp", "last_frame": 33329, "first_frame": 33094, "initiator_ip": "192.168.1.95", "responder_ip": "63.251.109.87", "initiator_port": 50064, "responder_port": 443, "initiator_bytes": 1480, "last_seen_epoch": "1533965137.547598", "responder_bytes": 6863, "first_seen_epoch": "1533965137.115079" }, { "bytes": 8451, "stream": 909, "flow_id": "flow-23f3eae1000229521be249f9", "packets": 23, "transport": "tcp", "last_frame": 33337, "first_frame": 33095, "initiator_ip": "192.168.1.95", "responder_ip": "63.251.109.87", "initiator_port": 50065, "responder_port": 443, "initiator_bytes": 1480, "last_seen_epoch": "1533965137.561345", "responder_bytes": 6971, "first_seen_epoch": "1533965137.115258" }, { "bytes": 8403, "stream": 910, "flow_id": "flow-be784170b2ca9cc9f815e28d", "packets": 22, "transport": "tcp", "last_frame": 33322, "first_frame": 33096, "initiator_ip": "192.168.1.95", "responder_ip": "63.251.109.87", "initiator_port": 50066, "responder_port": 443, "initiator_bytes": 1480, "last_seen_epoch": "1533965137.539731", "responder_bytes": 6923, "first_seen_epoch": "1533965137.115492" }, { "bytes": 8388, "stream": 911, "flow_id": "flow-b08ed6a21a0108d80e3ae055", "packets": 23, "transport": "tcp", "last_frame": 33315, "first_frame": 33097, "initiator_ip": "192.168.1.95", "responder_ip": "63.251.109.87", "initiator_port": 50067, "responder_port": 443, "initiator_bytes": 1480, "last_seen_epoch": "1533965137.538543", "responder_bytes": 6908, "first_seen_epoch": "1533965137.115659" }, { "bytes": 8565, "stream": 912, "flow_id": "flow-edec827a6e3798764b2253c0", "packets": 25, "transport": "tcp", "last_frame": 33355, "first_frame": 33098, "initiator_ip": "192.168.1.95", "responder_ip": "63.251.109.87", "initiator_port": 50068, "responder_port": 443, "initiator_bytes": 1540, "last_seen_epoch": "1533965137.612706", "responder_bytes": 7025, "first_seen_epoch": "1533965137.115857" }, { "bytes": 8525, "stream": 913, "flow_id": "flow-756491e0d522ddf2f2de7173", "packets": 22, "transport": "tcp", "last_frame": 33343, "first_frame": 33099, "initiator_ip": "192.168.1.95", "responder_ip": "63.251.109.87", "initiator_port": 50069, "responder_port": 443, "initiator_bytes": 1608, "last_seen_epoch": "1533965137.582811", "responder_bytes": 6917, "first_seen_epoch": "1533965137.116074" }, { "bytes": 1163, "stream": 914, "flow_id": "flow-554d5f673273a12609cb9b72", "packets": 13, "transport": "tcp", "last_frame": 36746, "first_frame": 33166, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.194.162", "initiator_port": 50070, "responder_port": 443, "initiator_bytes": 666, "last_seen_epoch": "1533965205.148888", "responder_bytes": 497, "first_seen_epoch": "1533965137.269656" }, { "bytes": 1668, "stream": 915, "flow_id": "flow-f48b77ef3a45b4bf114ebe88", "packets": 12, "transport": "tcp", "last_frame": 33374, "first_frame": 33317, "initiator_ip": "192.168.1.95", "responder_ip": "63.251.109.87", "initiator_port": 50071, "responder_port": 443, "initiator_bytes": 1197, "last_seen_epoch": "1533965137.760156", "responder_bytes": 471, "first_seen_epoch": "1533965137.538794" }, { "bytes": 1668, "stream": 916, "flow_id": "flow-404af41cac8f1acdafcc659b", "packets": 12, "transport": "tcp", "last_frame": 33373, "first_frame": 33323, "initiator_ip": "192.168.1.95", "responder_ip": "63.251.109.87", "initiator_port": 50072, "responder_port": 443, "initiator_bytes": 1197, "last_seen_epoch": "1533965137.760027", "responder_bytes": 471, "first_seen_epoch": "1533965137.539995" }, { "bytes": 286, "stream": 298, "flow_id": "flow-1d33a5bbc04ec0ccd372d51d", "packets": 2, "transport": "udp", "last_frame": 33377, "first_frame": 33372, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 50313, "responder_port": 53, "initiator_bytes": 80, "last_seen_epoch": "1533965137.904526", "responder_bytes": 206, "first_seen_epoch": "1533965137.714649" }, { "bytes": 6810, "stream": 917, "flow_id": "flow-39328f14af9948236e336b38", "packets": 20, "transport": "tcp", "last_frame": 36384, "first_frame": 33378, "initiator_ip": "192.168.1.95", "responder_ip": "63.251.109.87", "initiator_port": 50073, "responder_port": 443, "initiator_bytes": 982, "last_seen_epoch": "1533965205.039598", "responder_bytes": 5828, "first_seen_epoch": "1533965137.936091" }, { "bytes": 6744, "stream": 918, "flow_id": "flow-7570db03ee5f99af1a1e51c6", "packets": 19, "transport": "tcp", "last_frame": 36387, "first_frame": 33379, "initiator_ip": "192.168.1.95", "responder_ip": "63.251.109.87", "initiator_port": 50074, "responder_port": 443, "initiator_bytes": 922, "last_seen_epoch": "1533965205.040036", "responder_bytes": 5822, "first_seen_epoch": "1533965137.93627" }, { "bytes": 2524, "stream": 919, "flow_id": "flow-b59f036ab985d9c68d9a7dd9", "packets": 17, "transport": "tcp", "last_frame": 36785, "first_frame": 33418, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.192.2", "initiator_port": 50075, "responder_port": 443, "initiator_bytes": 1302, "last_seen_epoch": "1533965205.178998", "responder_bytes": 1222, "first_seen_epoch": "1533965142.786796" }, { "bytes": 2524, "stream": 920, "flow_id": "flow-5cda9df545c037d722b4a37a", "packets": 17, "transport": "tcp", "last_frame": 36784, "first_frame": 33419, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.192.2", "initiator_port": 50076, "responder_port": 443, "initiator_bytes": 1302, "last_seen_epoch": "1533965205.178857", "responder_bytes": 1222, "first_seen_epoch": "1533965142.786888" }, { "bytes": 15781, "stream": 921, "flow_id": "flow-c3af0307d7dcf5c6a246a556", "packets": 37, "transport": "tcp", "last_frame": 36062, "first_frame": 33500, "initiator_ip": "192.168.1.95", "responder_ip": "104.254.150.77", "initiator_port": 50077, "responder_port": 443, "initiator_bytes": 7433, "last_seen_epoch": "1533965173.237071", "responder_bytes": 8348, "first_seen_epoch": "1533965151.485266" }, { "bytes": 11690, "stream": 922, "flow_id": "flow-6cdd2e12a5677477883de820", "packets": 30, "transport": "tcp", "last_frame": 36059, "first_frame": 33501, "initiator_ip": "192.168.1.95", "responder_ip": "104.254.150.77", "initiator_port": 50078, "responder_port": 443, "initiator_bytes": 5920, "last_seen_epoch": "1533965173.23659", "responder_bytes": 5770, "first_seen_epoch": "1533965151.486133" }, { "bytes": 4492, "stream": 923, "flow_id": "flow-c4d3ac8bfc277812281e481b", "packets": 23, "transport": "tcp", "last_frame": 36108, "first_frame": 33541, "initiator_ip": "192.168.1.95", "responder_ip": "34.213.12.32", "initiator_port": 50079, "responder_port": 443, "initiator_bytes": 3063, "last_seen_epoch": "1533965174.339619", "responder_bytes": 1429, "first_seen_epoch": "1533965152.591161" }, { "bytes": 5015, "stream": 924, "flow_id": "flow-4c908eedeca20c6f0efd1b72", "packets": 19, "transport": "tcp", "last_frame": 36653, "first_frame": 33592, "initiator_ip": "192.168.1.95", "responder_ip": "104.254.150.77", "initiator_port": 50080, "responder_port": 443, "initiator_bytes": 3498, "last_seen_epoch": "1533965205.071793", "responder_bytes": 1517, "first_seen_epoch": "1533965155.398943" }, { "bytes": 7179, "stream": 925, "flow_id": "flow-7e38130953be6e9253bcf243", "packets": 26, "transport": "tcp", "last_frame": 36650, "first_frame": 33594, "initiator_ip": "192.168.1.95", "responder_ip": "104.254.150.77", "initiator_port": 50081, "responder_port": 443, "initiator_bytes": 4830, "last_seen_epoch": "1533965205.071577", "responder_bytes": 2349, "first_seen_epoch": "1533965155.399025" }, { "bytes": 6030, "stream": 926, "flow_id": "flow-5fd0c24fc36df203efeacdc8", "packets": 19, "transport": "tcp", "last_frame": 36638, "first_frame": 33625, "initiator_ip": "192.168.1.95", "responder_ip": "13.33.78.101", "initiator_port": 50082, "responder_port": 443, "initiator_bytes": 870, "last_seen_epoch": "1533965205.070644", "responder_bytes": 5160, "first_seen_epoch": "1533965156.92405" }, { "bytes": 25092, "stream": 927, "flow_id": "flow-2ab4604bca6c3346f024f042", "packets": 42, "transport": "tcp", "last_frame": 36966, "first_frame": 33626, "initiator_ip": "192.168.1.95", "responder_ip": "13.33.78.101", "initiator_port": 50083, "responder_port": 443, "initiator_bytes": 1933, "last_seen_epoch": "1533965219.230482", "responder_bytes": 23159, "first_seen_epoch": "1533965156.924167" }, { "bytes": 1735871, "stream": 928, "flow_id": "flow-40f765130b2276891d3e55ee", "packets": 1297, "transport": "tcp", "last_frame": 37009, "first_frame": 33661, "initiator_ip": "192.168.1.95", "responder_ip": "192.229.210.158", "initiator_port": 50084, "responder_port": 443, "initiator_bytes": 35636, "last_seen_epoch": "1533965219.345133", "responder_bytes": 1700235, "first_seen_epoch": "1533965157.055285" }, { "bytes": 45680, "stream": 929, "flow_id": "flow-c14dd897bc40dbbc495d15a5", "packets": 45, "transport": "tcp", "last_frame": 36965, "first_frame": 33662, "initiator_ip": "192.168.1.95", "responder_ip": "192.229.210.158", "initiator_port": 50085, "responder_port": 443, "initiator_bytes": 2233, "last_seen_epoch": "1533965219.230333", "responder_bytes": 43447, "first_seen_epoch": "1533965157.055287" }, { "bytes": 10564, "stream": 930, "flow_id": "flow-6c88d64220b9f4e7bd9f1154", "packets": 27, "transport": "tcp", "last_frame": 36678, "first_frame": 33692, "initiator_ip": "192.168.1.95", "responder_ip": "104.254.150.69", "initiator_port": 50086, "responder_port": 443, "initiator_bytes": 4520, "last_seen_epoch": "1533965205.074192", "responder_bytes": 6044, "first_seen_epoch": "1533965157.35623" }, { "bytes": 5950, "stream": 931, "flow_id": "flow-622418db09d98c76a1e2ede0", "packets": 23, "transport": "tcp", "last_frame": 36681, "first_frame": 33693, "initiator_ip": "192.168.1.95", "responder_ip": "104.254.150.69", "initiator_port": 50087, "responder_port": 443, "initiator_bytes": 2600, "last_seen_epoch": "1533965205.074395", "responder_bytes": 3350, "first_seen_epoch": "1533965157.356338" }, { "bytes": 9075, "stream": 932, "flow_id": "flow-1c20dd80d8391dbb5738ce4c", "packets": 25, "transport": "tcp", "last_frame": 34389, "first_frame": 33705, "initiator_ip": "192.168.1.95", "responder_ip": "207.244.102.143", "initiator_port": 50089, "responder_port": 443, "initiator_bytes": 1597, "last_seen_epoch": "1533965158.310974", "responder_bytes": 7478, "first_seen_epoch": "1533965157.363406" }, { "bytes": 7689, "stream": 933, "flow_id": "flow-1bc626b542fa6d3f98afee3b", "packets": 24, "transport": "tcp", "last_frame": 36672, "first_frame": 33706, "initiator_ip": "192.168.1.95", "responder_ip": "207.244.102.143", "initiator_port": 50088, "responder_port": 443, "initiator_bytes": 1082, "last_seen_epoch": "1533965205.073727", "responder_bytes": 6607, "first_seen_epoch": "1533965157.363408" }, { "bytes": 8476, "stream": 934, "flow_id": "flow-53a5e84a0b8856fdd53cc40c", "packets": 23, "transport": "tcp", "last_frame": 39460, "first_frame": 33827, "initiator_ip": "192.168.1.95", "responder_ip": "72.5.64.63", "initiator_port": 50090, "responder_port": 443, "initiator_bytes": 1691, "last_seen_epoch": "1533965249.307758", "responder_bytes": 6785, "first_seen_epoch": "1533965157.678358" }, { "bytes": 8460, "stream": 935, "flow_id": "flow-370fa55defb4eb9d74ee3e12", "packets": 23, "transport": "tcp", "last_frame": 39397, "first_frame": 33829, "initiator_ip": "192.168.1.95", "responder_ip": "72.5.64.63", "initiator_port": 50091, "responder_port": 443, "initiator_bytes": 1563, "last_seen_epoch": "1533965249.300637", "responder_bytes": 6897, "first_seen_epoch": "1533965157.67836" }, { "bytes": 4520, "stream": 936, "flow_id": "flow-960e784ef99c72ee7e4b91ae", "packets": 13, "transport": "tcp", "last_frame": 39432, "first_frame": 33830, "initiator_ip": "192.168.1.95", "responder_ip": "74.6.34.27", "initiator_port": 50092, "responder_port": 443, "initiator_bytes": 773, "last_seen_epoch": "1533965249.30451", "responder_bytes": 3747, "first_seen_epoch": "1533965157.67836" }, { "bytes": 7374, "stream": 937, "flow_id": "flow-c5f589b33ba19f6a0bdbe569", "packets": 24, "transport": "tcp", "last_frame": 36690, "first_frame": 33831, "initiator_ip": "192.168.1.95", "responder_ip": "74.6.34.27", "initiator_port": 50094, "responder_port": 443, "initiator_bytes": 1580, "last_seen_epoch": "1533965205.075232", "responder_bytes": 5794, "first_seen_epoch": "1533965157.678361" }, { "bytes": 4805, "stream": 938, "flow_id": "flow-89d5fadcf2dbdd7cded701cf", "packets": 15, "transport": "tcp", "last_frame": 39458, "first_frame": 33832, "initiator_ip": "192.168.1.95", "responder_ip": "98.136.101.121", "initiator_port": 50093, "responder_port": 443, "initiator_bytes": 827, "last_seen_epoch": "1533965249.307518", "responder_bytes": 3978, "first_seen_epoch": "1533965157.678476" }, { "bytes": 3860, "stream": 939, "flow_id": "flow-bc8907728b2b16e219b0e874", "packets": 19, "transport": "tcp", "last_frame": 36381, "first_frame": 33833, "initiator_ip": "192.168.1.95", "responder_ip": "98.136.101.121", "initiator_port": 50095, "responder_port": 443, "initiator_bytes": 1303, "last_seen_epoch": "1533965205.039444", "responder_bytes": 2557, "first_seen_epoch": "1533965157.678639" }, { "bytes": 168, "stream": 299, "flow_id": "flow-21c41b6260ea0b7eea926380", "packets": 2, "transport": "udp", "last_frame": 33923, "first_frame": 33838, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 58667, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1533965157.846245", "responder_bytes": 92, "first_seen_epoch": "1533965157.679632" }, { "bytes": 1423, "stream": 940, "flow_id": "flow-450bb808e3f57089d2dfce04", "packets": 16, "transport": "tcp", "last_frame": 36378, "first_frame": 33841, "initiator_ip": "192.168.1.95", "responder_ip": "162.210.199.69", "initiator_port": 50096, "responder_port": 443, "initiator_bytes": 801, "last_seen_epoch": "1533965205.039202", "responder_bytes": 622, "first_seen_epoch": "1533965157.681188" }, { "bytes": 2837, "stream": 941, "flow_id": "flow-9a7ffb6cf3caaba5d0495fdd", "packets": 18, "transport": "tcp", "last_frame": 36375, "first_frame": 33843, "initiator_ip": "192.168.1.95", "responder_ip": "162.210.199.69", "initiator_port": 50097, "responder_port": 443, "initiator_bytes": 1388, "last_seen_epoch": "1533965205.038911", "responder_bytes": 1449, "first_seen_epoch": "1533965157.681482" }, { "bytes": 280, "stream": 300, "flow_id": "flow-1667b1a1e660675ae06f4f36", "packets": 2, "transport": "udp", "last_frame": 33970, "first_frame": 33846, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 56854, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1533965157.910445", "responder_bytes": 204, "first_seen_epoch": "1533965157.683154" }, { "bytes": 7804, "stream": 942, "flow_id": "flow-ceabe52bc4f4c97253d477e8", "packets": 16, "transport": "tcp", "last_frame": 39456, "first_frame": 33924, "initiator_ip": "192.168.1.95", "responder_ip": "35.186.239.238", "initiator_port": 50098, "responder_port": 443, "initiator_bytes": 1209, "last_seen_epoch": "1533965249.307246", "responder_bytes": 6595, "first_seen_epoch": "1533965157.847056" }, { "bytes": 6400, "stream": 943, "flow_id": "flow-0937243360d4ff67eeb886f9", "packets": 14, "transport": "tcp", "last_frame": 39457, "first_frame": 33925, "initiator_ip": "192.168.1.95", "responder_ip": "35.186.239.238", "initiator_port": 50099, "responder_port": 443, "initiator_bytes": 782, "last_seen_epoch": "1533965249.307326", "responder_bytes": 5618, "first_seen_epoch": "1533965157.847142" }, { "bytes": 8599, "stream": 944, "flow_id": "flow-42623e61d791fa37e50330c8", "packets": 26, "transport": "tcp", "last_frame": 39448, "first_frame": 33989, "initiator_ip": "192.168.1.95", "responder_ip": "52.4.175.160", "initiator_port": 50100, "responder_port": 443, "initiator_bytes": 1924, "last_seen_epoch": "1533965249.306281", "responder_bytes": 6675, "first_seen_epoch": "1533965157.915985" }, { "bytes": 7823, "stream": 945, "flow_id": "flow-ad01be31f914860f14d04900", "packets": 23, "transport": "tcp", "last_frame": 39463, "first_frame": 33993, "initiator_ip": "192.168.1.95", "responder_ip": "52.4.175.160", "initiator_port": 50101, "responder_port": 443, "initiator_bytes": 1437, "last_seen_epoch": "1533965249.307972", "responder_bytes": 6386, "first_seen_epoch": "1533965157.916408" }, { "bytes": 6500, "stream": 946, "flow_id": "flow-5e44f271744d9a5209c01166", "packets": 28, "transport": "tcp", "last_frame": 36666, "first_frame": 34398, "initiator_ip": "192.168.1.95", "responder_ip": "185.167.164.39", "initiator_port": 50102, "responder_port": 443, "initiator_bytes": 3265, "last_seen_epoch": "1533965205.073087", "responder_bytes": 3235, "first_seen_epoch": "1533965158.31662" }, { "bytes": 6910, "stream": 947, "flow_id": "flow-aeaa513a461240a16eef3375", "packets": 22, "transport": "tcp", "last_frame": 36669, "first_frame": 34399, "initiator_ip": "192.168.1.95", "responder_ip": "185.167.164.39", "initiator_port": 50103, "responder_port": 443, "initiator_bytes": 2670, "last_seen_epoch": "1533965205.073338", "responder_bytes": 4240, "first_seen_epoch": "1533965158.316803" }, { "bytes": 4505, "stream": 948, "flow_id": "flow-afbf51f6a560f4db1fd8f3ac", "packets": 15, "transport": "tcp", "last_frame": 39466, "first_frame": 34639, "initiator_ip": "192.168.1.95", "responder_ip": "104.36.113.24", "initiator_port": 50104, "responder_port": 443, "initiator_bytes": 3317, "last_seen_epoch": "1533965249.308329", "responder_bytes": 1188, "first_seen_epoch": "1533965158.741274" }, { "bytes": 1137, "stream": 949, "flow_id": "flow-5db652573424470744dfe882", "packets": 12, "transport": "tcp", "last_frame": 39467, "first_frame": 34640, "initiator_ip": "192.168.1.95", "responder_ip": "104.36.113.24", "initiator_port": 50105, "responder_port": 443, "initiator_bytes": 682, "last_seen_epoch": "1533965249.3084", "responder_bytes": 455, "first_seen_epoch": "1533965158.741397" }, { "bytes": 3348, "stream": 950, "flow_id": "flow-2292e0781ee0150faaad897a", "packets": 15, "transport": "tcp", "last_frame": 35798, "first_frame": 35448, "initiator_ip": "192.168.1.95", "responder_ip": "109.232.197.110", "initiator_port": 50106, "responder_port": 443, "initiator_bytes": 1566, "last_seen_epoch": "1533965160.843278", "responder_bytes": 1782, "first_seen_epoch": "1533965159.992726" }, { "bytes": 1198, "stream": 951, "flow_id": "flow-b7737ace5ce9e31d77e4d4f1", "packets": 13, "transport": "tcp", "last_frame": 36656, "first_frame": 35449, "initiator_ip": "192.168.1.95", "responder_ip": "109.232.197.110", "initiator_port": 50107, "responder_port": 443, "initiator_bytes": 675, "last_seen_epoch": "1533965205.072189", "responder_bytes": 523, "first_seen_epoch": "1533965159.992818" }, { "bytes": 6203, "stream": 952, "flow_id": "flow-636540aa5bf86cefc6d9d415", "packets": 18, "transport": "tcp", "last_frame": 36661, "first_frame": 35476, "initiator_ip": "192.168.1.95", "responder_ip": "185.167.166.41", "initiator_port": 50108, "responder_port": 443, "initiator_bytes": 931, "last_seen_epoch": "1533965205.072556", "responder_bytes": 5272, "first_seen_epoch": "1533965160.209802" }, { "bytes": 29264, "stream": 953, "flow_id": "flow-80e7184259a57e8023025b79", "packets": 36, "transport": "tcp", "last_frame": 36658, "first_frame": 35477, "initiator_ip": "192.168.1.95", "responder_ip": "185.167.166.41", "initiator_port": 50109, "responder_port": 443, "initiator_bytes": 1862, "last_seen_epoch": "1533965205.072343", "responder_bytes": 27402, "first_seen_epoch": "1533965160.210368" }, { "bytes": 2679, "stream": 954, "flow_id": "flow-11e6c99ad3d102c9bc65f37c", "packets": 20, "transport": "tcp", "last_frame": 36629, "first_frame": 35490, "initiator_ip": "192.168.1.95", "responder_ip": "52.206.38.25", "initiator_port": 50110, "responder_port": 443, "initiator_bytes": 1418, "last_seen_epoch": "1533965205.069902", "responder_bytes": 1261, "first_seen_epoch": "1533965160.26983" }, { "bytes": 1481, "stream": 955, "flow_id": "flow-3944e5181e6227a6adc0dc46", "packets": 16, "transport": "tcp", "last_frame": 36632, "first_frame": 35491, "initiator_ip": "192.168.1.95", "responder_ip": "52.206.38.25", "initiator_port": 50111, "responder_port": 443, "initiator_bytes": 819, "last_seen_epoch": "1533965205.070209", "responder_bytes": 662, "first_seen_epoch": "1533965160.269967" }, { "bytes": 198, "stream": 301, "flow_id": "flow-852f470c445e498f1e833a54", "packets": 2, "transport": "udp", "last_frame": 35520, "first_frame": 35492, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 51799, "responder_port": 53, "initiator_bytes": 83, "last_seen_epoch": "1533965160.354275", "responder_bytes": 115, "first_seen_epoch": "1533965160.270599" }, { "bytes": 188, "stream": 302, "flow_id": "flow-cc93adc7405e0bf3ed395560", "packets": 2, "transport": "udp", "last_frame": 35521, "first_frame": 35493, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 55777, "responder_port": 53, "initiator_bytes": 86, "last_seen_epoch": "1533965160.354413", "responder_bytes": 102, "first_seen_epoch": "1533965160.270758" }, { "bytes": 184, "stream": 303, "flow_id": "flow-4de1d13d87dae88b54a38acf", "packets": 2, "transport": "udp", "last_frame": 35536, "first_frame": 35494, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 63711, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1533965160.370088", "responder_bytes": 108, "first_seen_epoch": "1533965160.271065" }, { "bytes": 208, "stream": 304, "flow_id": "flow-2d2ea113ab090517f98f32cc", "packets": 2, "transport": "udp", "last_frame": 35517, "first_frame": 35495, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 55252, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1533965160.353225", "responder_bytes": 136, "first_seen_epoch": "1533965160.271382" }, { "bytes": 439, "stream": 305, "flow_id": "flow-47219c7287ae888fd1b951ad", "packets": 2, "transport": "udp", "last_frame": 35537, "first_frame": 35496, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 49468, "responder_port": 53, "initiator_bytes": 100, "last_seen_epoch": "1533965160.370309", "responder_bytes": 339, "first_seen_epoch": "1533965160.27164" }, { "bytes": 262, "stream": 306, "flow_id": "flow-ed0cb11e56ae8f4243c906f9", "packets": 2, "transport": "udp", "last_frame": 35556, "first_frame": 35497, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 64655, "responder_port": 53, "initiator_bytes": 99, "last_seen_epoch": "1533965160.381946", "responder_bytes": 163, "first_seen_epoch": "1533965160.271885" }, { "bytes": 7976, "stream": 956, "flow_id": "flow-8aeda2f5dcf5e1f24911dcd5", "packets": 26, "transport": "tcp", "last_frame": 36614, "first_frame": 35498, "initiator_ip": "192.168.1.95", "responder_ip": "52.42.116.214", "initiator_port": 50112, "responder_port": 443, "initiator_bytes": 1591, "last_seen_epoch": "1533965205.068597", "responder_bytes": 6385, "first_seen_epoch": "1533965160.272014" }, { "bytes": 8072, "stream": 957, "flow_id": "flow-3271e472840c3853fa37a3e0", "packets": 26, "transport": "tcp", "last_frame": 36617, "first_frame": 35500, "initiator_ip": "192.168.1.95", "responder_ip": "52.42.116.214", "initiator_port": 50113, "responder_port": 443, "initiator_bytes": 1591, "last_seen_epoch": "1533965205.068875", "responder_bytes": 6481, "first_seen_epoch": "1533965160.272353" }, { "bytes": 4589, "stream": 958, "flow_id": "flow-12d4c103a8d1e94a9d5f1fc4", "packets": 15, "transport": "tcp", "last_frame": 39455, "first_frame": 35518, "initiator_ip": "192.168.1.95", "responder_ip": "54.92.93.205", "initiator_port": 50114, "responder_port": 443, "initiator_bytes": 794, "last_seen_epoch": "1533965249.307177", "responder_bytes": 3795, "first_seen_epoch": "1533965160.353894" }, { "bytes": 5904, "stream": 959, "flow_id": "flow-78dfa1a06d861d29122a595d", "packets": 19, "transport": "tcp", "last_frame": 39470, "first_frame": 35519, "initiator_ip": "192.168.1.95", "responder_ip": "54.92.93.205", "initiator_port": 50115, "responder_port": 443, "initiator_bytes": 1329, "last_seen_epoch": "1533965249.308576", "responder_bytes": 4575, "first_seen_epoch": "1533965160.354273" }, { "bytes": 4731, "stream": 960, "flow_id": "flow-a35a8555cb70b2c8aec813ed", "packets": 16, "transport": "tcp", "last_frame": 39468, "first_frame": 35525, "initiator_ip": "192.168.1.95", "responder_ip": "213.155.156.164", "initiator_port": 50116, "responder_port": 443, "initiator_bytes": 855, "last_seen_epoch": "1533965249.308414", "responder_bytes": 3876, "first_seen_epoch": "1533965160.355508" }, { "bytes": 4462, "stream": 961, "flow_id": "flow-05c319bf330c48c6074b717e", "packets": 14, "transport": "tcp", "last_frame": 39469, "first_frame": 35526, "initiator_ip": "192.168.1.95", "responder_ip": "35.201.123.46", "initiator_port": 50117, "responder_port": 443, "initiator_bytes": 732, "last_seen_epoch": "1533965249.308511", "responder_bytes": 3730, "first_seen_epoch": "1533965160.355835" }, { "bytes": 5342, "stream": 962, "flow_id": "flow-494ec6f3d0a737c28194c42e", "packets": 19, "transport": "tcp", "last_frame": 35887, "first_frame": 35527, "initiator_ip": "192.168.1.95", "responder_ip": "213.155.156.164", "initiator_port": 50118, "responder_port": 443, "initiator_bytes": 1330, "last_seen_epoch": "1533965161.276735", "responder_bytes": 4012, "first_seen_epoch": "1533965160.356962" }, { "bytes": 6965, "stream": 963, "flow_id": "flow-14e20b22e0073e572ca5d38c", "packets": 20, "transport": "tcp", "last_frame": 36366, "first_frame": 35528, "initiator_ip": "192.168.1.95", "responder_ip": "85.114.159.93", "initiator_port": 50119, "responder_port": 443, "initiator_bytes": 1384, "last_seen_epoch": "1533965205.038025", "responder_bytes": 5581, "first_seen_epoch": "1533965160.357968" }, { "bytes": 5780, "stream": 964, "flow_id": "flow-f872ba57359f8fcb394674f7", "packets": 20, "transport": "tcp", "last_frame": 39471, "first_frame": 35529, "initiator_ip": "192.168.1.95", "responder_ip": "35.201.123.46", "initiator_port": 50120, "responder_port": 443, "initiator_bytes": 1403, "last_seen_epoch": "1533965249.308671", "responder_bytes": 4377, "first_seen_epoch": "1533965160.35797" }, { "bytes": 5717, "stream": 965, "flow_id": "flow-e44f18bba08498d40e720e6e", "packets": 15, "transport": "tcp", "last_frame": 39472, "first_frame": 35530, "initiator_ip": "192.168.1.95", "responder_ip": "85.114.159.93", "initiator_port": 50121, "responder_port": 443, "initiator_bytes": 805, "last_seen_epoch": "1533965249.308731", "responder_bytes": 4912, "first_seen_epoch": "1533965160.358253" }, { "bytes": 8136, "stream": 966, "flow_id": "flow-484ee39ae59021d28522d2a0", "packets": 22, "transport": "tcp", "last_frame": 39473, "first_frame": 35541, "initiator_ip": "192.168.1.95", "responder_ip": "18.218.60.224", "initiator_port": 50122, "responder_port": 443, "initiator_bytes": 1437, "last_seen_epoch": "1533965249.308807", "responder_bytes": 6699, "first_seen_epoch": "1533965160.370868" }, { "bytes": 6858, "stream": 967, "flow_id": "flow-27904c5e96265fef16964683", "packets": 18, "transport": "tcp", "last_frame": 39474, "first_frame": 35542, "initiator_ip": "192.168.1.95", "responder_ip": "18.218.60.224", "initiator_port": 50123, "responder_port": 443, "initiator_bytes": 918, "last_seen_epoch": "1533965249.30887", "responder_bytes": 5940, "first_seen_epoch": "1533965160.370869" }, { "bytes": 6375, "stream": 968, "flow_id": "flow-b21ccdd8062307f16870cc95", "packets": 18, "transport": "tcp", "last_frame": 36372, "first_frame": 35549, "initiator_ip": "192.168.1.95", "responder_ip": "52.211.165.177", "initiator_port": 50124, "responder_port": 443, "initiator_bytes": 942, "last_seen_epoch": "1533965205.038622", "responder_bytes": 5433, "first_seen_epoch": "1533965160.37197" }, { "bytes": 7555, "stream": 969, "flow_id": "flow-99c7b7889deb6d4e82b719ad", "packets": 20, "transport": "tcp", "last_frame": 36369, "first_frame": 35551, "initiator_ip": "192.168.1.95", "responder_ip": "52.211.165.177", "initiator_port": 50125, "responder_port": 443, "initiator_bytes": 1481, "last_seen_epoch": "1533965205.038319", "responder_bytes": 6074, "first_seen_epoch": "1533965160.3722" }, { "bytes": 5742, "stream": 970, "flow_id": "flow-98437e254558891a8d34f792", "packets": 22, "transport": "tcp", "last_frame": 39475, "first_frame": 35557, "initiator_ip": "192.168.1.95", "responder_ip": "23.20.36.175", "initiator_port": 50126, "responder_port": 443, "initiator_bytes": 1448, "last_seen_epoch": "1533965249.30894", "responder_bytes": 4294, "first_seen_epoch": "1533965160.383567" }, { "bytes": 4550, "stream": 971, "flow_id": "flow-d30fa8496172dcfdb1389ba7", "packets": 18, "transport": "tcp", "last_frame": 39476, "first_frame": 35558, "initiator_ip": "192.168.1.95", "responder_ip": "23.20.36.175", "initiator_port": 50127, "responder_port": 443, "initiator_bytes": 941, "last_seen_epoch": "1533965249.309001", "responder_bytes": 3609, "first_seen_epoch": "1533965160.384197" }, { "bytes": 6088, "stream": 972, "flow_id": "flow-53daf1b37433a0c1780c9d3d", "packets": 23, "transport": "tcp", "last_frame": 36644, "first_frame": 35799, "initiator_ip": "192.168.1.95", "responder_ip": "34.237.234.13", "initiator_port": 50129, "responder_port": 443, "initiator_bytes": 2953, "last_seen_epoch": "1533965205.07106", "responder_bytes": 3135, "first_seen_epoch": "1533965160.843776" }, { "bytes": 1484, "stream": 973, "flow_id": "flow-7fcd6fa0d060b8c721d3fbf5", "packets": 16, "transport": "tcp", "last_frame": 36647, "first_frame": 35800, "initiator_ip": "192.168.1.95", "responder_ip": "34.237.234.13", "initiator_port": 50128, "responder_port": 443, "initiator_bytes": 822, "last_seen_epoch": "1533965205.071348", "responder_bytes": 662, "first_seen_epoch": "1533965160.844268" }, { "bytes": 5104, "stream": 974, "flow_id": "flow-8ef604d637c356b63c03e212", "packets": 23, "transport": "tcp", "last_frame": 36226, "first_frame": 36063, "initiator_ip": "192.168.1.95", "responder_ip": "104.254.150.77", "initiator_port": 50130, "responder_port": 443, "initiator_bytes": 3047, "last_seen_epoch": "1533965193.854129", "responder_bytes": 2057, "first_seen_epoch": "1533965173.237483" }, { "bytes": 5044, "stream": 975, "flow_id": "flow-355890d555f8232fbb2123fe", "packets": 22, "transport": "tcp", "last_frame": 36229, "first_frame": 36064, "initiator_ip": "192.168.1.95", "responder_ip": "104.254.150.77", "initiator_port": 50131, "responder_port": 443, "initiator_bytes": 2987, "last_seen_epoch": "1533965193.854381", "responder_bytes": 2057, "first_seen_epoch": "1533965173.23844" }, { "bytes": 4492, "stream": 976, "flow_id": "flow-c19b7e644226709cc444d9bf", "packets": 23, "transport": "tcp", "last_frame": 36272, "first_frame": 36109, "initiator_ip": "192.168.1.95", "responder_ip": "34.213.12.32", "initiator_port": 50132, "responder_port": 443, "initiator_bytes": 3063, "last_seen_epoch": "1533965195.017583", "responder_bytes": 1429, "first_seen_epoch": "1533965174.340105" }, { "bytes": 5103, "stream": 977, "flow_id": "flow-3f272f49e3aeabd5b47ab674", "packets": 23, "transport": "tcp", "last_frame": 36725, "first_frame": 36230, "initiator_ip": "192.168.1.95", "responder_ip": "104.254.150.77", "initiator_port": 50133, "responder_port": 443, "initiator_bytes": 3047, "last_seen_epoch": "1533965205.079975", "responder_bytes": 2056, "first_seen_epoch": "1533965193.854575" }, { "bytes": 5043, "stream": 978, "flow_id": "flow-776bc2469a58e231ec018d43", "packets": 22, "transport": "tcp", "last_frame": 36723, "first_frame": 36231, "initiator_ip": "192.168.1.95", "responder_ip": "104.254.150.77", "initiator_port": 50134, "responder_port": 443, "initiator_bytes": 2987, "last_seen_epoch": "1533965205.078266", "responder_bytes": 2056, "first_seen_epoch": "1533965193.856408" }, { "bytes": 4492, "stream": 979, "flow_id": "flow-1f30610433119bb7fd8c7634", "packets": 23, "transport": "tcp", "last_frame": 36911, "first_frame": 36273, "initiator_ip": "192.168.1.95", "responder_ip": "34.213.12.32", "initiator_port": 50135, "responder_port": 443, "initiator_bytes": 3063, "last_seen_epoch": "1533965215.191459", "responder_bytes": 1429, "first_seen_epoch": "1533965195.017786" }, { "bytes": 5044, "stream": 980, "flow_id": "flow-525fed2d06ccb39ca0aeeee4", "packets": 22, "transport": "tcp", "last_frame": 38588, "first_frame": 36858, "initiator_ip": "192.168.1.95", "responder_ip": "104.254.150.77", "initiator_port": 50136, "responder_port": 443, "initiator_bytes": 2987, "last_seen_epoch": "1533965234.409563", "responder_bytes": 2057, "first_seen_epoch": "1533965213.677659" }, { "bytes": 4984, "stream": 981, "flow_id": "flow-1990c164d50d4c1adde3ae8f", "packets": 21, "transport": "tcp", "last_frame": 38585, "first_frame": 36859, "initiator_ip": "192.168.1.95", "responder_ip": "104.254.150.77", "initiator_port": 50137, "responder_port": 443, "initiator_bytes": 2987, "last_seen_epoch": "1533965234.400419", "responder_bytes": 1997, "first_seen_epoch": "1533965213.679412" }, { "bytes": 186, "stream": 982, "flow_id": "flow-05dfa34ca68883d9e6a53d34", "packets": 3, "transport": "tcp", "last_frame": 38666, "first_frame": 36912, "initiator_ip": "192.168.1.95", "responder_ip": "34.213.12.32", "initiator_port": 50138, "responder_port": 443, "initiator_bytes": 66, "last_seen_epoch": "1533965236.987312", "responder_bytes": 120, "first_seen_epoch": "1533965215.191706" }, { "bytes": 5679, "stream": 983, "flow_id": "flow-b8939e538d4ddaf8a355ea8a", "packets": 14, "transport": "tcp", "last_frame": 39394, "first_frame": 36957, "initiator_ip": "192.168.1.95", "responder_ip": "13.33.78.101", "initiator_port": 50140, "responder_port": 443, "initiator_bytes": 810, "last_seen_epoch": "1533965249.300197", "responder_bytes": 4869, "first_seen_epoch": "1533965219.12639" }, { "bytes": 26379, "stream": 984, "flow_id": "flow-f4ed833b5662998df38bec66", "packets": 38, "transport": "tcp", "last_frame": 39438, "first_frame": 36958, "initiator_ip": "192.168.1.95", "responder_ip": "13.33.78.101", "initiator_port": 50139, "responder_port": 443, "initiator_bytes": 1993, "last_seen_epoch": "1533965249.30533", "responder_bytes": 24386, "first_seen_epoch": "1533965219.126472" }, { "bytes": 77072, "stream": 985, "flow_id": "flow-865ec7dbc2aa2b3d395c5752", "packets": 86, "transport": "tcp", "last_frame": 39409, "first_frame": 37010, "initiator_ip": "192.168.1.95", "responder_ip": "192.229.210.158", "initiator_port": 50141, "responder_port": 443, "initiator_bytes": 3259, "last_seen_epoch": "1533965249.301878", "responder_bytes": 73813, "first_seen_epoch": "1533965219.349076" }, { "bytes": 1585125, "stream": 986, "flow_id": "flow-66baba642cb5966e3f1bf450", "packets": 1337, "transport": "tcp", "last_frame": 39464, "first_frame": 37011, "initiator_ip": "192.168.1.95", "responder_ip": "192.229.210.158", "initiator_port": 50142, "responder_port": 443, "initiator_bytes": 36423, "last_seen_epoch": "1533965249.308067", "responder_bytes": 1548702, "first_seen_epoch": "1533965219.349078" }, { "bytes": 4984, "stream": 987, "flow_id": "flow-6c56d8474047aa8dd2647cdd", "packets": 21, "transport": "tcp", "last_frame": 39416, "first_frame": 38589, "initiator_ip": "192.168.1.95", "responder_ip": "104.254.150.77", "initiator_port": 50143, "responder_port": 443, "initiator_bytes": 2987, "last_seen_epoch": "1533965249.302467", "responder_bytes": 1997, "first_seen_epoch": "1533965234.412753" }, { "bytes": 4984, "stream": 988, "flow_id": "flow-60c63d869fe840c87eab3b73", "packets": 21, "transport": "tcp", "last_frame": 39430, "first_frame": 38590, "initiator_ip": "192.168.1.95", "responder_ip": "104.254.150.77", "initiator_port": 50144, "responder_port": 443, "initiator_bytes": 2987, "last_seen_epoch": "1533965249.303972", "responder_bytes": 1997, "first_seen_epoch": "1533965234.422778" }, { "bytes": 4252, "stream": 989, "flow_id": "flow-e586930ea7248a66defe7042", "packets": 19, "transport": "tcp", "last_frame": 39402, "first_frame": 38640, "initiator_ip": "192.168.1.95", "responder_ip": "34.213.12.32", "initiator_port": 50145, "responder_port": 443, "initiator_bytes": 2943, "last_seen_epoch": "1533965249.301135", "responder_bytes": 1309, "first_seen_epoch": "1533965235.911114" }, { "bytes": 60, "stream": 990, "flow_id": "flow-c2fc5678cc3510e6f696a425", "packets": 1, "transport": "tcp", "last_frame": 38667, "first_frame": 38667, "initiator_ip": "34.213.12.32", "responder_ip": "192.168.1.95", "initiator_port": 443, "responder_port": 50138, "initiator_bytes": 60, "last_seen_epoch": "1533965237.090525", "responder_bytes": 0, "first_seen_epoch": "1533965237.090525" }, { "bytes": 60, "stream": 991, "flow_id": "flow-a803eab99f89e2575103ad5f", "packets": 1, "transport": "tcp", "last_frame": 38668, "first_frame": 38668, "initiator_ip": "34.213.12.32", "responder_ip": "192.168.1.95", "initiator_port": 443, "responder_port": 50138, "initiator_bytes": 60, "last_seen_epoch": "1533965237.195614", "responder_bytes": 0, "first_seen_epoch": "1533965237.195614" }, { "bytes": 60, "stream": 992, "flow_id": "flow-44bc6d7067298cb537402d3a", "packets": 1, "transport": "tcp", "last_frame": 38669, "first_frame": 38669, "initiator_ip": "34.213.12.32", "responder_ip": "192.168.1.95", "initiator_port": 443, "responder_port": 50138, "initiator_bytes": 60, "last_seen_epoch": "1533965237.299622", "responder_bytes": 0, "first_seen_epoch": "1533965237.299622" }, { "bytes": 60, "stream": 993, "flow_id": "flow-72bb22f44f8c45c92b22bd7b", "packets": 1, "transport": "tcp", "last_frame": 38680, "first_frame": 38680, "initiator_ip": "34.213.12.32", "responder_ip": "192.168.1.95", "initiator_port": 443, "responder_port": 50138, "initiator_bytes": 60, "last_seen_epoch": "1533965238.304266", "responder_bytes": 0, "first_seen_epoch": "1533965238.304266" }, { "bytes": 16131, "stream": 994, "flow_id": "flow-7037a0e632f94d9f644502e2", "packets": 30, "transport": "tcp", "last_frame": 39398, "first_frame": 38690, "initiator_ip": "192.168.1.95", "responder_ip": "74.125.195.154", "initiator_port": 50146, "responder_port": 443, "initiator_bytes": 4396, "last_seen_epoch": "1533965249.300704", "responder_bytes": 11735, "first_seen_epoch": "1533965238.539084" }, { "bytes": 977, "stream": 995, "flow_id": "flow-c9d6c7a6e38bfe0334794712", "packets": 10, "transport": "tcp", "last_frame": 39454, "first_frame": 38691, "initiator_ip": "192.168.1.95", "responder_ip": "74.125.195.154", "initiator_port": 50147, "responder_port": 443, "initiator_bytes": 600, "last_seen_epoch": "1533965249.307094", "responder_bytes": 377, "first_seen_epoch": "1533965238.53931" }, { "bytes": 4235, "stream": 996, "flow_id": "flow-9b0a3b8b7914f99ae43e74b3", "packets": 14, "transport": "tcp", "last_frame": 39413, "first_frame": 38730, "initiator_ip": "192.168.1.95", "responder_ip": "52.24.61.237", "initiator_port": 50148, "responder_port": 443, "initiator_bytes": 1201, "last_seen_epoch": "1533965249.302213", "responder_bytes": 3034, "first_seen_epoch": "1533965239.152528" }, { "bytes": 1053, "stream": 997, "flow_id": "flow-32f51c010aaedf2ccdd84240", "packets": 10, "transport": "tcp", "last_frame": 39465, "first_frame": 38731, "initiator_ip": "192.168.1.95", "responder_ip": "52.24.61.237", "initiator_port": 50149, "responder_port": 443, "initiator_bytes": 634, "last_seen_epoch": "1533965249.308145", "responder_bytes": 419, "first_seen_epoch": "1533965239.152531" }, { "bytes": 2665, "stream": 998, "flow_id": "flow-161c2e32a46764a060c583ea", "packets": 14, "transport": "tcp", "last_frame": 39422, "first_frame": 38758, "initiator_ip": "192.168.1.95", "responder_ip": "18.218.6.11", "initiator_port": 50150, "responder_port": 443, "initiator_bytes": 1487, "last_seen_epoch": "1533965249.303148", "responder_bytes": 1178, "first_seen_epoch": "1533965239.692549" }, { "bytes": 1051, "stream": 999, "flow_id": "flow-3b7c8595f4369a7025d589f4", "packets": 10, "transport": "tcp", "last_frame": 39462, "first_frame": 38759, "initiator_ip": "192.168.1.95", "responder_ip": "18.218.6.11", "initiator_port": 50151, "responder_port": 443, "initiator_bytes": 632, "last_seen_epoch": "1533965249.30788", "responder_bytes": 419, "first_seen_epoch": "1533965239.692995" }, { "bytes": 5176, "stream": 1000, "flow_id": "flow-e402d4678f8cd86182668a81", "packets": 19, "transport": "tcp", "last_frame": 38807, "first_frame": 38762, "initiator_ip": "192.168.1.95", "responder_ip": "63.251.109.87", "initiator_port": 50152, "responder_port": 443, "initiator_bytes": 1999, "last_seen_epoch": "1533965240.12445", "responder_bytes": 3177, "first_seen_epoch": "1533965239.773088" }, { "bytes": 1625, "stream": 1001, "flow_id": "flow-e777c7072916a496e1cd3837", "packets": 14, "transport": "tcp", "last_frame": 39410, "first_frame": 38763, "initiator_ip": "192.168.1.95", "responder_ip": "63.251.109.87", "initiator_port": 50153, "responder_port": 443, "initiator_bytes": 760, "last_seen_epoch": "1533965249.301878", "responder_bytes": 865, "first_seen_epoch": "1533965239.77318" }, { "bytes": 244, "stream": 307, "flow_id": "flow-6caf94fc047201c795af4147", "packets": 2, "transport": "udp", "last_frame": 38809, "first_frame": 38808, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 54687, "responder_port": 53, "initiator_bytes": 83, "last_seen_epoch": "1533965240.205005", "responder_bytes": 161, "first_seen_epoch": "1533965240.128848" }, { "bytes": 8442, "stream": 1002, "flow_id": "flow-74b47bc619451c02775328f4", "packets": 24, "transport": "tcp", "last_frame": 38932, "first_frame": 38810, "initiator_ip": "192.168.1.95", "responder_ip": "63.251.109.87", "initiator_port": 50154, "responder_port": 443, "initiator_bytes": 1540, "last_seen_epoch": "1533965240.538003", "responder_bytes": 6902, "first_seen_epoch": "1533965240.215401" }, { "bytes": 8685, "stream": 1003, "flow_id": "flow-e0b3e21d6be4ee616b260e48", "packets": 27, "transport": "tcp", "last_frame": 38921, "first_frame": 38813, "initiator_ip": "192.168.1.95", "responder_ip": "63.251.109.87", "initiator_port": 50155, "responder_port": 443, "initiator_bytes": 1660, "last_seen_epoch": "1533965240.536465", "responder_bytes": 7025, "first_seen_epoch": "1533965240.235213" }, { "bytes": 8502, "stream": 1004, "flow_id": "flow-48e7510445aba73e51646c04", "packets": 25, "transport": "tcp", "last_frame": 38944, "first_frame": 38814, "initiator_ip": "192.168.1.95", "responder_ip": "63.251.109.87", "initiator_port": 50156, "responder_port": 443, "initiator_bytes": 1600, "last_seen_epoch": "1533965240.591095", "responder_bytes": 6902, "first_seen_epoch": "1533965240.235337" }, { "bytes": 8625, "stream": 1005, "flow_id": "flow-72add569f301448cf72cecf2", "packets": 26, "transport": "tcp", "last_frame": 38952, "first_frame": 38815, "initiator_ip": "192.168.1.95", "responder_ip": "63.251.109.87", "initiator_port": 50157, "responder_port": 443, "initiator_bytes": 1600, "last_seen_epoch": "1533965240.628608", "responder_bytes": 7025, "first_seen_epoch": "1533965240.23555" }, { "bytes": 1052, "stream": 1006, "flow_id": "flow-34ac2825ac385ef572bea839", "packets": 10, "transport": "tcp", "last_frame": 39399, "first_frame": 38820, "initiator_ip": "192.168.1.95", "responder_ip": "52.33.44.132", "initiator_port": 50158, "responder_port": 443, "initiator_bytes": 633, "last_seen_epoch": "1533965249.30078", "responder_bytes": 419, "first_seen_epoch": "1533965240.288928" }, { "bytes": 2330, "stream": 1007, "flow_id": "flow-5ea8e7e4c37568bd34aed93b", "packets": 14, "transport": "tcp", "last_frame": 39425, "first_frame": 38821, "initiator_ip": "192.168.1.95", "responder_ip": "52.33.44.132", "initiator_port": 50159, "responder_port": 443, "initiator_bytes": 1488, "last_seen_epoch": "1533965249.30347", "responder_bytes": 842, "first_seen_epoch": "1533965240.288931" }, { "bytes": 60, "stream": 1008, "flow_id": "flow-1f5ae0b6c7555abb7416572d", "packets": 1, "transport": "tcp", "last_frame": 38826, "first_frame": 38826, "initiator_ip": "34.213.12.32", "responder_ip": "192.168.1.95", "initiator_port": 443, "responder_port": 50138, "initiator_bytes": 60, "last_seen_epoch": "1533965240.305142", "responder_bytes": 0, "first_seen_epoch": "1533965240.305142" }, { "bytes": 4766, "stream": 1009, "flow_id": "flow-d4e4a7f927075199e200ced8", "packets": 18, "transport": "tcp", "last_frame": 39405, "first_frame": 38893, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.194.162", "initiator_port": 50160, "responder_port": 443, "initiator_bytes": 2839, "last_seen_epoch": "1533965249.30155", "responder_bytes": 1927, "first_seen_epoch": "1533965240.446812" }, { "bytes": 3658, "stream": 1010, "flow_id": "flow-2275dcd759adc937e08b0571", "packets": 15, "transport": "tcp", "last_frame": 39411, "first_frame": 38894, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.194.162", "initiator_port": 50161, "responder_port": 443, "initiator_bytes": 2446, "last_seen_epoch": "1533965249.302094", "responder_bytes": 1212, "first_seen_epoch": "1533965240.446992" }, { "bytes": 3297, "stream": 1011, "flow_id": "flow-e2e0943dbff2090a8f91c79b", "packets": 15, "transport": "tcp", "last_frame": 39071, "first_frame": 38963, "initiator_ip": "192.168.1.95", "responder_ip": "63.251.109.87", "initiator_port": 50162, "responder_port": 443, "initiator_bytes": 1385, "last_seen_epoch": "1533965241.009437", "responder_bytes": 1912, "first_seen_epoch": "1533965240.652833" }, { "bytes": 3169, "stream": 1012, "flow_id": "flow-39da9ae3aaa2825fb83bf9b3", "packets": 15, "transport": "tcp", "last_frame": 39079, "first_frame": 38964, "initiator_ip": "192.168.1.95", "responder_ip": "63.251.109.87", "initiator_port": 50163, "responder_port": 443, "initiator_bytes": 1257, "last_seen_epoch": "1533965241.021077", "responder_bytes": 1912, "first_seen_epoch": "1533965240.652836" }, { "bytes": 3517, "stream": 1013, "flow_id": "flow-9fa8aba74239c59220858163", "packets": 21, "transport": "tcp", "last_frame": 39101, "first_frame": 38965, "initiator_ip": "192.168.1.95", "responder_ip": "63.251.109.87", "initiator_port": 50164, "responder_port": 443, "initiator_bytes": 1437, "last_seen_epoch": "1533965241.039132", "responder_bytes": 2080, "first_seen_epoch": "1533965240.656434" }, { "bytes": 12960, "stream": 1014, "flow_id": "flow-c3985d6f5251e99e4b601e94", "packets": 21, "transport": "tcp", "last_frame": 39423, "first_frame": 38966, "initiator_ip": "192.168.1.95", "responder_ip": "23.54.20.74", "initiator_port": 50166, "responder_port": 443, "initiator_bytes": 1501, "last_seen_epoch": "1533965249.303235", "responder_bytes": 11459, "first_seen_epoch": "1533965240.657347" }, { "bytes": 5936, "stream": 1015, "flow_id": "flow-a38695868ec9fee5f6f05c78", "packets": 14, "transport": "tcp", "last_frame": 39412, "first_frame": 38967, "initiator_ip": "192.168.1.95", "responder_ip": "23.54.20.74", "initiator_port": 50165, "responder_port": 443, "initiator_bytes": 758, "last_seen_epoch": "1533965249.302095", "responder_bytes": 5178, "first_seen_epoch": "1533965240.657431" }, { "bytes": 9986, "stream": 1016, "flow_id": "flow-0bca358aadd299303deee98e", "packets": 20, "transport": "tcp", "last_frame": 39392, "first_frame": 39025, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.192.1", "initiator_port": 50167, "responder_port": 443, "initiator_bytes": 1327, "last_seen_epoch": "1533965249.300087", "responder_bytes": 8659, "first_seen_epoch": "1533965240.856169" }, { "bytes": 1029, "stream": 1017, "flow_id": "flow-e563cc94b8a742025172233b", "packets": 10, "transport": "tcp", "last_frame": 39424, "first_frame": 39026, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.192.1", "initiator_port": 50168, "responder_port": 443, "initiator_bytes": 628, "last_seen_epoch": "1533965249.303381", "responder_bytes": 401, "first_seen_epoch": "1533965240.856303" }, { "bytes": 3214, "stream": 1018, "flow_id": "flow-fe1dfbf394a3b61ebb41a1e6", "packets": 17, "transport": "tcp", "last_frame": 39117, "first_frame": 39027, "initiator_ip": "192.168.1.95", "responder_ip": "63.251.109.87", "initiator_port": 50169, "responder_port": 443, "initiator_bytes": 1317, "last_seen_epoch": "1533965241.227707", "responder_bytes": 1897, "first_seen_epoch": "1533965240.864314" }, { "bytes": 3274, "stream": 1019, "flow_id": "flow-6d9b4d2175133c480cdc51ef", "packets": 18, "transport": "tcp", "last_frame": 39131, "first_frame": 39052, "initiator_ip": "192.168.1.95", "responder_ip": "63.251.109.87", "initiator_port": 50170, "responder_port": 443, "initiator_bytes": 1317, "last_seen_epoch": "1533965241.32607", "responder_bytes": 1957, "first_seen_epoch": "1533965240.93453" }, { "bytes": 1684, "stream": 1020, "flow_id": "flow-0d0d887b25097b302e5f452a", "packets": 12, "transport": "tcp", "last_frame": 39147, "first_frame": 39124, "initiator_ip": "192.168.1.95", "responder_ip": "63.251.109.87", "initiator_port": 50171, "responder_port": 443, "initiator_bytes": 1213, "last_seen_epoch": "1533965241.549829", "responder_bytes": 471, "first_seen_epoch": "1533965241.28794" }, { "bytes": 60, "stream": 1021, "flow_id": "flow-d08d2bcc3726708738a35b01", "packets": 1, "transport": "tcp", "last_frame": 39148, "first_frame": 39148, "initiator_ip": "34.213.12.32", "responder_ip": "192.168.1.95", "initiator_port": 443, "responder_port": 50138, "initiator_bytes": 60, "last_seen_epoch": "1533965244.308859", "responder_bytes": 0, "first_seen_epoch": "1533965244.308859" }, { "bytes": 7705, "stream": 1022, "flow_id": "flow-78739ccff63a9cc275834096", "packets": 22, "transport": "tcp", "last_frame": 39433, "first_frame": 39161, "initiator_ip": "192.168.1.95", "responder_ip": "136.243.25.70", "initiator_port": 50172, "responder_port": 443, "initiator_bytes": 1670, "last_seen_epoch": "1533965249.304626", "responder_bytes": 6035, "first_seen_epoch": "1533965245.666679" }, { "bytes": 6683, "stream": 1023, "flow_id": "flow-5b3144d6f887a8c067dd274b", "packets": 18, "transport": "tcp", "last_frame": 39440, "first_frame": 39162, "initiator_ip": "192.168.1.95", "responder_ip": "136.243.25.70", "initiator_port": 50173, "responder_port": 443, "initiator_bytes": 943, "last_seen_epoch": "1533965249.30547", "responder_bytes": 5740, "first_seen_epoch": "1533965245.666842" }, { "bytes": 34588, "stream": 1024, "flow_id": "flow-b076963d41ec5bf8a88921b0", "packets": 52, "transport": "tcp", "last_frame": 39434, "first_frame": 39163, "initiator_ip": "192.168.1.95", "responder_ip": "185.167.166.41", "initiator_port": 50175, "responder_port": 443, "initiator_bytes": 2387, "last_seen_epoch": "1533965249.30488", "responder_bytes": 32201, "first_seen_epoch": "1533965245.809998" }, { "bytes": 4819, "stream": 1025, "flow_id": "flow-feff655761211f1aa717c420", "packets": 16, "transport": "tcp", "last_frame": 39418, "first_frame": 39164, "initiator_ip": "192.168.1.95", "responder_ip": "185.167.166.41", "initiator_port": 50174, "responder_port": 443, "initiator_bytes": 1307, "last_seen_epoch": "1533965249.302642", "responder_bytes": 3512, "first_seen_epoch": "1533965245.810001" }, { "bytes": 7454, "stream": 1026, "flow_id": "flow-db8e49799c3167b7a072333c", "packets": 22, "transport": "tcp", "last_frame": 39426, "first_frame": 39165, "initiator_ip": "192.168.1.95", "responder_ip": "185.167.164.39", "initiator_port": 50176, "responder_port": 443, "initiator_bytes": 1658, "last_seen_epoch": "1533965249.303549", "responder_bytes": 5796, "first_seen_epoch": "1533965245.812191" }, { "bytes": 7334, "stream": 1027, "flow_id": "flow-d6d75d4fad2f80a73be52187", "packets": 20, "transport": "tcp", "last_frame": 39459, "first_frame": 39166, "initiator_ip": "192.168.1.95", "responder_ip": "185.167.164.39", "initiator_port": 50177, "responder_port": 443, "initiator_bytes": 1538, "last_seen_epoch": "1533965249.307686", "responder_bytes": 5796, "first_seen_epoch": "1533965245.8123" }, { "bytes": 6865, "stream": 1028, "flow_id": "flow-3ae4fb54757d279a60660a6d", "packets": 20, "transport": "tcp", "last_frame": 39393, "first_frame": 39305, "initiator_ip": "192.168.1.95", "responder_ip": "104.254.150.77", "initiator_port": 50178, "responder_port": 443, "initiator_bytes": 4722, "last_seen_epoch": "1533965249.300196", "responder_bytes": 2143, "first_seen_epoch": "1533965246.710288" }, { "bytes": 967, "stream": 1029, "flow_id": "flow-278496741464a1dbe409ec7c", "packets": 10, "transport": "tcp", "last_frame": 39404, "first_frame": 39306, "initiator_ip": "192.168.1.95", "responder_ip": "104.254.150.77", "initiator_port": 50179, "responder_port": 443, "initiator_bytes": 596, "last_seen_epoch": "1533965249.301291", "responder_bytes": 371, "first_seen_epoch": "1533965246.710291" }, { "bytes": 1655, "stream": 1030, "flow_id": "flow-a018cccfacf82581120fdf95", "packets": 12, "transport": "tcp", "last_frame": 39445, "first_frame": 39333, "initiator_ip": "192.168.1.95", "responder_ip": "136.243.42.249", "initiator_port": 50180, "responder_port": 443, "initiator_bytes": 1184, "last_seen_epoch": "1533965249.306126", "responder_bytes": 471, "first_seen_epoch": "1533965247.001327" }, { "bytes": 6403, "stream": 1031, "flow_id": "flow-9b5750b70a14d5b38d7c9c4b", "packets": 18, "transport": "tcp", "last_frame": 39461, "first_frame": 39340, "initiator_ip": "192.168.1.95", "responder_ip": "23.54.23.55", "initiator_port": 50181, "responder_port": 443, "initiator_bytes": 2910, "last_seen_epoch": "1533965249.307853", "responder_bytes": 3493, "first_seen_epoch": "1533965247.185414" }, { "bytes": 6537, "stream": 1032, "flow_id": "flow-15f914a0e08a03dfbceddc82", "packets": 19, "transport": "tcp", "last_frame": 39435, "first_frame": 39341, "initiator_ip": "192.168.1.95", "responder_ip": "23.54.23.55", "initiator_port": 50182, "responder_port": 443, "initiator_bytes": 3043, "last_seen_epoch": "1533965249.30497", "responder_bytes": 3494, "first_seen_epoch": "1533965247.185524" }, { "bytes": 120, "stream": 1033, "flow_id": "flow-3bcb5c575b5899d4d803c0c3", "packets": 2, "transport": "tcp", "last_frame": 40068, "first_frame": 39477, "initiator_ip": "34.213.12.32", "responder_ip": "192.168.1.95", "initiator_port": 443, "responder_port": 50138, "initiator_bytes": 120, "last_seen_epoch": "1533965747.941057", "responder_bytes": 0, "first_seen_epoch": "1533965252.309521" }, { "bytes": 289, "stream": 308, "flow_id": "flow-0a8442aba6e2ef6a41fc3e02", "packets": 2, "transport": "udp", "last_frame": 39482, "first_frame": 39481, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 64315, "responder_port": 53, "initiator_bytes": 90, "last_seen_epoch": "1533965401.063902", "responder_bytes": 199, "first_seen_epoch": "1533965400.871842" }, { "bytes": 1353, "stream": 1034, "flow_id": "flow-c3d082b5ef7eef9e07eacc53", "packets": 10, "transport": "tcp", "last_frame": 39492, "first_frame": 39483, "initiator_ip": "192.168.1.95", "responder_ip": "205.185.216.42", "initiator_port": 50183, "responder_port": 80, "initiator_bytes": 719, "last_seen_epoch": "1533965401.249175", "responder_bytes": 634, "first_seen_epoch": "1533965401.066978" }, { "bytes": 58315, "stream": 1035, "flow_id": "flow-d9e84aff87b609a24248d394", "packets": 60, "transport": "tcp", "last_frame": 39771, "first_frame": 39493, "initiator_ip": "192.168.1.95", "responder_ip": "205.185.216.42", "initiator_port": 50184, "responder_port": 80, "initiator_bytes": 1799, "last_seen_epoch": "1533965520.76087", "responder_bytes": 56516, "first_seen_epoch": "1533965406.239815" }, { "bytes": 1558, "stream": 1036, "flow_id": "flow-686e3e1851c302f3d00e71a0", "packets": 13, "transport": "tcp", "last_frame": 39668, "first_frame": 39551, "initiator_ip": "192.168.1.95", "responder_ip": "185.68.93.18", "initiator_port": 50185, "responder_port": 80, "initiator_bytes": 860, "last_seen_epoch": "1533965412.636952", "responder_bytes": 698, "first_seen_epoch": "1533965406.683517" }, { "bytes": 8977, "stream": 1037, "flow_id": "flow-e77291e70f69fefabd0b9f78", "packets": 26, "transport": "tcp", "last_frame": 39628, "first_frame": 39559, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 50186, "responder_port": 389, "initiator_bytes": 4352, "last_seen_epoch": "1533965407.603376", "responder_bytes": 4625, "first_seen_epoch": "1533965407.38166" }, { "bytes": 3863, "stream": 1038, "flow_id": "flow-2e10ab759bf10e76753b78ca", "packets": 10, "transport": "tcp", "last_frame": 39574, "first_frame": 39565, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 50187, "responder_port": 88, "initiator_bytes": 1941, "last_seen_epoch": "1533965407.385923", "responder_bytes": 1922, "first_seen_epoch": "1533965407.383409" }, { "bytes": 334, "stream": 309, "flow_id": "flow-083b61ad1ef89dcbca01e9b4", "packets": 2, "transport": "udp", "last_frame": 39583, "first_frame": 39582, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 52847, "responder_port": 53, "initiator_bytes": 133, "last_seen_epoch": "1533965407.390593", "responder_bytes": 201, "first_seen_epoch": "1533965407.390401" }, { "bytes": 438, "stream": 310, "flow_id": "flow-6649f72b30c5c28533ed1f05", "packets": 2, "transport": "udp", "last_frame": 39585, "first_frame": 39584, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 52848, "responder_port": 389, "initiator_bytes": 192, "last_seen_epoch": "1533965407.391554", "responder_bytes": 246, "first_seen_epoch": "1533965407.391358" }, { "bytes": 372, "stream": 1039, "flow_id": "flow-cbb04df89eb6ef7eb0581370", "packets": 6, "transport": "tcp", "last_frame": 39592, "first_frame": 39586, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 50188, "responder_port": 389, "initiator_bytes": 186, "last_seen_epoch": "1533965407.489562", "responder_bytes": 186, "first_seen_epoch": "1533965407.487263" }, { "bytes": 334, "stream": 311, "flow_id": "flow-dfe53997f06b5eaa8dc6bce9", "packets": 2, "transport": "udp", "last_frame": 39595, "first_frame": 39594, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 65030, "responder_port": 53, "initiator_bytes": 133, "last_seen_epoch": "1533965407.491736", "responder_bytes": 201, "first_seen_epoch": "1533965407.491461" }, { "bytes": 438, "stream": 312, "flow_id": "flow-8fd591eeb54d2aa1407679cc", "packets": 2, "transport": "udp", "last_frame": 39597, "first_frame": 39596, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 65031, "responder_port": 389, "initiator_bytes": 192, "last_seen_epoch": "1533965407.493141", "responder_bytes": 246, "first_seen_epoch": "1533965407.492846" }, { "bytes": 192, "stream": 1040, "flow_id": "flow-382568f45a3a065480b5b8e6", "packets": 3, "transport": "tcp", "last_frame": 39664, "first_frame": 39599, "initiator_ip": "192.168.1.95", "responder_ip": "89.223.92.202", "initiator_port": 50189, "responder_port": 80, "initiator_bytes": 132, "last_seen_epoch": "1533965412.636467", "responder_bytes": 60, "first_seen_epoch": "1533965407.583245" }, { "bytes": 372, "stream": 1041, "flow_id": "flow-1d8df2f3c5133f4bd8bd52a5", "packets": 6, "transport": "tcp", "last_frame": 39606, "first_frame": 39600, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 50190, "responder_port": 389, "initiator_bytes": 186, "last_seen_epoch": "1533965407.597156", "responder_bytes": 186, "first_seen_epoch": "1533965407.595868" }, { "bytes": 372, "stream": 1042, "flow_id": "flow-b90533de2a775774d76d6cd2", "packets": 6, "transport": "tcp", "last_frame": 39613, "first_frame": 39608, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 50191, "responder_port": 389, "initiator_bytes": 186, "last_seen_epoch": "1533965407.599366", "responder_bytes": 186, "first_seen_epoch": "1533965407.598284" }, { "bytes": 372, "stream": 1043, "flow_id": "flow-d9cd4eab953b74bd3b074645", "packets": 6, "transport": "tcp", "last_frame": 39622, "first_frame": 39616, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 50192, "responder_port": 389, "initiator_bytes": 186, "last_seen_epoch": "1533965407.601808", "responder_bytes": 186, "first_seen_epoch": "1533965407.600827" }, { "bytes": 6321, "stream": 1044, "flow_id": "flow-bf1e5d99b8962f0190248938", "packets": 21, "transport": "tcp", "last_frame": 39689, "first_frame": 39630, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 50193, "responder_port": 445, "initiator_bytes": 4601, "last_seen_epoch": "1533965423.185853", "responder_bytes": 1720, "first_seen_epoch": "1533965409.306669" }, { "bytes": 146, "stream": 313, "flow_id": "flow-b59c2b4bff0bef8baa01ef78", "packets": 2, "transport": "udp", "last_frame": 39661, "first_frame": 39652, "initiator_ip": "192.168.1.95", "responder_ip": "224.0.0.252", "initiator_port": 58410, "responder_port": 5355, "initiator_bytes": 146, "last_seen_epoch": "1533965410.279591", "responder_bytes": 0, "first_seen_epoch": "1533965410.182619" }, { "bytes": 259, "stream": 314, "flow_id": "flow-808ef0cdbe5b83a41d346b8b", "packets": 2, "transport": "udp", "last_frame": 39654, "first_frame": 39653, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 49595, "responder_port": 53, "initiator_bytes": 90, "last_seen_epoch": "1533965410.183053", "responder_bytes": 169, "first_seen_epoch": "1533965410.18285" }, { "bytes": 316, "stream": 315, "flow_id": "flow-ab1aec112dde73b1d618b452", "packets": 2, "transport": "udp", "last_frame": 39656, "first_frame": 39655, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 64650, "responder_port": 53, "initiator_bytes": 158, "last_seen_epoch": "1533965410.184627", "responder_bytes": 158, "first_seen_epoch": "1533965410.183603" }, { "bytes": 259, "stream": 316, "flow_id": "flow-fdec6015c1562e9cb82876be", "packets": 2, "transport": "udp", "last_frame": 39658, "first_frame": 39657, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 53076, "responder_port": 53, "initiator_bytes": 90, "last_seen_epoch": "1533965410.185581", "responder_bytes": 169, "first_seen_epoch": "1533965410.185413" }, { "bytes": 316, "stream": 317, "flow_id": "flow-ce4300c8d2615c128c27b965", "packets": 2, "transport": "udp", "last_frame": 39660, "first_frame": 39659, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 52195, "responder_port": 53, "initiator_bytes": 158, "last_seen_epoch": "1533965410.186527", "responder_bytes": 158, "first_seen_epoch": "1533965410.186117" }, { "bytes": 122, "stream": 1045, "flow_id": "flow-9abf5f7fe2c3b6576d65487f", "packets": 2, "transport": "tcp", "last_frame": 39670, "first_frame": 39669, "initiator_ip": "192.168.1.95", "responder_ip": "89.223.92.202", "initiator_port": 50189, "responder_port": 80, "initiator_bytes": 62, "last_seen_epoch": "1533965418.156358", "responder_bytes": 60, "first_seen_epoch": "1533965413.139573" }, { "bytes": 2820, "stream": 1046, "flow_id": "flow-6ae6cdf05de87ed709eb9296", "packets": 18, "transport": "tcp", "last_frame": 39693, "first_frame": 39671, "initiator_ip": "192.168.1.95", "responder_ip": "185.68.93.18", "initiator_port": 50194, "responder_port": 80, "initiator_bytes": 1761, "last_seen_epoch": "1533965425.336289", "responder_bytes": 1059, "first_seen_epoch": "1533965418.157527" }, { "bytes": 1474, "stream": 1047, "flow_id": "flow-fce73ad3d8488e46362a17e5", "packets": 13, "transport": "tcp", "last_frame": 39706, "first_frame": 39694, "initiator_ip": "192.168.1.95", "responder_ip": "185.68.93.18", "initiator_port": 50195, "responder_port": 80, "initiator_bytes": 860, "last_seen_epoch": "1533965441.390454", "responder_bytes": 614, "first_seen_epoch": "1533965435.072652" }, { "bytes": 1474, "stream": 1048, "flow_id": "flow-20dceee27303299c9f2f59c9", "packets": 13, "transport": "tcp", "last_frame": 39719, "first_frame": 39707, "initiator_ip": "192.168.1.95", "responder_ip": "185.68.93.18", "initiator_port": 50196, "responder_port": 80, "initiator_bytes": 860, "last_seen_epoch": "1533965457.49062", "responder_bytes": 614, "first_seen_epoch": "1533965451.374669" }, { "bytes": 1474, "stream": 1049, "flow_id": "flow-a06ff44ce795a6b27ba0cc0c", "packets": 13, "transport": "tcp", "last_frame": 39735, "first_frame": 39720, "initiator_ip": "192.168.1.95", "responder_ip": "185.68.93.18", "initiator_port": 50197, "responder_port": 80, "initiator_bytes": 860, "last_seen_epoch": "1533965474.05128", "responder_bytes": 614, "first_seen_epoch": "1533965467.396093" }, { "bytes": 1474, "stream": 1050, "flow_id": "flow-5c6a688a82a4b2eb404028c9", "packets": 13, "transport": "tcp", "last_frame": 39748, "first_frame": 39736, "initiator_ip": "192.168.1.95", "responder_ip": "185.68.93.18", "initiator_port": 50198, "responder_port": 80, "initiator_bytes": 860, "last_seen_epoch": "1533965490.23177", "responder_bytes": 614, "first_seen_epoch": "1533965483.717588" }, { "bytes": 1474, "stream": 1051, "flow_id": "flow-d9ba6ec6d6763baff9378492", "packets": 13, "transport": "tcp", "last_frame": 39761, "first_frame": 39749, "initiator_ip": "192.168.1.95", "responder_ip": "185.68.93.18", "initiator_port": 50199, "responder_port": 80, "initiator_bytes": 860, "last_seen_epoch": "1533965506.410646", "responder_bytes": 614, "first_seen_epoch": "1533965500.113173" }, { "bytes": 1474, "stream": 1052, "flow_id": "flow-d58a27dba0f4b3b06d355d7f", "packets": 13, "transport": "tcp", "last_frame": 39775, "first_frame": 39762, "initiator_ip": "192.168.1.95", "responder_ip": "185.68.93.18", "initiator_port": 50200, "responder_port": 80, "initiator_bytes": 860, "last_seen_epoch": "1533965522.791289", "responder_bytes": 614, "first_seen_epoch": "1533965516.16174" }, { "bytes": 1474, "stream": 1053, "flow_id": "flow-c2822acbc32185ee6de535a2", "packets": 13, "transport": "tcp", "last_frame": 39790, "first_frame": 39776, "initiator_ip": "192.168.1.95", "responder_ip": "185.68.93.18", "initiator_port": 50201, "responder_port": 80, "initiator_bytes": 860, "last_seen_epoch": "1533965539.660802", "responder_bytes": 614, "first_seen_epoch": "1533965533.813577" }, { "bytes": 1474, "stream": 1054, "flow_id": "flow-bff26abeb15340200ec24490", "packets": 13, "transport": "tcp", "last_frame": 39803, "first_frame": 39791, "initiator_ip": "192.168.1.95", "responder_ip": "185.68.93.18", "initiator_port": 50202, "responder_port": 80, "initiator_bytes": 860, "last_seen_epoch": "1533965555.432397", "responder_bytes": 614, "first_seen_epoch": "1533965548.93344" }, { "bytes": 1474, "stream": 1055, "flow_id": "flow-632e4a9b4df7aa0d0bf7484e", "packets": 13, "transport": "tcp", "last_frame": 39853, "first_frame": 39804, "initiator_ip": "192.168.1.95", "responder_ip": "185.68.93.18", "initiator_port": 50203, "responder_port": 80, "initiator_bytes": 860, "last_seen_epoch": "1533965571.261018", "responder_bytes": 614, "first_seen_epoch": "1533965565.09535" }, { "bytes": 223, "stream": 318, "flow_id": "flow-735b34b5366f95b4a579c353", "packets": 2, "transport": "udp", "last_frame": 39814, "first_frame": 39813, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 52726, "responder_port": 53, "initiator_bytes": 74, "last_seen_epoch": "1533965567.514714", "responder_bytes": 149, "first_seen_epoch": "1533965567.110094" }, { "bytes": 13926, "stream": 1056, "flow_id": "flow-4900610c6791b55ef96f21d2", "packets": 55, "transport": "tcp", "last_frame": 39873, "first_frame": 39815, "initiator_ip": "192.168.1.95", "responder_ip": "87.250.251.37", "initiator_port": 50204, "responder_port": 995, "initiator_bytes": 2041, "last_seen_epoch": "1533965572.650397", "responder_bytes": 11885, "first_seen_epoch": "1533965567.516098" }, { "bytes": 1474, "stream": 1057, "flow_id": "flow-381484fc0a8267f0a854d1eb", "packets": 13, "transport": "tcp", "last_frame": 39886, "first_frame": 39874, "initiator_ip": "192.168.1.95", "responder_ip": "185.68.93.18", "initiator_port": 50205, "responder_port": 80, "initiator_bytes": 860, "last_seen_epoch": "1533965587.586032", "responder_bytes": 614, "first_seen_epoch": "1533965581.294765" }, { "bytes": 1474, "stream": 1058, "flow_id": "flow-82db2a34c690bb6b266a4a37", "packets": 13, "transport": "tcp", "last_frame": 39902, "first_frame": 39890, "initiator_ip": "192.168.1.95", "responder_ip": "185.68.93.18", "initiator_port": 50206, "responder_port": 80, "initiator_bytes": 860, "last_seen_epoch": "1533965603.916527", "responder_bytes": 614, "first_seen_epoch": "1533965597.385655" }, { "bytes": 258, "stream": 319, "flow_id": "flow-a73f431ef12d68bda1169201", "packets": 2, "transport": "udp", "last_frame": 39904, "first_frame": 39903, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 51194, "responder_port": 53, "initiator_bytes": 75, "last_seen_epoch": "1533965605.965885", "responder_bytes": 183, "first_seen_epoch": "1533965605.526057" }, { "bytes": 10169, "stream": 1059, "flow_id": "flow-3211e1ad15f329213467784c", "packets": 47, "transport": "tcp", "last_frame": 39958, "first_frame": 39905, "initiator_ip": "192.168.1.95", "responder_ip": "93.158.134.38", "initiator_port": 50207, "responder_port": 465, "initiator_bytes": 3073, "last_seen_epoch": "1533965614.751986", "responder_bytes": 7096, "first_seen_epoch": "1533965605.967018" }, { "bytes": 1474, "stream": 1060, "flow_id": "flow-ee52237768fb470034e8dfdc", "packets": 13, "transport": "tcp", "last_frame": 39964, "first_frame": 39946, "initiator_ip": "192.168.1.95", "responder_ip": "185.68.93.18", "initiator_port": 50208, "responder_port": 80, "initiator_bytes": 860, "last_seen_epoch": "1533965619.791916", "responder_bytes": 614, "first_seen_epoch": "1533965613.595595" }, { "bytes": 1474, "stream": 1061, "flow_id": "flow-0967540b26ab5417b1313139", "packets": 13, "transport": "tcp", "last_frame": 39977, "first_frame": 39965, "initiator_ip": "192.168.1.95", "responder_ip": "185.68.93.18", "initiator_port": 50209, "responder_port": 80, "initiator_bytes": 860, "last_seen_epoch": "1533965635.764034", "responder_bytes": 614, "first_seen_epoch": "1533965629.748716" }, { "bytes": 1474, "stream": 1062, "flow_id": "flow-556bad3ff82a66f721a8f338", "packets": 13, "transport": "tcp", "last_frame": 39990, "first_frame": 39978, "initiator_ip": "192.168.1.95", "responder_ip": "185.68.93.18", "initiator_port": 50210, "responder_port": 80, "initiator_bytes": 860, "last_seen_epoch": "1533965653.585315", "responder_bytes": 614, "first_seen_epoch": "1533965645.756549" }, { "bytes": 1474, "stream": 1063, "flow_id": "flow-d5d78c761aefcc7d5f8e8663", "packets": 13, "transport": "tcp", "last_frame": 40003, "first_frame": 39991, "initiator_ip": "192.168.1.95", "responder_ip": "185.68.93.18", "initiator_port": 50211, "responder_port": 80, "initiator_bytes": 860, "last_seen_epoch": "1533965668.195896", "responder_bytes": 614, "first_seen_epoch": "1533965662.096757" }, { "bytes": 1474, "stream": 1064, "flow_id": "flow-9abc685d1d4f5dcbcbfe1a63", "packets": 13, "transport": "tcp", "last_frame": 40016, "first_frame": 40004, "initiator_ip": "192.168.1.95", "responder_ip": "185.68.93.18", "initiator_port": 50212, "responder_port": 80, "initiator_bytes": 860, "last_seen_epoch": "1533965684.550033", "responder_bytes": 614, "first_seen_epoch": "1533965678.148707" }, { "bytes": 1474, "stream": 1065, "flow_id": "flow-dda06e0fb079cd1b0f5be2af", "packets": 13, "transport": "tcp", "last_frame": 40029, "first_frame": 40017, "initiator_ip": "192.168.1.95", "responder_ip": "185.68.93.18", "initiator_port": 50213, "responder_port": 80, "initiator_bytes": 860, "last_seen_epoch": "1533965701.722653", "responder_bytes": 614, "first_seen_epoch": "1533965694.547065" }, { "bytes": 1474, "stream": 1066, "flow_id": "flow-7ca20b0eff6ebdab3910764d", "packets": 13, "transport": "tcp", "last_frame": 40045, "first_frame": 40032, "initiator_ip": "192.168.1.95", "responder_ip": "185.68.93.18", "initiator_port": 50214, "responder_port": 80, "initiator_bytes": 860, "last_seen_epoch": "1533965718.27582", "responder_bytes": 614, "first_seen_epoch": "1533965711.07103" }, { "bytes": 1474, "stream": 1067, "flow_id": "flow-6d7e4837572685d1f3a35a3a", "packets": 13, "transport": "tcp", "last_frame": 40058, "first_frame": 40046, "initiator_ip": "192.168.1.95", "responder_ip": "185.68.93.18", "initiator_port": 50215, "responder_port": 80, "initiator_bytes": 860, "last_seen_epoch": "1533965734.602698", "responder_bytes": 614, "first_seen_epoch": "1533965728.568116" }, { "bytes": 1474, "stream": 1068, "flow_id": "flow-c0af05c7b640669a6ab6e074", "packets": 13, "transport": "tcp", "last_frame": 40072, "first_frame": 40059, "initiator_ip": "192.168.1.95", "responder_ip": "185.68.93.18", "initiator_port": 50216, "responder_port": 80, "initiator_bytes": 860, "last_seen_epoch": "1533965750.861927", "responder_bytes": 614, "first_seen_epoch": "1533965744.433461" }, { "bytes": 1474, "stream": 1069, "flow_id": "flow-c7222368184ba20a3502c9b4", "packets": 13, "transport": "tcp", "last_frame": 40085, "first_frame": 40073, "initiator_ip": "192.168.1.95", "responder_ip": "185.68.93.18", "initiator_port": 50217, "responder_port": 80, "initiator_bytes": 860, "last_seen_epoch": "1533965767.169377", "responder_bytes": 614, "first_seen_epoch": "1533965761.028377" }, { "bytes": 241, "stream": 320, "flow_id": "flow-db1af7cf88ad4edaed9a7f99", "packets": 2, "transport": "udp", "last_frame": 40089, "first_frame": 40088, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 55923, "responder_port": 53, "initiator_bytes": 81, "last_seen_epoch": "1533965768.474612", "responder_bytes": 160, "first_seen_epoch": "1533965768.474387" }, { "bytes": 227, "stream": 321, "flow_id": "flow-007e9c49302537fce5e582ad", "packets": 2, "transport": "udp", "last_frame": 40095, "first_frame": 40090, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 50302, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1533965768.531747", "responder_bytes": 151, "first_seen_epoch": "1533965768.474924" }, { "bytes": 392159, "stream": 1070, "flow_id": "flow-2c3a7eb7e8f61ab330ada0f7", "packets": 471, "transport": "tcp", "last_frame": 47107, "first_frame": 40093, "initiator_ip": "192.168.1.95", "responder_ip": "103.5.149.72", "initiator_port": 50218, "responder_port": 80, "initiator_bytes": 22189, "last_seen_epoch": "1533965857.072945", "responder_bytes": 369970, "first_seen_epoch": "1533965768.496173" }, { "bytes": 190797, "stream": 1071, "flow_id": "flow-2e0d6435a10166e716257598", "packets": 214, "transport": "tcp", "last_frame": 47103, "first_frame": 40094, "initiator_ip": "192.168.1.95", "responder_ip": "103.5.149.72", "initiator_port": 50219, "responder_port": 80, "initiator_bytes": 11349, "last_seen_epoch": "1533965856.940221", "responder_bytes": 179448, "first_seen_epoch": "1533965768.496175" }, { "bytes": 128, "stream": 322, "flow_id": "flow-3568a88f6f7f629f6bc8a360", "packets": 2, "transport": "udp", "last_frame": 40097, "first_frame": 40096, "initiator_ip": "192.168.1.95", "responder_ip": "224.0.0.252", "initiator_port": 49345, "responder_port": 5355, "initiator_bytes": 128, "last_seen_epoch": "1533965768.638881", "responder_bytes": 0, "first_seen_epoch": "1533965768.532062" }, { "bytes": 219143, "stream": 1072, "flow_id": "flow-346c9c0a0bb39bf0a7132f75", "packets": 302, "transport": "tcp", "last_frame": 47164, "first_frame": 40115, "initiator_ip": "192.168.1.95", "responder_ip": "103.5.149.72", "initiator_port": 50220, "responder_port": 80, "initiator_bytes": 16177, "last_seen_epoch": "1533965895.833467", "responder_bytes": 202966, "first_seen_epoch": "1533965770.053415" }, { "bytes": 168778, "stream": 1073, "flow_id": "flow-ec56c9116ecfd977bbd81097", "packets": 239, "transport": "tcp", "last_frame": 47100, "first_frame": 40116, "initiator_ip": "192.168.1.95", "responder_ip": "103.5.149.72", "initiator_port": 50221, "responder_port": 80, "initiator_bytes": 15804, "last_seen_epoch": "1533965856.842945", "responder_bytes": 152974, "first_seen_epoch": "1533965770.054283" }, { "bytes": 33961, "stream": 1074, "flow_id": "flow-8e5d9e9054d1e4f65eeb812b", "packets": 59, "transport": "tcp", "last_frame": 43227, "first_frame": 40117, "initiator_ip": "192.168.1.95", "responder_ip": "103.5.149.72", "initiator_port": 50223, "responder_port": 80, "initiator_bytes": 4475, "last_seen_epoch": "1533965778.281656", "responder_bytes": 29486, "first_seen_epoch": "1533965770.054457" }, { "bytes": 34939, "stream": 1075, "flow_id": "flow-0e42f67f265fb8a7119bc92f", "packets": 63, "transport": "tcp", "last_frame": 43116, "first_frame": 40118, "initiator_ip": "192.168.1.95", "responder_ip": "103.5.149.72", "initiator_port": 50222, "responder_port": 80, "initiator_bytes": 5123, "last_seen_epoch": "1533965777.952141", "responder_bytes": 29816, "first_seen_epoch": "1533965770.054562" }, { "bytes": 196, "stream": 323, "flow_id": "flow-927efa20608a640c2db5151e", "packets": 2, "transport": "udp", "last_frame": 40120, "first_frame": 40119, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 50599, "responder_port": 53, "initiator_bytes": 66, "last_seen_epoch": "1533965770.136548", "responder_bytes": 130, "first_seen_epoch": "1533965770.058014" }, { "bytes": 30330, "stream": 1076, "flow_id": "flow-c3f7458afea374b325be3908", "packets": 25, "transport": "tcp", "last_frame": 40507, "first_frame": 40121, "initiator_ip": "192.168.1.95", "responder_ip": "87.240.129.133", "initiator_port": 50224, "responder_port": 80, "initiator_bytes": 1014, "last_seen_epoch": "1533965771.061568", "responder_bytes": 29316, "first_seen_epoch": "1533965770.137502" }, { "bytes": 306, "stream": 1077, "flow_id": "flow-a606adf291f3eeac3c33c14e", "packets": 5, "transport": "tcp", "last_frame": 47009, "first_frame": 40122, "initiator_ip": "192.168.1.95", "responder_ip": "87.240.129.133", "initiator_port": 50225, "responder_port": 80, "initiator_bytes": 186, "last_seen_epoch": "1533965831.410148", "responder_bytes": 120, "first_seen_epoch": "1533965770.13768" }, { "bytes": 180, "stream": 324, "flow_id": "flow-bb6b47c29e88255c5b79404c", "packets": 2, "transport": "udp", "last_frame": 40193, "first_frame": 40130, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 50685, "responder_port": 53, "initiator_bytes": 82, "last_seen_epoch": "1533965770.483961", "responder_bytes": 98, "first_seen_epoch": "1533965770.287434" }, { "bytes": 160, "stream": 325, "flow_id": "flow-88832d3b9dd652bb01e0fe4e", "packets": 2, "transport": "udp", "last_frame": 40223, "first_frame": 40131, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 58360, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1533965770.56936", "responder_bytes": 88, "first_seen_epoch": "1533965770.28801" }, { "bytes": 180, "stream": 326, "flow_id": "flow-69e538fb13e4b825e9543bfd", "packets": 2, "transport": "udp", "last_frame": 40222, "first_frame": 40132, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 54862, "responder_port": 53, "initiator_bytes": 82, "last_seen_epoch": "1533965770.569135", "responder_bytes": 98, "first_seen_epoch": "1533965770.289792" }, { "bytes": 160, "stream": 327, "flow_id": "flow-386b8ec8b04603105b93a2c0", "packets": 2, "transport": "udp", "last_frame": 40215, "first_frame": 40133, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 61950, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1533965770.562042", "responder_bytes": 88, "first_seen_epoch": "1533965770.289999" }, { "bytes": 180, "stream": 328, "flow_id": "flow-e81238ee371f55dd1903272a", "packets": 2, "transport": "udp", "last_frame": 40224, "first_frame": 40134, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 61598, "responder_port": 53, "initiator_bytes": 82, "last_seen_epoch": "1533965770.569362", "responder_bytes": 98, "first_seen_epoch": "1533965770.290547" }, { "bytes": 180, "stream": 329, "flow_id": "flow-67d743c4b6e313606bd7d8bc", "packets": 2, "transport": "udp", "last_frame": 40243, "first_frame": 40137, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 61124, "responder_port": 53, "initiator_bytes": 82, "last_seen_epoch": "1533965770.575466", "responder_bytes": 98, "first_seen_epoch": "1533965770.291819" }, { "bytes": 19882, "stream": 1078, "flow_id": "flow-96809946767f91af0b938570", "packets": 39, "transport": "tcp", "last_frame": 41861, "first_frame": 40194, "initiator_ip": "192.168.1.95", "responder_ip": "151.236.85.22", "initiator_port": 50226, "responder_port": 443, "initiator_bytes": 1939, "last_seen_epoch": "1533965774.814453", "responder_bytes": 17943, "first_seen_epoch": "1533965770.484932" }, { "bytes": 25994, "stream": 1079, "flow_id": "flow-deb3a1ed8fc82f24028ac1c4", "packets": 50, "transport": "tcp", "last_frame": 46410, "first_frame": 40195, "initiator_ip": "192.168.1.95", "responder_ip": "151.236.85.22", "initiator_port": 50227, "responder_port": 443, "initiator_bytes": 2299, "last_seen_epoch": "1533965791.004554", "responder_bytes": 23695, "first_seen_epoch": "1533965770.484934" }, { "bytes": 18435, "stream": 1080, "flow_id": "flow-8527a86c05a4b0f4c18ee3f7", "packets": 33, "transport": "tcp", "last_frame": 46411, "first_frame": 40196, "initiator_ip": "192.168.1.95", "responder_ip": "151.236.85.22", "initiator_port": 50228, "responder_port": 443, "initiator_bytes": 1759, "last_seen_epoch": "1533965791.004875", "responder_bytes": 16676, "first_seen_epoch": "1533965770.485303" }, { "bytes": 23461, "stream": 1081, "flow_id": "flow-96610911c332c2edf1e9ac54", "packets": 40, "transport": "tcp", "last_frame": 43381, "first_frame": 40197, "initiator_ip": "192.168.1.95", "responder_ip": "151.236.85.22", "initiator_port": 50229, "responder_port": 443, "initiator_bytes": 1999, "last_seen_epoch": "1533965778.819668", "responder_bytes": 21462, "first_seen_epoch": "1533965770.485467" }, { "bytes": 28330, "stream": 1082, "flow_id": "flow-c2a6c4e4309b3ea3cebed98a", "packets": 50, "transport": "tcp", "last_frame": 46408, "first_frame": 40198, "initiator_ip": "192.168.1.95", "responder_ip": "151.236.85.22", "initiator_port": 50230, "responder_port": 443, "initiator_bytes": 2299, "last_seen_epoch": "1533965791.004181", "responder_bytes": 26031, "first_seen_epoch": "1533965770.485974" }, { "bytes": 18447, "stream": 1083, "flow_id": "flow-b682e4021a91ecbf0597f459", "packets": 34, "transport": "tcp", "last_frame": 46392, "first_frame": 40199, "initiator_ip": "192.168.1.95", "responder_ip": "151.236.85.22", "initiator_port": 50231, "responder_port": 443, "initiator_bytes": 1819, "last_seen_epoch": "1533965791.002487", "responder_bytes": 16628, "first_seen_epoch": "1533965770.485976" }, { "bytes": 24865, "stream": 1084, "flow_id": "flow-c6b5760c6e4de2248bf6f51f", "packets": 43, "transport": "tcp", "last_frame": 42165, "first_frame": 40216, "initiator_ip": "192.168.1.95", "responder_ip": "91.216.130.22", "initiator_port": 50232, "responder_port": 443, "initiator_bytes": 2225, "last_seen_epoch": "1533965775.740793", "responder_bytes": 22640, "first_seen_epoch": "1533965770.562862" }, { "bytes": 40571, "stream": 1085, "flow_id": "flow-5e8f2345bfc2e72fcab15ab5", "packets": 34, "transport": "tcp", "last_frame": 47050, "first_frame": 40217, "initiator_ip": "192.168.1.95", "responder_ip": "91.216.130.22", "initiator_port": 50233, "responder_port": 443, "initiator_bytes": 1925, "last_seen_epoch": "1533965848.241097", "responder_bytes": 38646, "first_seen_epoch": "1533965770.563031" }, { "bytes": 28450, "stream": 1086, "flow_id": "flow-159283785a24e483bf35dfad", "packets": 34, "transport": "tcp", "last_frame": 42838, "first_frame": 40218, "initiator_ip": "192.168.1.95", "responder_ip": "91.216.130.22", "initiator_port": 50234, "responder_port": 443, "initiator_bytes": 1925, "last_seen_epoch": "1533965777.283387", "responder_bytes": 26525, "first_seen_epoch": "1533965770.563197" }, { "bytes": 21986, "stream": 1087, "flow_id": "flow-c54d61e94d59782028fea830", "packets": 30, "transport": "tcp", "last_frame": 47053, "first_frame": 40219, "initiator_ip": "192.168.1.95", "responder_ip": "91.216.130.22", "initiator_port": 50235, "responder_port": 443, "initiator_bytes": 1805, "last_seen_epoch": "1533965848.628819", "responder_bytes": 20181, "first_seen_epoch": "1533965770.563374" }, { "bytes": 22341, "stream": 1088, "flow_id": "flow-da49cd05d3151f170db51483", "packets": 31, "transport": "tcp", "last_frame": 42767, "first_frame": 40220, "initiator_ip": "192.168.1.95", "responder_ip": "91.216.130.22", "initiator_port": 50236, "responder_port": 443, "initiator_bytes": 1865, "last_seen_epoch": "1533965777.098606", "responder_bytes": 20476, "first_seen_epoch": "1533965770.563376" }, { "bytes": 25857, "stream": 1089, "flow_id": "flow-1417fb5e46203272b1bdf924", "packets": 29, "transport": "tcp", "last_frame": 47051, "first_frame": 40221, "initiator_ip": "192.168.1.95", "responder_ip": "91.216.130.22", "initiator_port": 50237, "responder_port": 443, "initiator_bytes": 1805, "last_seen_epoch": "1533965848.241098", "responder_bytes": 24052, "first_seen_epoch": "1533965770.563853" }, { "bytes": 28675, "stream": 1090, "flow_id": "flow-9f4ddc015e4d746ac2e92b40", "packets": 43, "transport": "tcp", "last_frame": 42882, "first_frame": 40225, "initiator_ip": "192.168.1.95", "responder_ip": "151.236.120.42", "initiator_port": 50238, "responder_port": 443, "initiator_bytes": 2059, "last_seen_epoch": "1533965777.362432", "responder_bytes": 26616, "first_seen_epoch": "1533965770.570159" }, { "bytes": 17842, "stream": 1091, "flow_id": "flow-e0ca52b5c7f7c3aa83fa3909", "packets": 31, "transport": "tcp", "last_frame": 42535, "first_frame": 40226, "initiator_ip": "192.168.1.95", "responder_ip": "151.236.98.22", "initiator_port": 50239, "responder_port": 443, "initiator_bytes": 1699, "last_seen_epoch": "1533965776.508809", "responder_bytes": 16143, "first_seen_epoch": "1533965770.570161" }, { "bytes": 19736, "stream": 1092, "flow_id": "flow-16dd5b18d790eb94b9fcd4de", "packets": 37, "transport": "tcp", "last_frame": 42844, "first_frame": 40227, "initiator_ip": "192.168.1.95", "responder_ip": "151.236.98.22", "initiator_port": 50240, "responder_port": 443, "initiator_bytes": 1879, "last_seen_epoch": "1533965777.284611", "responder_bytes": 17857, "first_seen_epoch": "1533965770.570647" }, { "bytes": 46233, "stream": 1093, "flow_id": "flow-3c44a52a36d6b5ec9f2207cd", "packets": 72, "transport": "tcp", "last_frame": 44518, "first_frame": 40228, "initiator_ip": "192.168.1.95", "responder_ip": "151.236.120.42", "initiator_port": 50241, "responder_port": 443, "initiator_bytes": 3314, "last_seen_epoch": "1533965785.490135", "responder_bytes": 42919, "first_seen_epoch": "1533965770.57065" }, { "bytes": 22456, "stream": 1094, "flow_id": "flow-2ef2cbbe1da7c098ca67db09", "packets": 37, "transport": "tcp", "last_frame": 42874, "first_frame": 40229, "initiator_ip": "192.168.1.95", "responder_ip": "151.236.98.22", "initiator_port": 50242, "responder_port": 443, "initiator_bytes": 1879, "last_seen_epoch": "1533965777.362008", "responder_bytes": 20577, "first_seen_epoch": "1533965770.571167" }, { "bytes": 32903, "stream": 1095, "flow_id": "flow-e650e5499a86aa5383700e40", "packets": 42, "transport": "tcp", "last_frame": 42883, "first_frame": 40230, "initiator_ip": "192.168.1.95", "responder_ip": "151.236.120.42", "initiator_port": 50243, "responder_port": 443, "initiator_bytes": 1999, "last_seen_epoch": "1533965777.36257", "responder_bytes": 30904, "first_seen_epoch": "1533965770.57117" }, { "bytes": 19942, "stream": 1096, "flow_id": "flow-76ffbd81eb8b9462f0229fe8", "packets": 35, "transport": "tcp", "last_frame": 42875, "first_frame": 40231, "initiator_ip": "192.168.1.95", "responder_ip": "151.236.120.42", "initiator_port": 50244, "responder_port": 443, "initiator_bytes": 1819, "last_seen_epoch": "1533965777.362041", "responder_bytes": 18123, "first_seen_epoch": "1533965770.571603" }, { "bytes": 20023, "stream": 1097, "flow_id": "flow-7f8a6796d08837aea1b76866", "packets": 33, "transport": "tcp", "last_frame": 42452, "first_frame": 40232, "initiator_ip": "192.168.1.95", "responder_ip": "91.216.130.21", "initiator_port": 50245, "responder_port": 443, "initiator_bytes": 1925, "last_seen_epoch": "1533965776.304373", "responder_bytes": 18098, "first_seen_epoch": "1533965770.571792" }, { "bytes": 32669, "stream": 1098, "flow_id": "flow-5e5a9613853b157b41195c12", "packets": 51, "transport": "tcp", "last_frame": 47061, "first_frame": 40233, "initiator_ip": "192.168.1.95", "responder_ip": "91.216.130.21", "initiator_port": 50246, "responder_port": 443, "initiator_bytes": 2465, "last_seen_epoch": "1533965848.738069", "responder_bytes": 30204, "first_seen_epoch": "1533965770.571928" }, { "bytes": 24659, "stream": 1099, "flow_id": "flow-6ecb709d552d0f0cdc26ce4a", "packets": 38, "transport": "tcp", "last_frame": 44532, "first_frame": 40234, "initiator_ip": "192.168.1.95", "responder_ip": "151.236.98.22", "initiator_port": 50248, "responder_port": 443, "initiator_bytes": 1939, "last_seen_epoch": "1533965785.493409", "responder_bytes": 22720, "first_seen_epoch": "1533965770.57229" }, { "bytes": 25764, "stream": 1100, "flow_id": "flow-a51222008ae6314b12ac0ca3", "packets": 44, "transport": "tcp", "last_frame": 44510, "first_frame": 40235, "initiator_ip": "192.168.1.95", "responder_ip": "151.236.120.42", "initiator_port": 50247, "responder_port": 443, "initiator_bytes": 2119, "last_seen_epoch": "1533965785.489431", "responder_bytes": 23645, "first_seen_epoch": "1533965770.57233" }, { "bytes": 27043, "stream": 1101, "flow_id": "flow-7a7a6b8f93ba6ab54e575c79", "packets": 46, "transport": "tcp", "last_frame": 47069, "first_frame": 40236, "initiator_ip": "192.168.1.95", "responder_ip": "91.216.130.21", "initiator_port": 50250, "responder_port": 443, "initiator_bytes": 2345, "last_seen_epoch": "1533965848.827753", "responder_bytes": 24698, "first_seen_epoch": "1533965770.572882" }, { "bytes": 40027, "stream": 1102, "flow_id": "flow-51d605354697909d1924fb17", "packets": 58, "transport": "tcp", "last_frame": 42884, "first_frame": 40237, "initiator_ip": "192.168.1.95", "responder_ip": "151.236.120.42", "initiator_port": 50249, "responder_port": 443, "initiator_bytes": 2834, "last_seen_epoch": "1533965777.362572", "responder_bytes": 37193, "first_seen_epoch": "1533965770.573037" }, { "bytes": 19157, "stream": 1103, "flow_id": "flow-3017faa8049e67935149fc9b", "packets": 35, "transport": "tcp", "last_frame": 44506, "first_frame": 40238, "initiator_ip": "192.168.1.95", "responder_ip": "151.236.98.22", "initiator_port": 50251, "responder_port": 443, "initiator_bytes": 1819, "last_seen_epoch": "1533965785.489036", "responder_bytes": 17338, "first_seen_epoch": "1533965770.573294" }, { "bytes": 20812, "stream": 1104, "flow_id": "flow-6e69a3c3f8f54227dae11e60", "packets": 41, "transport": "tcp", "last_frame": 42199, "first_frame": 40239, "initiator_ip": "192.168.1.95", "responder_ip": "151.236.98.22", "initiator_port": 50253, "responder_port": 443, "initiator_bytes": 1999, "last_seen_epoch": "1533965775.803689", "responder_bytes": 18813, "first_seen_epoch": "1533965770.573615" }, { "bytes": 27657, "stream": 1105, "flow_id": "flow-e2441aa8f070e47531b702cf", "packets": 47, "transport": "tcp", "last_frame": 47065, "first_frame": 40240, "initiator_ip": "192.168.1.95", "responder_ip": "91.216.130.21", "initiator_port": 50252, "responder_port": 443, "initiator_bytes": 2345, "last_seen_epoch": "1533965848.783669", "responder_bytes": 25312, "first_seen_epoch": "1533965770.57368" }, { "bytes": 30491, "stream": 1106, "flow_id": "flow-3dfa2406305114d538a26aef", "packets": 49, "transport": "tcp", "last_frame": 47057, "first_frame": 40241, "initiator_ip": "192.168.1.95", "responder_ip": "91.216.130.21", "initiator_port": 50254, "responder_port": 443, "initiator_bytes": 2405, "last_seen_epoch": "1533965848.710002", "responder_bytes": 28086, "first_seen_epoch": "1533965770.573991" }, { "bytes": 53569, "stream": 1107, "flow_id": "flow-a842b7a657b1735149db3d2a", "packets": 66, "transport": "tcp", "last_frame": 47126, "first_frame": 40242, "initiator_ip": "192.168.1.95", "responder_ip": "91.216.130.21", "initiator_port": 50255, "responder_port": 443, "initiator_bytes": 3360, "last_seen_epoch": "1533965866.69376", "responder_bytes": 50209, "first_seen_epoch": "1533965770.574023" }, { "bytes": 24973, "stream": 1108, "flow_id": "flow-892ed524089e8685eae80fd2", "packets": 42, "transport": "tcp", "last_frame": 46388, "first_frame": 40244, "initiator_ip": "192.168.1.95", "responder_ip": "109.201.156.81", "initiator_port": 50256, "responder_port": 443, "initiator_bytes": 2059, "last_seen_epoch": "1533965791.002258", "responder_bytes": 22914, "first_seen_epoch": "1533965770.576109" }, { "bytes": 22253, "stream": 1109, "flow_id": "flow-b3fdf5e058b1280b22cbf8c1", "packets": 38, "transport": "tcp", "last_frame": 46384, "first_frame": 40245, "initiator_ip": "192.168.1.95", "responder_ip": "109.201.156.81", "initiator_port": 50257, "responder_port": 443, "initiator_bytes": 1879, "last_seen_epoch": "1533965791.001945", "responder_bytes": 20374, "first_seen_epoch": "1533965770.57611" }, { "bytes": 21323, "stream": 1110, "flow_id": "flow-37099dfa0f992dd5bb198a74", "packets": 35, "transport": "tcp", "last_frame": 46365, "first_frame": 40246, "initiator_ip": "192.168.1.95", "responder_ip": "109.201.156.81", "initiator_port": 50258, "responder_port": 443, "initiator_bytes": 1819, "last_seen_epoch": "1533965790.99975", "responder_bytes": 19504, "first_seen_epoch": "1533965770.5764" }, { "bytes": 23707, "stream": 1111, "flow_id": "flow-82da5ffa1c1eee0823a3eb91", "packets": 40, "transport": "tcp", "last_frame": 46379, "first_frame": 40247, "initiator_ip": "192.168.1.95", "responder_ip": "109.201.156.81", "initiator_port": 50259, "responder_port": 443, "initiator_bytes": 1999, "last_seen_epoch": "1533965791.001442", "responder_bytes": 21708, "first_seen_epoch": "1533965770.576517" }, { "bytes": 30556, "stream": 1112, "flow_id": "flow-7e0cb22b22b4500cb331d06d", "packets": 52, "transport": "tcp", "last_frame": 46394, "first_frame": 40248, "initiator_ip": "192.168.1.95", "responder_ip": "109.201.156.81", "initiator_port": 50260, "responder_port": 443, "initiator_bytes": 2359, "last_seen_epoch": "1533965791.002728", "responder_bytes": 28197, "first_seen_epoch": "1533965770.576743" }, { "bytes": 19959, "stream": 1113, "flow_id": "flow-558c0ae7e65ebbe70a31bfa5", "packets": 42, "transport": "tcp", "last_frame": 46400, "first_frame": 40249, "initiator_ip": "192.168.1.95", "responder_ip": "109.201.156.81", "initiator_port": 50261, "responder_port": 443, "initiator_bytes": 2059, "last_seen_epoch": "1533965791.003356", "responder_bytes": 17900, "first_seen_epoch": "1533965770.576827" }, { "bytes": 22505, "stream": 1114, "flow_id": "flow-e122ecba7cdab586cbc6b557", "packets": 39, "transport": "tcp", "last_frame": 46382, "first_frame": 40463, "initiator_ip": "192.168.1.95", "responder_ip": "151.236.85.22", "initiator_port": 50265, "responder_port": 443, "initiator_bytes": 1939, "last_seen_epoch": "1533965791.001769", "responder_bytes": 20566, "first_seen_epoch": "1533965770.919562" }, { "bytes": 24944, "stream": 1115, "flow_id": "flow-4049351153ee807c58775235", "packets": 43, "transport": "tcp", "last_frame": 47075, "first_frame": 40464, "initiator_ip": "192.168.1.95", "responder_ip": "91.216.130.22", "initiator_port": 50264, "responder_port": 443, "initiator_bytes": 2225, "last_seen_epoch": "1533965850.2886", "responder_bytes": 22719, "first_seen_epoch": "1533965770.919782" }, { "bytes": 53620, "stream": 1116, "flow_id": "flow-8dd095a2b96262dd1b4b5416", "packets": 75, "transport": "tcp", "last_frame": 47134, "first_frame": 40465, "initiator_ip": "192.168.1.95", "responder_ip": "91.216.130.21", "initiator_port": 50262, "responder_port": 443, "initiator_bytes": 3600, "last_seen_epoch": "1533965866.731663", "responder_bytes": 50020, "first_seen_epoch": "1533965770.920215" }, { "bytes": 21652, "stream": 1117, "flow_id": "flow-187e9df487e647994d13c383", "packets": 33, "transport": "tcp", "last_frame": 42718, "first_frame": 40466, "initiator_ip": "192.168.1.95", "responder_ip": "151.236.98.22", "initiator_port": 50266, "responder_port": 443, "initiator_bytes": 1759, "last_seen_epoch": "1533965776.974031", "responder_bytes": 19893, "first_seen_epoch": "1533965770.920563" }, { "bytes": 29317, "stream": 1118, "flow_id": "flow-6922cfa808c17caaa73db9c1", "packets": 49, "transport": "tcp", "last_frame": 47076, "first_frame": 40467, "initiator_ip": "192.168.1.95", "responder_ip": "91.216.130.22", "initiator_port": 50263, "responder_port": 443, "initiator_bytes": 2405, "last_seen_epoch": "1533965850.288719", "responder_bytes": 26912, "first_seen_epoch": "1533965770.920771" }, { "bytes": 30716, "stream": 1119, "flow_id": "flow-2100dbfb81d96f81dd21ea49", "packets": 52, "transport": "tcp", "last_frame": 44529, "first_frame": 40468, "initiator_ip": "192.168.1.95", "responder_ip": "151.236.98.22", "initiator_port": 50267, "responder_port": 443, "initiator_bytes": 2359, "last_seen_epoch": "1533965785.493052", "responder_bytes": 28357, "first_seen_epoch": "1533965770.920919" }, { "bytes": 22362, "stream": 1120, "flow_id": "flow-fdb24100fa54421d8b2993a9", "packets": 39, "transport": "tcp", "last_frame": 42617, "first_frame": 40469, "initiator_ip": "192.168.1.95", "responder_ip": "151.236.120.42", "initiator_port": 50268, "responder_port": 443, "initiator_bytes": 1939, "last_seen_epoch": "1533965776.735195", "responder_bytes": 20423, "first_seen_epoch": "1533965770.921219" }, { "bytes": 27257, "stream": 1121, "flow_id": "flow-c632616ce4ef583463f03e9e", "packets": 49, "transport": "tcp", "last_frame": 42881, "first_frame": 40470, "initiator_ip": "192.168.1.95", "responder_ip": "151.236.120.42", "initiator_port": 50269, "responder_port": 443, "initiator_bytes": 2239, "last_seen_epoch": "1533965777.36243", "responder_bytes": 25018, "first_seen_epoch": "1533965770.921426" }, { "bytes": 20336, "stream": 1122, "flow_id": "flow-e8c9b10f32749e65fe15fb5f", "packets": 36, "transport": "tcp", "last_frame": 44508, "first_frame": 40739, "initiator_ip": "192.168.1.95", "responder_ip": "151.236.120.42", "initiator_port": 50270, "responder_port": 443, "initiator_bytes": 1836, "last_seen_epoch": "1533965785.489122", "responder_bytes": 18500, "first_seen_epoch": "1533965771.47795" }, { "bytes": 24258, "stream": 1123, "flow_id": "flow-12dedd0ef33175586e378702", "packets": 44, "transport": "tcp", "last_frame": 44495, "first_frame": 40740, "initiator_ip": "192.168.1.95", "responder_ip": "151.236.120.42", "initiator_port": 50271, "responder_port": 443, "initiator_bytes": 2016, "last_seen_epoch": "1533965785.488066", "responder_bytes": 22242, "first_seen_epoch": "1533965771.478293" }, { "bytes": 18323, "stream": 1124, "flow_id": "flow-4f7a95693e2c52fa456f10de", "packets": 38, "transport": "tcp", "last_frame": 44526, "first_frame": 40741, "initiator_ip": "192.168.1.95", "responder_ip": "151.236.98.22", "initiator_port": 50272, "responder_port": 443, "initiator_bytes": 1896, "last_seen_epoch": "1533965785.492753", "responder_bytes": 16427, "first_seen_epoch": "1533965771.478295" }, { "bytes": 86680, "stream": 1125, "flow_id": "flow-b70649602c5e0ba9fb9b0dc7", "packets": 121, "transport": "tcp", "last_frame": 47130, "first_frame": 40742, "initiator_ip": "192.168.1.95", "responder_ip": "91.216.130.22", "initiator_port": 50273, "responder_port": 443, "initiator_bytes": 5084, "last_seen_epoch": "1533965866.711641", "responder_bytes": 81596, "first_seen_epoch": "1533965771.478625" }, { "bytes": 22206, "stream": 1126, "flow_id": "flow-a8cfef6ecc23c84fdefb9168", "packets": 34, "transport": "tcp", "last_frame": 44523, "first_frame": 40743, "initiator_ip": "192.168.1.95", "responder_ip": "151.236.98.22", "initiator_port": 50274, "responder_port": 443, "initiator_bytes": 1776, "last_seen_epoch": "1533965785.491924", "responder_bytes": 20430, "first_seen_epoch": "1533965771.478984" }, { "bytes": 22026, "stream": 1127, "flow_id": "flow-1c7bbf529cadab7c667ba0cc", "packets": 41, "transport": "tcp", "last_frame": 44515, "first_frame": 40983, "initiator_ip": "192.168.1.95", "responder_ip": "151.236.98.22", "initiator_port": 50276, "responder_port": 443, "initiator_bytes": 1956, "last_seen_epoch": "1533965785.489805", "responder_bytes": 20070, "first_seen_epoch": "1533965773.83984" }, { "bytes": 18795, "stream": 1128, "flow_id": "flow-7063303a1ae3852a02ea74b9", "packets": 36, "transport": "tcp", "last_frame": 44503, "first_frame": 40984, "initiator_ip": "192.168.1.95", "responder_ip": "151.236.120.42", "initiator_port": 50277, "responder_port": 443, "initiator_bytes": 1836, "last_seen_epoch": "1533965785.48885", "responder_bytes": 16959, "first_seen_epoch": "1533965773.839849" }, { "bytes": 20660, "stream": 1129, "flow_id": "flow-d10a723b0a47286d28dc077e", "packets": 40, "transport": "tcp", "last_frame": 44498, "first_frame": 40985, "initiator_ip": "192.168.1.95", "responder_ip": "151.236.120.42", "initiator_port": 50275, "responder_port": 443, "initiator_bytes": 1896, "last_seen_epoch": "1533965785.48846", "responder_bytes": 18764, "first_seen_epoch": "1533965773.839986" }, { "bytes": 247207, "stream": 1130, "flow_id": "flow-08a31a3dc9ca6245bc384bf5", "packets": 310, "transport": "tcp", "last_frame": 47101, "first_frame": 40986, "initiator_ip": "192.168.1.95", "responder_ip": "103.5.149.72", "initiator_port": 50278, "responder_port": 80, "initiator_bytes": 15452, "last_seen_epoch": "1533965856.842947", "responder_bytes": 231755, "first_seen_epoch": "1533965773.840021" }, { "bytes": 32853, "stream": 1131, "flow_id": "flow-c4f594d2d0137eb91bc5a277", "packets": 47, "transport": "tcp", "last_frame": 43272, "first_frame": 40987, "initiator_ip": "192.168.1.95", "responder_ip": "103.5.149.72", "initiator_port": 50279, "responder_port": 80, "initiator_bytes": 3077, "last_seen_epoch": "1533965778.48598", "responder_bytes": 29776, "first_seen_epoch": "1533965773.840276" }, { "bytes": 292, "stream": 330, "flow_id": "flow-f9fabfb1fd0f8a8b133f16f5", "packets": 3, "transport": "udp", "last_frame": 41619, "first_frame": 41222, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 54139, "responder_port": 53, "initiator_bytes": 144, "last_seen_epoch": "1533965774.364956", "responder_bytes": 148, "first_seen_epoch": "1533965772.517902" }, { "bytes": 462, "stream": 331, "flow_id": "flow-65e8c118207cc812896d7e13", "packets": 4, "transport": "udp", "last_frame": 41618, "first_frame": 41223, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 54958, "responder_port": 53, "initiator_bytes": 144, "last_seen_epoch": "1533965774.364689", "responder_bytes": 318, "first_seen_epoch": "1533965772.517905" }, { "bytes": 657, "stream": 332, "flow_id": "flow-27026484be5babf36c745953", "packets": 6, "transport": "udp", "last_frame": 43421, "first_frame": 41224, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 65367, "responder_port": 53, "initiator_bytes": 288, "last_seen_epoch": "1533965778.973203", "responder_bytes": 369, "first_seen_epoch": "1533965772.518384" }, { "bytes": 1007, "stream": 333, "flow_id": "flow-6a60b7ab44e6114984b32433", "packets": 8, "transport": "udp", "last_frame": 43419, "first_frame": 41225, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 64470, "responder_port": 53, "initiator_bytes": 288, "last_seen_epoch": "1533965778.972999", "responder_bytes": 719, "first_seen_epoch": "1533965772.518739" }, { "bytes": 1018, "stream": 334, "flow_id": "flow-79335cb1f8e1d264695a4d04", "packets": 8, "transport": "udp", "last_frame": 43418, "first_frame": 41226, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 56128, "responder_port": 53, "initiator_bytes": 288, "last_seen_epoch": "1533965778.972933", "responder_bytes": 730, "first_seen_epoch": "1533965772.519191" }, { "bytes": 1018, "stream": 335, "flow_id": "flow-a522b85cee6cdef377029c86", "packets": 8, "transport": "udp", "last_frame": 43420, "first_frame": 41227, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 64483, "responder_port": 53, "initiator_bytes": 288, "last_seen_epoch": "1533965778.973091", "responder_bytes": 730, "first_seen_epoch": "1533965772.519388" }, { "bytes": 22541, "stream": 1132, "flow_id": "flow-65171b5db27c85207d32ccf3", "packets": 30, "transport": "tcp", "last_frame": 43236, "first_frame": 41336, "initiator_ip": "192.168.1.95", "responder_ip": "103.5.149.72", "initiator_port": 50281, "responder_port": 80, "initiator_bytes": 2568, "last_seen_epoch": "1533965778.293988", "responder_bytes": 19973, "first_seen_epoch": "1533965772.952551" }, { "bytes": 167859, "stream": 1133, "flow_id": "flow-804b3217bb6c2e0346300287", "packets": 201, "transport": "tcp", "last_frame": 47105, "first_frame": 41337, "initiator_ip": "192.168.1.95", "responder_ip": "103.5.149.72", "initiator_port": 50280, "responder_port": 80, "initiator_bytes": 10403, "last_seen_epoch": "1533965856.984467", "responder_bytes": 157456, "first_seen_epoch": "1533965772.952559" }, { "bytes": 30177, "stream": 1134, "flow_id": "flow-c68f5de37384699b7973d67f", "packets": 48, "transport": "tcp", "last_frame": 43235, "first_frame": 41529, "initiator_ip": "192.168.1.95", "responder_ip": "103.5.149.72", "initiator_port": 50283, "responder_port": 80, "initiator_bytes": 2563, "last_seen_epoch": "1533965778.293986", "responder_bytes": 27614, "first_seen_epoch": "1533965774.04596" }, { "bytes": 7490, "stream": 1135, "flow_id": "flow-0b4d5101ee964b65652956d4", "packets": 18, "transport": "tcp", "last_frame": 43158, "first_frame": 41530, "initiator_ip": "192.168.1.95", "responder_ip": "103.5.149.72", "initiator_port": 50282, "responder_port": 80, "initiator_bytes": 1624, "last_seen_epoch": "1533965778.043751", "responder_bytes": 5866, "first_seen_epoch": "1533965774.046226" }, { "bytes": 1474, "stream": 1136, "flow_id": "flow-0376b93d440930abff54cf30", "packets": 13, "transport": "tcp", "last_frame": 43912, "first_frame": 42819, "initiator_ip": "192.168.1.95", "responder_ip": "185.68.93.18", "initiator_port": 50284, "responder_port": 80, "initiator_bytes": 860, "last_seen_epoch": "1533965783.781487", "responder_bytes": 614, "first_seen_epoch": "1533965777.242904" }, { "bytes": 226, "stream": 336, "flow_id": "flow-aadd2d9226f267436859d5f2", "packets": 2, "transport": "udp", "last_frame": 43648, "first_frame": 43637, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 64289, "responder_port": 53, "initiator_bytes": 85, "last_seen_epoch": "1533965783.044158", "responder_bytes": 141, "first_seen_epoch": "1533965782.964876" }, { "bytes": 224, "stream": 337, "flow_id": "flow-253fd4c87d4d6701cf860295", "packets": 2, "transport": "udp", "last_frame": 43651, "first_frame": 43638, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 56976, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1533965783.060399", "responder_bytes": 152, "first_seen_epoch": "1533965783.001053" }, { "bytes": 166, "stream": 338, "flow_id": "flow-4b61387b9ede7d24ff5353d7", "packets": 2, "transport": "udp", "last_frame": 43659, "first_frame": 43639, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 49370, "responder_port": 53, "initiator_bytes": 75, "last_seen_epoch": "1533965783.084459", "responder_bytes": 91, "first_seen_epoch": "1533965783.004773" }, { "bytes": 228, "stream": 339, "flow_id": "flow-6143daf4fa7e51f6b521baba", "packets": 2, "transport": "udp", "last_frame": 43662, "first_frame": 43640, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 64443, "responder_port": 53, "initiator_bytes": 84, "last_seen_epoch": "1533965783.090968", "responder_bytes": 144, "first_seen_epoch": "1533965783.005376" }, { "bytes": 504, "stream": 340, "flow_id": "flow-bb50cb2523812de0d2d08c8e", "packets": 2, "transport": "udp", "last_frame": 43654, "first_frame": 43641, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 52111, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1533965783.076721", "responder_bytes": 428, "first_seen_epoch": "1533965783.022652" }, { "bytes": 220, "stream": 341, "flow_id": "flow-a478811fe897f633790623ff", "packets": 2, "transport": "udp", "last_frame": 43643, "first_frame": 43642, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 63575, "responder_port": 53, "initiator_bytes": 78, "last_seen_epoch": "1533965783.028284", "responder_bytes": 142, "first_seen_epoch": "1533965783.028088" }, { "bytes": 2486, "stream": 1137, "flow_id": "flow-e9de47d085f78b61d53be72d", "packets": 13, "transport": "tcp", "last_frame": 47006, "first_frame": 43644, "initiator_ip": "192.168.1.95", "responder_ip": "194.226.130.228", "initiator_port": 50285, "responder_port": 80, "initiator_bytes": 1128, "last_seen_epoch": "1533965829.564234", "responder_bytes": 1358, "first_seen_epoch": "1533965783.028698" }, { "bytes": 186, "stream": 1138, "flow_id": "flow-0d32da174e12c26f731f7b06", "packets": 3, "transport": "tcp", "last_frame": 43726, "first_frame": 43645, "initiator_ip": "192.168.1.95", "responder_ip": "194.226.130.228", "initiator_port": 50286, "responder_port": 80, "initiator_bytes": 126, "last_seen_epoch": "1533965783.254198", "responder_bytes": 60, "first_seen_epoch": "1533965783.028843" }, { "bytes": 208, "stream": 342, "flow_id": "flow-ef739cd57c476a2129da9088", "packets": 2, "transport": "udp", "last_frame": 43674, "first_frame": 43646, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 51278, "responder_port": 53, "initiator_bytes": 80, "last_seen_epoch": "1533965783.128458", "responder_bytes": 128, "first_seen_epoch": "1533965783.030794" }, { "bytes": 336, "stream": 343, "flow_id": "flow-ad778f62d6164d1f2716a5bc", "packets": 2, "transport": "udp", "last_frame": 43671, "first_frame": 43647, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 58784, "responder_port": 53, "initiator_bytes": 80, "last_seen_epoch": "1533965783.112888", "responder_bytes": 256, "first_seen_epoch": "1533965783.031263" }, { "bytes": 9404, "stream": 1139, "flow_id": "flow-cc66eb44a51780904ce05261", "packets": 15, "transport": "tcp", "last_frame": 43721, "first_frame": 43649, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.194.162", "initiator_port": 50287, "responder_port": 80, "initiator_bytes": 776, "last_seen_epoch": "1533965783.225725", "responder_bytes": 8628, "first_seen_epoch": "1533965783.044536" }, { "bytes": 186, "stream": 1140, "flow_id": "flow-6fc48a3b1acf0a85e5f52664", "packets": 3, "transport": "tcp", "last_frame": 43666, "first_frame": 43650, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.194.162", "initiator_port": 50288, "responder_port": 80, "initiator_bytes": 126, "last_seen_epoch": "1533965783.09766", "responder_bytes": 60, "first_seen_epoch": "1533965783.044731" }, { "bytes": 5981, "stream": 1141, "flow_id": "flow-56aef602db82d431c242c763", "packets": 19, "transport": "tcp", "last_frame": 47029, "first_frame": 43652, "initiator_ip": "192.168.1.95", "responder_ip": "93.158.134.90", "initiator_port": 50289, "responder_port": 443, "initiator_bytes": 874, "last_seen_epoch": "1533965844.349839", "responder_bytes": 5107, "first_seen_epoch": "1533965783.061296" }, { "bytes": 7208, "stream": 1142, "flow_id": "flow-eadd4c9be80b3d12b68cec8a", "packets": 23, "transport": "tcp", "last_frame": 46899, "first_frame": 43653, "initiator_ip": "192.168.1.95", "responder_ip": "93.158.134.90", "initiator_port": 50290, "responder_port": 443, "initiator_bytes": 1485, "last_seen_epoch": "1533965794.656207", "responder_bytes": 5723, "first_seen_epoch": "1533965783.061668" }, { "bytes": 1315, "stream": 1143, "flow_id": "flow-e46680f125c8c1c81e82cdf3", "packets": 11, "transport": "tcp", "last_frame": 43961, "first_frame": 43655, "initiator_ip": "192.168.1.95", "responder_ip": "88.212.196.103", "initiator_port": 50291, "responder_port": 80, "initiator_bytes": 758, "last_seen_epoch": "1533965783.849312", "responder_bytes": 557, "first_seen_epoch": "1533965783.077482" }, { "bytes": 1297, "stream": 1144, "flow_id": "flow-11545b957084a75e3eaa5da9", "packets": 10, "transport": "tcp", "last_frame": 43955, "first_frame": 43656, "initiator_ip": "192.168.1.95", "responder_ip": "88.212.196.103", "initiator_port": 50292, "responder_port": 80, "initiator_bytes": 707, "last_seen_epoch": "1533965783.844449", "responder_bytes": 590, "first_seen_epoch": "1533965783.077661" }, { "bytes": 246, "stream": 1145, "flow_id": "flow-885e31662ca8e4c08eb5a705", "packets": 4, "transport": "tcp", "last_frame": 46917, "first_frame": 43660, "initiator_ip": "192.168.1.95", "responder_ip": "74.119.117.100", "initiator_port": 50293, "responder_port": 80, "initiator_bytes": 126, "last_seen_epoch": "1533965797.636964", "responder_bytes": 120, "first_seen_epoch": "1533965783.084914" }, { "bytes": 1470, "stream": 1146, "flow_id": "flow-abf555ff0f1c793609fecdbb", "packets": 8, "transport": "tcp", "last_frame": 46916, "first_frame": 43661, "initiator_ip": "192.168.1.95", "responder_ip": "74.119.117.100", "initiator_port": 50294, "responder_port": 80, "initiator_bytes": 600, "last_seen_epoch": "1533965797.004236", "responder_bytes": 870, "first_seen_epoch": "1533965783.085123" }, { "bytes": 56185, "stream": 1147, "flow_id": "flow-9925d759831915ca5d2524c6", "packets": 65, "transport": "tcp", "last_frame": 44011, "first_frame": 43663, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.192.8", "initiator_port": 50295, "responder_port": 80, "initiator_bytes": 2222, "last_seen_epoch": "1533965783.936684", "responder_bytes": 53963, "first_seen_epoch": "1533965783.091622" }, { "bytes": 186, "stream": 1148, "flow_id": "flow-3ed66ebadac4ddfc580e665a", "packets": 3, "transport": "tcp", "last_frame": 43697, "first_frame": 43664, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.192.8", "initiator_port": 50296, "responder_port": 80, "initiator_bytes": 126, "last_seen_epoch": "1533965783.176438", "responder_bytes": 60, "first_seen_epoch": "1533965783.091753" }, { "bytes": 306, "stream": 1149, "flow_id": "flow-5ac398eda64929aafc3e2f9d", "packets": 5, "transport": "tcp", "last_frame": 47027, "first_frame": 43672, "initiator_ip": "192.168.1.95", "responder_ip": "192.229.163.25", "initiator_port": 50297, "responder_port": 80, "initiator_bytes": 186, "last_seen_epoch": "1533965844.349571", "responder_bytes": 120, "first_seen_epoch": "1533965783.113408" }, { "bytes": 38440, "stream": 1150, "flow_id": "flow-7af57c9889188fbf5f22f954", "packets": 41, "transport": "tcp", "last_frame": 43812, "first_frame": 43673, "initiator_ip": "192.168.1.95", "responder_ip": "192.229.163.25", "initiator_port": 50298, "responder_port": 80, "initiator_bytes": 1548, "last_seen_epoch": "1533965783.596384", "responder_bytes": 36892, "first_seen_epoch": "1533965783.113583" }, { "bytes": 73912, "stream": 1151, "flow_id": "flow-a5bb12931d5dbe0d045ce85f", "packets": 87, "transport": "tcp", "last_frame": 43967, "first_frame": 43675, "initiator_ip": "192.168.1.95", "responder_ip": "157.240.11.22", "initiator_port": 50299, "responder_port": 80, "initiator_bytes": 2930, "last_seen_epoch": "1533965783.85857", "responder_bytes": 70982, "first_seen_epoch": "1533965783.129179" }, { "bytes": 186, "stream": 1152, "flow_id": "flow-43dd7a152f7297e31d50aa1d", "packets": 3, "transport": "tcp", "last_frame": 43693, "first_frame": 43676, "initiator_ip": "192.168.1.95", "responder_ip": "157.240.11.22", "initiator_port": 50300, "responder_port": 80, "initiator_bytes": 126, "last_seen_epoch": "1533965783.175609", "responder_bytes": 60, "first_seen_epoch": "1533965783.129367" }, { "bytes": 208, "stream": 344, "flow_id": "flow-58f4fdb342abac9cbcf38194", "packets": 2, "transport": "udp", "last_frame": 43729, "first_frame": 43677, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 60901, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1533965783.276443", "responder_bytes": 136, "first_seen_epoch": "1533965783.159102" }, { "bytes": 216, "stream": 345, "flow_id": "flow-e1d4b609043dfb7b74e5f6fe", "packets": 2, "transport": "udp", "last_frame": 43840, "first_frame": 43722, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 60183, "responder_port": 53, "initiator_bytes": 80, "last_seen_epoch": "1533965783.630277", "responder_bytes": 136, "first_seen_epoch": "1533965783.242495" }, { "bytes": 14232, "stream": 1153, "flow_id": "flow-a20a5999c05475345edfb0a4", "packets": 37, "transport": "tcp", "last_frame": 47039, "first_frame": 43730, "initiator_ip": "192.168.1.95", "responder_ip": "93.158.134.119", "initiator_port": 50301, "responder_port": 443, "initiator_bytes": 5401, "last_seen_epoch": "1533965846.80779", "responder_bytes": 8831, "first_seen_epoch": "1533965783.276862" }, { "bytes": 8178, "stream": 1154, "flow_id": "flow-facb721f7111a72a08194ceb", "packets": 25, "transport": "tcp", "last_frame": 47035, "first_frame": 43731, "initiator_ip": "192.168.1.95", "responder_ip": "93.158.134.119", "initiator_port": 50302, "responder_port": 443, "initiator_bytes": 2304, "last_seen_epoch": "1533965846.257073", "responder_bytes": 5874, "first_seen_epoch": "1533965783.277022" }, { "bytes": 5814, "stream": 1155, "flow_id": "flow-d4f9c3a6afaa0416ee3785cb", "packets": 17, "transport": "tcp", "last_frame": 44219, "first_frame": 43841, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.194.162", "initiator_port": 50303, "responder_port": 443, "initiator_bytes": 1158, "last_seen_epoch": "1533965784.462599", "responder_bytes": 4656, "first_seen_epoch": "1533965783.630817" }, { "bytes": 4560, "stream": 1156, "flow_id": "flow-733dd78bb1d7919c8cfee076", "packets": 15, "transport": "tcp", "last_frame": 44149, "first_frame": 43842, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.194.162", "initiator_port": 50304, "responder_port": 443, "initiator_bytes": 762, "last_seen_epoch": "1533965784.337203", "responder_bytes": 3798, "first_seen_epoch": "1533965783.630818" }, { "bytes": 222, "stream": 346, "flow_id": "flow-e9bd44d90e77b4a5d6a921ea", "packets": 2, "transport": "udp", "last_frame": 44008, "first_frame": 43899, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 62752, "responder_port": 53, "initiator_bytes": 90, "last_seen_epoch": "1533965783.935554", "responder_bytes": 132, "first_seen_epoch": "1533965783.77112" }, { "bytes": 16338, "stream": 1157, "flow_id": "flow-5431ab15ae965f3d6b69bf08", "packets": 21, "transport": "tcp", "last_frame": 44430, "first_frame": 44014, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.192.2", "initiator_port": 50305, "responder_port": 443, "initiator_bytes": 2183, "last_seen_epoch": "1533965785.325915", "responder_bytes": 14155, "first_seen_epoch": "1533965783.944974" }, { "bytes": 16241, "stream": 1158, "flow_id": "flow-04b7d340a0006e943689caf6", "packets": 33, "transport": "tcp", "last_frame": 44721, "first_frame": 44015, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.192.2", "initiator_port": 50306, "responder_port": 443, "initiator_bytes": 3355, "last_seen_epoch": "1533965786.048225", "responder_bytes": 12886, "first_seen_epoch": "1533965783.945357" }, { "bytes": 16507, "stream": 1159, "flow_id": "flow-67a5c6394ec8ec110dd40ee1", "packets": 29, "transport": "tcp", "last_frame": 44390, "first_frame": 44016, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.192.2", "initiator_port": 50307, "responder_port": 443, "initiator_bytes": 2422, "last_seen_epoch": "1533965785.084608", "responder_bytes": 14085, "first_seen_epoch": "1533965783.945534" }, { "bytes": 6838, "stream": 1160, "flow_id": "flow-32c72954c21bbbf77eec1ba5", "packets": 21, "transport": "tcp", "last_frame": 44491, "first_frame": 44017, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.192.2", "initiator_port": 50308, "responder_port": 443, "initiator_bytes": 2155, "last_seen_epoch": "1533965785.453907", "responder_bytes": 4683, "first_seen_epoch": "1533965783.945795" }, { "bytes": 58402, "stream": 1161, "flow_id": "flow-b159b11c0ea65476f1e26e7a", "packets": 85, "transport": "tcp", "last_frame": 45392, "first_frame": 44018, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.192.2", "initiator_port": 50309, "responder_port": 443, "initiator_bytes": 6180, "last_seen_epoch": "1533965787.64486", "responder_bytes": 52222, "first_seen_epoch": "1533965783.945978" }, { "bytes": 6671, "stream": 1162, "flow_id": "flow-563030c0c7bdd9e171c685d1", "packets": 21, "transport": "tcp", "last_frame": 44620, "first_frame": 44019, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.192.2", "initiator_port": 50310, "responder_port": 443, "initiator_bytes": 2195, "last_seen_epoch": "1533965785.932564", "responder_bytes": 4476, "first_seen_epoch": "1533965783.946137" }, { "bytes": 13626, "stream": 1163, "flow_id": "flow-28e91052947da7264470ecbe", "packets": 33, "transport": "tcp", "last_frame": 45424, "first_frame": 44078, "initiator_ip": "192.168.1.95", "responder_ip": "192.229.163.25", "initiator_port": 50311, "responder_port": 443, "initiator_bytes": 2220, "last_seen_epoch": "1533965787.730584", "responder_bytes": 11406, "first_seen_epoch": "1533965784.065742" }, { "bytes": 229, "stream": 347, "flow_id": "flow-f6c95f812186b2b40a5ffb28", "packets": 2, "transport": "udp", "last_frame": 44193, "first_frame": 44102, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 60201, "responder_port": 53, "initiator_bytes": 85, "last_seen_epoch": "1533965784.401633", "responder_bytes": 144, "first_seen_epoch": "1533965784.176878" }, { "bytes": 213, "stream": 348, "flow_id": "flow-6cd90bceac2cc5795e9b0344", "packets": 2, "transport": "udp", "last_frame": 44214, "first_frame": 44116, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 56430, "responder_port": 53, "initiator_bytes": 81, "last_seen_epoch": "1533965784.461656", "responder_bytes": 132, "first_seen_epoch": "1533965784.194344" }, { "bytes": 245, "stream": 349, "flow_id": "flow-19755b93827ee9670efee0fe", "packets": 2, "transport": "udp", "last_frame": 44215, "first_frame": 44127, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 60530, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1533965784.462482", "responder_bytes": 173, "first_seen_epoch": "1533965784.244464" }, { "bytes": 280, "stream": 350, "flow_id": "flow-301017c9eb072f0b368eac53", "packets": 2, "transport": "udp", "last_frame": 44229, "first_frame": 44128, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 56510, "responder_port": 53, "initiator_bytes": 75, "last_seen_epoch": "1533965784.476926", "responder_bytes": 205, "first_seen_epoch": "1533965784.248113" }, { "bytes": 228, "stream": 351, "flow_id": "flow-8f2ee67c30a487a28df46617", "packets": 2, "transport": "udp", "last_frame": 44230, "first_frame": 44137, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 55436, "responder_port": 53, "initiator_bytes": 84, "last_seen_epoch": "1533965784.477104", "responder_bytes": 144, "first_seen_epoch": "1533965784.278556" }, { "bytes": 5534, "stream": 1164, "flow_id": "flow-0c70fe7408be1588e9d9bfc1", "packets": 19, "transport": "tcp", "last_frame": 45379, "first_frame": 44174, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.192.2", "initiator_port": 50312, "responder_port": 443, "initiator_bytes": 3080, "last_seen_epoch": "1533965787.587944", "responder_bytes": 2454, "first_seen_epoch": "1533965784.387049" }, { "bytes": 2849, "stream": 1165, "flow_id": "flow-4352222c7ecc77dd91072b2f", "packets": 11, "transport": "tcp", "last_frame": 44724, "first_frame": 44198, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.192.1", "initiator_port": 50313, "responder_port": 80, "initiator_bytes": 649, "last_seen_epoch": "1533965786.084613", "responder_bytes": 2200, "first_seen_epoch": "1533965784.402756" }, { "bytes": 2997, "stream": 1166, "flow_id": "flow-3d3cb3e63d71266724829b6a", "packets": 13, "transport": "tcp", "last_frame": 44795, "first_frame": 44201, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.192.1", "initiator_port": 50314, "responder_port": 80, "initiator_bytes": 743, "last_seen_epoch": "1533965786.355962", "responder_bytes": 2254, "first_seen_epoch": "1533965784.403864" }, { "bytes": 39645, "stream": 1167, "flow_id": "flow-e0597626563f372065d22e30", "packets": 63, "transport": "tcp", "last_frame": 47085, "first_frame": 44222, "initiator_ip": "192.168.1.95", "responder_ip": "142.93.61.37", "initiator_port": 50315, "responder_port": 443, "initiator_bytes": 2585, "last_seen_epoch": "1533965852.336307", "responder_bytes": 37060, "first_seen_epoch": "1533965784.463646" }, { "bytes": 21062, "stream": 1168, "flow_id": "flow-fec7e36799f9680e38136e6b", "packets": 37, "transport": "tcp", "last_frame": 44914, "first_frame": 44223, "initiator_ip": "192.168.1.95", "responder_ip": "157.240.11.22", "initiator_port": 50316, "responder_port": 443, "initiator_bytes": 1775, "last_seen_epoch": "1533965786.501232", "responder_bytes": 19287, "first_seen_epoch": "1533965784.463735" }, { "bytes": 4411, "stream": 1169, "flow_id": "flow-c9a61a3fff81d4c8f9c627b8", "packets": 15, "transport": "tcp", "last_frame": 44754, "first_frame": 44224, "initiator_ip": "192.168.1.95", "responder_ip": "157.240.11.22", "initiator_port": 50317, "responder_port": 443, "initiator_bytes": 763, "last_seen_epoch": "1533965786.190497", "responder_bytes": 3648, "first_seen_epoch": "1533965784.463833" }, { "bytes": 7692, "stream": 1170, "flow_id": "flow-1eaceb700d5af9fa5faf524d", "packets": 19, "transport": "tcp", "last_frame": 47033, "first_frame": 44225, "initiator_ip": "192.168.1.95", "responder_ip": "142.93.61.37", "initiator_port": 50318, "responder_port": 443, "initiator_bytes": 914, "last_seen_epoch": "1533965845.578721", "responder_bytes": 6778, "first_seen_epoch": "1533965784.463834" }, { "bytes": 198, "stream": 352, "flow_id": "flow-6233e59e4f64704a9ac16db6", "packets": 2, "transport": "udp", "last_frame": 44343, "first_frame": 44228, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 63411, "responder_port": 53, "initiator_bytes": 83, "last_seen_epoch": "1533965785.001653", "responder_bytes": 115, "first_seen_epoch": "1533965784.469953" }, { "bytes": 7690, "stream": 1171, "flow_id": "flow-2b519d68800896e01fc141fe", "packets": 23, "transport": "tcp", "last_frame": 46311, "first_frame": 44231, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.192.14", "initiator_port": 50321, "responder_port": 443, "initiator_bytes": 2532, "last_seen_epoch": "1533965790.494167", "responder_bytes": 5158, "first_seen_epoch": "1533965784.477619" }, { "bytes": 26808, "stream": 1172, "flow_id": "flow-12d76cfd7ec18ccb9d4a2895", "packets": 53, "transport": "tcp", "last_frame": 46273, "first_frame": 44232, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.192.14", "initiator_port": 50320, "responder_port": 443, "initiator_bytes": 4534, "last_seen_epoch": "1533965790.434919", "responder_bytes": 22274, "first_seen_epoch": "1533965784.477621" }, { "bytes": 6424, "stream": 1173, "flow_id": "flow-f7ddf4a7371ffdc51eb07b16", "packets": 19, "transport": "tcp", "last_frame": 44966, "first_frame": 44233, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.192.14", "initiator_port": 50319, "responder_port": 443, "initiator_bytes": 1230, "last_seen_epoch": "1533965786.573921", "responder_bytes": 5194, "first_seen_epoch": "1533965784.477783" }, { "bytes": 4555, "stream": 1174, "flow_id": "flow-1d4e715d7a1f6918ac0b59aa", "packets": 15, "transport": "tcp", "last_frame": 44786, "first_frame": 44234, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.192.14", "initiator_port": 50322, "responder_port": 443, "initiator_bytes": 757, "last_seen_epoch": "1533965786.354699", "responder_bytes": 3798, "first_seen_epoch": "1533965784.47795" }, { "bytes": 6520, "stream": 1175, "flow_id": "flow-9d39a2e5854075d02545bfe6", "packets": 19, "transport": "tcp", "last_frame": 45063, "first_frame": 44344, "initiator_ip": "192.168.1.95", "responder_ip": "199.59.149.201", "initiator_port": 50323, "responder_port": 443, "initiator_bytes": 1548, "last_seen_epoch": "1533965786.768662", "responder_bytes": 4972, "first_seen_epoch": "1533965785.002143" }, { "bytes": 8966, "stream": 1176, "flow_id": "flow-b2a153d81a269d1d376d628f", "packets": 22, "transport": "tcp", "last_frame": 45216, "first_frame": 44345, "initiator_ip": "192.168.1.95", "responder_ip": "199.59.149.201", "initiator_port": 50324, "responder_port": 443, "initiator_bytes": 3927, "last_seen_epoch": "1533965787.190205", "responder_bytes": 5039, "first_seen_epoch": "1533965785.002269" }, { "bytes": 234, "stream": 353, "flow_id": "flow-8ed0ed4a3ce2d338c3a2a5ee", "packets": 2, "transport": "udp", "last_frame": 44701, "first_frame": 44401, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 55051, "responder_port": 53, "initiator_bytes": 89, "last_seen_epoch": "1533965786.043701", "responder_bytes": 145, "first_seen_epoch": "1533965785.103477" }, { "bytes": 50768, "stream": 1177, "flow_id": "flow-1b48e0b396aaf9e85806fc1b", "packets": 77, "transport": "tcp", "last_frame": 45657, "first_frame": 44435, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.192.1", "initiator_port": 50325, "responder_port": 443, "initiator_bytes": 3417, "last_seen_epoch": "1533965788.435836", "responder_bytes": 47351, "first_seen_epoch": "1533965785.354274" }, { "bytes": 42536, "stream": 1178, "flow_id": "flow-6ff7c8855c3b9721a51a9548", "packets": 67, "transport": "tcp", "last_frame": 45581, "first_frame": 44436, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.192.1", "initiator_port": 50326, "responder_port": 443, "initiator_bytes": 3117, "last_seen_epoch": "1533965788.235417", "responder_bytes": 39419, "first_seen_epoch": "1533965785.355818" }, { "bytes": 61421, "stream": 1179, "flow_id": "flow-76f49e91aa2263a359fe70e8", "packets": 82, "transport": "tcp", "last_frame": 45601, "first_frame": 44437, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.192.1", "initiator_port": 50327, "responder_port": 443, "initiator_bytes": 3713, "last_seen_epoch": "1533965788.263545", "responder_bytes": 57708, "first_seen_epoch": "1533965785.361966" }, { "bytes": 29058, "stream": 1180, "flow_id": "flow-328e9c3797a04c740a7354bb", "packets": 39, "transport": "tcp", "last_frame": 46889, "first_frame": 44519, "initiator_ip": "192.168.1.95", "responder_ip": "151.236.120.42", "initiator_port": 50328, "responder_port": 443, "initiator_bytes": 1896, "last_seen_epoch": "1533965793.923173", "responder_bytes": 27162, "first_seen_epoch": "1533965785.490523" }, { "bytes": 1295, "stream": 1181, "flow_id": "flow-46bc51368db60f4eb12f00e3", "packets": 13, "transport": "tcp", "last_frame": 47043, "first_frame": 44520, "initiator_ip": "192.168.1.95", "responder_ip": "151.236.120.42", "initiator_port": 50329, "responder_port": 443, "initiator_bytes": 701, "last_seen_epoch": "1533965846.842356", "responder_bytes": 594, "first_seen_epoch": "1533965785.490872" }, { "bytes": 57746, "stream": 1182, "flow_id": "flow-0e6efc67a7c5b6fafa321ab2", "packets": 77, "transport": "tcp", "last_frame": 46911, "first_frame": 44533, "initiator_ip": "192.168.1.95", "responder_ip": "151.236.98.22", "initiator_port": 50330, "responder_port": 443, "initiator_bytes": 3467, "last_seen_epoch": "1533965796.792866", "responder_bytes": 54279, "first_seen_epoch": "1533965785.493646" }, { "bytes": 19041, "stream": 1183, "flow_id": "flow-190159b1c8800081fcc93eae", "packets": 37, "transport": "tcp", "last_frame": 46915, "first_frame": 44534, "initiator_ip": "192.168.1.95", "responder_ip": "151.236.98.22", "initiator_port": 50331, "responder_port": 443, "initiator_bytes": 1852, "last_seen_epoch": "1533965796.870681", "responder_bytes": 17189, "first_seen_epoch": "1533965785.493844" }, { "bytes": 212, "stream": 354, "flow_id": "flow-b94672343b23b8e9b9ea1cb7", "packets": 2, "transport": "udp", "last_frame": 44732, "first_frame": 44597, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 52612, "responder_port": 53, "initiator_bytes": 80, "last_seen_epoch": "1533965786.093172", "responder_bytes": 132, "first_seen_epoch": "1533965785.837646" }, { "bytes": 75390, "stream": 1184, "flow_id": "flow-c25f6c0e97d23781715499c0", "packets": 107, "transport": "tcp", "last_frame": 45795, "first_frame": 44598, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.192.1", "initiator_port": 50332, "responder_port": 443, "initiator_bytes": 4509, "last_seen_epoch": "1533965788.829502", "responder_bytes": 70881, "first_seen_epoch": "1533965785.850646" }, { "bytes": 181732, "stream": 1185, "flow_id": "flow-507977220d242eb7e695e96e", "packets": 228, "transport": "tcp", "last_frame": 46061, "first_frame": 44600, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.192.1", "initiator_port": 50333, "responder_port": 443, "initiator_bytes": 7582, "last_seen_epoch": "1533965789.672194", "responder_bytes": 174150, "first_seen_epoch": "1533965785.850911" }, { "bytes": 3435, "stream": 1186, "flow_id": "flow-54512d0f754782b6bbabf6ea", "packets": 40, "transport": "tcp", "last_frame": 46551, "first_frame": 44702, "initiator_ip": "192.168.1.95", "responder_ip": "103.5.149.77", "initiator_port": 50334, "responder_port": 8080, "initiator_bytes": 2017, "last_seen_epoch": "1533965791.711191", "responder_bytes": 1418, "first_seen_epoch": "1533965786.044259" }, { "bytes": 29302, "stream": 1187, "flow_id": "flow-6501137b368c70db251294ab", "packets": 38, "transport": "tcp", "last_frame": 45010, "first_frame": 44703, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.194.162", "initiator_port": 50335, "responder_port": 80, "initiator_bytes": 1440, "last_seen_epoch": "1533965786.714413", "responder_bytes": 27862, "first_seen_epoch": "1533965786.04446" }, { "bytes": 186, "stream": 1188, "flow_id": "flow-c969f3a3348ae02ec2f6919a", "packets": 3, "transport": "tcp", "last_frame": 44809, "first_frame": 44704, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.194.162", "initiator_port": 50336, "responder_port": 80, "initiator_bytes": 126, "last_seen_epoch": "1533965786.358813", "responder_bytes": 60, "first_seen_epoch": "1533965786.044662" }, { "bytes": 34594, "stream": 1189, "flow_id": "flow-0e08672dfbf148d7d436f569", "packets": 59, "transport": "tcp", "last_frame": 45666, "first_frame": 44705, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.192.1", "initiator_port": 50337, "responder_port": 443, "initiator_bytes": 2973, "last_seen_epoch": "1533965788.446049", "responder_bytes": 31621, "first_seen_epoch": "1533965786.044832" }, { "bytes": 1422, "stream": 1190, "flow_id": "flow-a901ff09cac374ec028329fa", "packets": 9, "transport": "tcp", "last_frame": 44999, "first_frame": 44733, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.192.10", "initiator_port": 50338, "responder_port": 80, "initiator_bytes": 632, "last_seen_epoch": "1533965786.618065", "responder_bytes": 790, "first_seen_epoch": "1533965786.093877" }, { "bytes": 1422, "stream": 1191, "flow_id": "flow-adb960890cea237b360e90a8", "packets": 9, "transport": "tcp", "last_frame": 45012, "first_frame": 44734, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.192.10", "initiator_port": 50339, "responder_port": 80, "initiator_bytes": 632, "last_seen_epoch": "1533965786.714848", "responder_bytes": 790, "first_seen_epoch": "1533965786.094143" }, { "bytes": 252, "stream": 355, "flow_id": "flow-43340657ab3e500887bada37", "packets": 2, "transport": "udp", "last_frame": 45074, "first_frame": 44973, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 50052, "responder_port": 53, "initiator_bytes": 83, "last_seen_epoch": "1533965786.80803", "responder_bytes": 169, "first_seen_epoch": "1533965786.582537" }, { "bytes": 968, "stream": 1192, "flow_id": "flow-1a2990369c9e74438f055d46", "packets": 9, "transport": "tcp", "last_frame": 45305, "first_frame": 44988, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.192.14", "initiator_port": 50340, "responder_port": 443, "initiator_bytes": 567, "last_seen_epoch": "1533965787.330483", "responder_bytes": 401, "first_seen_epoch": "1533965786.597039" }, { "bytes": 190, "stream": 356, "flow_id": "flow-1f54aa06fce6b8bc361ef3df", "packets": 2, "transport": "udp", "last_frame": 45110, "first_frame": 44989, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 62437, "responder_port": 53, "initiator_bytes": 71, "last_seen_epoch": "1533965786.890742", "responder_bytes": 119, "first_seen_epoch": "1533965786.599954" }, { "bytes": 206, "stream": 357, "flow_id": "flow-bf82ebe528173133c226c7d9", "packets": 2, "transport": "udp", "last_frame": 45116, "first_frame": 45000, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 61202, "responder_port": 53, "initiator_bytes": 77, "last_seen_epoch": "1533965786.910754", "responder_bytes": 129, "first_seen_epoch": "1533965786.627493" }, { "bytes": 5454, "stream": 1193, "flow_id": "flow-527e441e0976edf25f2efdae", "packets": 17, "transport": "tcp", "last_frame": 45863, "first_frame": 45076, "initiator_ip": "192.168.1.95", "responder_ip": "74.125.195.155", "initiator_port": 50341, "responder_port": 443, "initiator_bytes": 1382, "last_seen_epoch": "1533965789.148465", "responder_bytes": 4072, "first_seen_epoch": "1533965786.809416" }, { "bytes": 4987, "stream": 1194, "flow_id": "flow-b05e879602b5f6e2ef211ffe", "packets": 17, "transport": "tcp", "last_frame": 45871, "first_frame": 45077, "initiator_ip": "192.168.1.95", "responder_ip": "74.125.195.155", "initiator_port": 50342, "responder_port": 443, "initiator_bytes": 1380, "last_seen_epoch": "1533965789.163967", "responder_bytes": 3607, "first_seen_epoch": "1533965786.809662" }, { "bytes": 14212, "stream": 1195, "flow_id": "flow-2a4dc85fe203eca7b93f238a", "packets": 31, "transport": "tcp", "last_frame": 45873, "first_frame": 45111, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.192.14", "initiator_port": 50343, "responder_port": 443, "initiator_bytes": 1575, "last_seen_epoch": "1533965789.172567", "responder_bytes": 12637, "first_seen_epoch": "1533965786.891236" }, { "bytes": 4551, "stream": 1196, "flow_id": "flow-fe72ae04e86935dee0bdf1b8", "packets": 15, "transport": "tcp", "last_frame": 45739, "first_frame": 45112, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.192.14", "initiator_port": 50344, "responder_port": 443, "initiator_bytes": 753, "last_seen_epoch": "1533965788.592082", "responder_bytes": 3798, "first_seen_epoch": "1533965786.89139" }, { "bytes": 302, "stream": 358, "flow_id": "flow-8743700fa089747573b0f462", "packets": 2, "transport": "udp", "last_frame": 45340, "first_frame": 45115, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 54643, "responder_port": 53, "initiator_bytes": 71, "last_seen_epoch": "1533965787.454378", "responder_bytes": 231, "first_seen_epoch": "1533965786.906355" }, { "bytes": 22711, "stream": 1197, "flow_id": "flow-257e1b631800fce9ce299a64", "packets": 35, "transport": "tcp", "last_frame": 45740, "first_frame": 45117, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.192.3", "initiator_port": 50345, "responder_port": 80, "initiator_bytes": 1462, "last_seen_epoch": "1533965788.592106", "responder_bytes": 21249, "first_seen_epoch": "1533965786.91135" }, { "bytes": 22569, "stream": 1198, "flow_id": "flow-ad9cd9f820f0b4f1de34a324", "packets": 33, "transport": "tcp", "last_frame": 45741, "first_frame": 45118, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.192.3", "initiator_port": 50346, "responder_port": 80, "initiator_bytes": 1402, "last_seen_epoch": "1533965788.592257", "responder_bytes": 21167, "first_seen_epoch": "1533965786.911475" }, { "bytes": 6290, "stream": 1199, "flow_id": "flow-a0010308f1a776329fef7f61", "packets": 21, "transport": "tcp", "last_frame": 46318, "first_frame": 45275, "initiator_ip": "192.168.1.95", "responder_ip": "74.125.195.155", "initiator_port": 50347, "responder_port": 443, "initiator_bytes": 2043, "last_seen_epoch": "1533965790.59716", "responder_bytes": 4247, "first_seen_epoch": "1533965787.310047" }, { "bytes": 9755, "stream": 1200, "flow_id": "flow-af02dae7715db7cd35be1616", "packets": 25, "transport": "tcp", "last_frame": 46802, "first_frame": 45341, "initiator_ip": "192.168.1.95", "responder_ip": "136.243.151.13", "initiator_port": 50349, "responder_port": 443, "initiator_bytes": 1923, "last_seen_epoch": "1533965792.577212", "responder_bytes": 7832, "first_seen_epoch": "1533965787.456309" }, { "bytes": 10045, "stream": 1201, "flow_id": "flow-9f1e84dea9590c2c68413db5", "packets": 26, "transport": "tcp", "last_frame": 46764, "first_frame": 45342, "initiator_ip": "192.168.1.95", "responder_ip": "136.243.151.13", "initiator_port": 50348, "responder_port": 443, "initiator_bytes": 2724, "last_seen_epoch": "1533965792.441218", "responder_bytes": 7321, "first_seen_epoch": "1533965787.456312" }, { "bytes": 9502, "stream": 1202, "flow_id": "flow-86b2a21fc68d0bce3124356c", "packets": 27, "transport": "tcp", "last_frame": 46436, "first_frame": 45485, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.194.162", "initiator_port": 50350, "responder_port": 443, "initiator_bytes": 3433, "last_seen_epoch": "1533965791.350153", "responder_bytes": 6069, "first_seen_epoch": "1533965788.011939" }, { "bytes": 215, "stream": 359, "flow_id": "flow-63b25fa1671458aed225f27a", "packets": 2, "transport": "udp", "last_frame": 45830, "first_frame": 45612, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 55542, "responder_port": 53, "initiator_bytes": 87, "last_seen_epoch": "1533965789.081206", "responder_bytes": 128, "first_seen_epoch": "1533965788.303184" }, { "bytes": 5725, "stream": 1203, "flow_id": "flow-c37735008dfbcb3cf5ce3601", "packets": 17, "transport": "tcp", "last_frame": 45988, "first_frame": 45615, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.194.162", "initiator_port": 50351, "responder_port": 443, "initiator_bytes": 1223, "last_seen_epoch": "1533965789.43398", "responder_bytes": 4502, "first_seen_epoch": "1533965788.305" }, { "bytes": 5837, "stream": 1204, "flow_id": "flow-d289c48c429e22fbd0273565", "packets": 19, "transport": "tcp", "last_frame": 46020, "first_frame": 45618, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.194.162", "initiator_port": 50352, "responder_port": 443, "initiator_bytes": 1283, "last_seen_epoch": "1533965789.533584", "responder_bytes": 4554, "first_seen_epoch": "1533965788.320701" }, { "bytes": 164, "stream": 360, "flow_id": "flow-9aa538592b8929cbc0166fbc", "packets": 2, "transport": "udp", "last_frame": 45837, "first_frame": 45622, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 53554, "responder_port": 53, "initiator_bytes": 74, "last_seen_epoch": "1533965789.095261", "responder_bytes": 90, "first_seen_epoch": "1533965788.343931" }, { "bytes": 4818, "stream": 1205, "flow_id": "flow-6bf46d965946cab0cb7b6555", "packets": 15, "transport": "tcp", "last_frame": 46058, "first_frame": 45835, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.194.162", "initiator_port": 50353, "responder_port": 443, "initiator_bytes": 1230, "last_seen_epoch": "1533965789.668516", "responder_bytes": 3588, "first_seen_epoch": "1533965789.083403" }, { "bytes": 7403, "stream": 1206, "flow_id": "flow-9aa92ef312679bfea22b555f", "packets": 23, "transport": "tcp", "last_frame": 46261, "first_frame": 45836, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.194.162", "initiator_port": 50354, "responder_port": 443, "initiator_bytes": 2224, "last_seen_epoch": "1533965790.230643", "responder_bytes": 5179, "first_seen_epoch": "1533965789.083444" }, { "bytes": 186, "stream": 1207, "flow_id": "flow-cd9f0d775263591d4d414f82", "packets": 3, "transport": "tcp", "last_frame": 45899, "first_frame": 45838, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.192.4", "initiator_port": 50355, "responder_port": 80, "initiator_bytes": 126, "last_seen_epoch": "1533965789.194894", "responder_bytes": 60, "first_seen_epoch": "1533965789.095909" }, { "bytes": 1068, "stream": 1208, "flow_id": "flow-37ca17e0514de10a41f9d0c4", "packets": 6, "transport": "tcp", "last_frame": 45962, "first_frame": 45839, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.192.4", "initiator_port": 50356, "responder_port": 80, "initiator_bytes": 644, "last_seen_epoch": "1533965789.40511", "responder_bytes": 424, "first_seen_epoch": "1533965789.096176" }, { "bytes": 3562, "stream": 1209, "flow_id": "flow-9c9415442356b3cc8c7790a4", "packets": 11, "transport": "tcp", "last_frame": 46018, "first_frame": 45852, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.194.162", "initiator_port": 50357, "responder_port": 443, "initiator_bytes": 651, "last_seen_epoch": "1533965789.532851", "responder_bytes": 2911, "first_seen_epoch": "1533965789.116082" }, { "bytes": 5786, "stream": 1210, "flow_id": "flow-130b3b626730e66868245d4c", "packets": 21, "transport": "tcp", "last_frame": 46158, "first_frame": 45865, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.192.4", "initiator_port": 50358, "responder_port": 443, "initiator_bytes": 1647, "last_seen_epoch": "1533965789.832745", "responder_bytes": 4139, "first_seen_epoch": "1533965789.150179" }, { "bytes": 281, "stream": 361, "flow_id": "flow-3ca3cae3cc4c82e83913c6f7", "packets": 2, "transport": "udp", "last_frame": 46077, "first_frame": 45975, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 60922, "responder_port": 53, "initiator_bytes": 73, "last_seen_epoch": "1533965789.700898", "responder_bytes": 208, "first_seen_epoch": "1533965789.421325" }, { "bytes": 199, "stream": 362, "flow_id": "flow-4ee2c72d9df94bc75d36ea2c", "packets": 2, "transport": "udp", "last_frame": 46032, "first_frame": 45976, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 64141, "responder_port": 53, "initiator_bytes": 80, "last_seen_epoch": "1533965789.555893", "responder_bytes": 119, "first_seen_epoch": "1533965789.422175" }, { "bytes": 215, "stream": 363, "flow_id": "flow-da6731d94f235bfb8f318b09", "packets": 2, "transport": "udp", "last_frame": 46038, "first_frame": 45993, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 64494, "responder_port": 53, "initiator_bytes": 79, "last_seen_epoch": "1533965789.567878", "responder_bytes": 136, "first_seen_epoch": "1533965789.443122" }, { "bytes": 327, "stream": 364, "flow_id": "flow-a161e1f32feb9fc2606a1899", "packets": 2, "transport": "udp", "last_frame": 46080, "first_frame": 46027, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 49826, "responder_port": 53, "initiator_bytes": 81, "last_seen_epoch": "1533965789.714227", "responder_bytes": 246, "first_seen_epoch": "1533965789.539672" }, { "bytes": 6096, "stream": 1211, "flow_id": "flow-f756b1cf84f6a48451e6b629", "packets": 21, "transport": "tcp", "last_frame": 46257, "first_frame": 46033, "initiator_ip": "192.168.1.95", "responder_ip": "172.217.6.66", "initiator_port": 50359, "responder_port": 443, "initiator_bytes": 1999, "last_seen_epoch": "1533965790.158148", "responder_bytes": 4097, "first_seen_epoch": "1533965789.556495" }, { "bytes": 6096, "stream": 1212, "flow_id": "flow-b9c30286bd539ceba25460cc", "packets": 21, "transport": "tcp", "last_frame": 46254, "first_frame": 46034, "initiator_ip": "192.168.1.95", "responder_ip": "172.217.6.66", "initiator_port": 50360, "responder_port": 443, "initiator_bytes": 1997, "last_seen_epoch": "1533965790.155786", "responder_bytes": 4099, "first_seen_epoch": "1533965789.556738" }, { "bytes": 5961, "stream": 1213, "flow_id": "flow-5cf9fec60375b4346c6af295", "packets": 19, "transport": "tcp", "last_frame": 46251, "first_frame": 46035, "initiator_ip": "192.168.1.95", "responder_ip": "172.217.6.66", "initiator_port": 50361, "responder_port": 443, "initiator_bytes": 1918, "last_seen_epoch": "1533965790.12431", "responder_bytes": 4043, "first_seen_epoch": "1533965789.55698" }, { "bytes": 4488, "stream": 1214, "flow_id": "flow-99e67c89ca6088664c848cee", "packets": 13, "transport": "tcp", "last_frame": 46225, "first_frame": 46041, "initiator_ip": "192.168.1.95", "responder_ip": "74.6.34.27", "initiator_port": 50362, "responder_port": 443, "initiator_bytes": 741, "last_seen_epoch": "1533965789.984302", "responder_bytes": 3747, "first_seen_epoch": "1533965789.568688" }, { "bytes": 7051, "stream": 1215, "flow_id": "flow-131ddb7e10532b41f8707e66", "packets": 17, "transport": "tcp", "last_frame": 46905, "first_frame": 46044, "initiator_ip": "192.168.1.95", "responder_ip": "74.6.34.27", "initiator_port": 50363, "responder_port": 443, "initiator_bytes": 1388, "last_seen_epoch": "1533965795.576993", "responder_bytes": 5663, "first_seen_epoch": "1533965789.569117" }, { "bytes": 1030, "stream": 1216, "flow_id": "flow-93ef4c27fc04eca015df524a", "packets": 11, "transport": "tcp", "last_frame": 46971, "first_frame": 46075, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.192.4", "initiator_port": 50364, "responder_port": 443, "initiator_bytes": 593, "last_seen_epoch": "1533965799.829564", "responder_bytes": 437, "first_seen_epoch": "1533965789.697115" }, { "bytes": 2040, "stream": 1217, "flow_id": "flow-24dc96e17fdd7c5cf93c365b", "packets": 13, "transport": "tcp", "last_frame": 46247, "first_frame": 46076, "initiator_ip": "192.168.1.95", "responder_ip": "216.58.192.4", "initiator_port": 50365, "responder_port": 443, "initiator_bytes": 938, "last_seen_epoch": "1533965790.088762", "responder_bytes": 1102, "first_seen_epoch": "1533965789.700076" }, { "bytes": 6178, "stream": 1218, "flow_id": "flow-aee3855d4fe6875fff79b057", "packets": 16, "transport": "tcp", "last_frame": 47077, "first_frame": 46078, "initiator_ip": "192.168.1.95", "responder_ip": "23.108.108.218", "initiator_port": 50367, "responder_port": 443, "initiator_bytes": 795, "last_seen_epoch": "1533965850.288721", "responder_bytes": 5383, "first_seen_epoch": "1533965789.701868" }, { "bytes": 7432, "stream": 1219, "flow_id": "flow-138f631230270bb0ed1ceb8e", "packets": 17, "transport": "tcp", "last_frame": 46994, "first_frame": 46079, "initiator_ip": "192.168.1.95", "responder_ip": "23.108.108.218", "initiator_port": 50366, "responder_port": 443, "initiator_bytes": 1414, "last_seen_epoch": "1533965820.182958", "responder_bytes": 6018, "first_seen_epoch": "1533965789.701899" }, { "bytes": 5027, "stream": 1220, "flow_id": "flow-0102ea49d12e19824c0c90c6", "packets": 19, "transport": "tcp", "last_frame": 47097, "first_frame": 46081, "initiator_ip": "192.168.1.95", "responder_ip": "52.9.78.114", "initiator_port": 50368, "responder_port": 443, "initiator_bytes": 923, "last_seen_epoch": "1533965855.332717", "responder_bytes": 4104, "first_seen_epoch": "1533965789.715178" }, { "bytes": 6849, "stream": 1221, "flow_id": "flow-32a17d712b511fd884e9fabe", "packets": 23, "transport": "tcp", "last_frame": 47096, "first_frame": 46082, "initiator_ip": "192.168.1.95", "responder_ip": "52.9.78.114", "initiator_port": 50369, "responder_port": 443, "initiator_bytes": 1570, "last_seen_epoch": "1533965855.332441", "responder_bytes": 5279, "first_seen_epoch": "1533965789.715332" }, { "bytes": 200, "stream": 365, "flow_id": "flow-9781beeee2d6001976757bb5", "packets": 2, "transport": "udp", "last_frame": 46422, "first_frame": 46366, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 51980, "responder_port": 53, "initiator_bytes": 68, "last_seen_epoch": "1533965791.276701", "responder_bytes": 132, "first_seen_epoch": "1533965791.000009" }, { "bytes": 907, "stream": 1222, "flow_id": "flow-257436e0f2d7448a7ffb5964", "packets": 9, "transport": "tcp", "last_frame": 47091, "first_frame": 46397, "initiator_ip": "192.168.1.95", "responder_ip": "109.201.156.81", "initiator_port": 50370, "responder_port": 443, "initiator_bytes": 496, "last_seen_epoch": "1533965852.336557", "responder_bytes": 411, "first_seen_epoch": "1533965791.003133" }, { "bytes": 907, "stream": 1223, "flow_id": "flow-0564b8fc3a27c7f9651c2dba", "packets": 9, "transport": "tcp", "last_frame": 47092, "first_frame": 46399, "initiator_ip": "192.168.1.95", "responder_ip": "109.201.156.81", "initiator_port": 50371, "responder_port": 443, "initiator_bytes": 496, "last_seen_epoch": "1533965852.336571", "responder_bytes": 411, "first_seen_epoch": "1533965791.003355" }, { "bytes": 907, "stream": 1224, "flow_id": "flow-2b5022596ae413d3529a57c2", "packets": 9, "transport": "tcp", "last_frame": 47090, "first_frame": 46407, "initiator_ip": "192.168.1.95", "responder_ip": "151.236.85.22", "initiator_port": 50372, "responder_port": 443, "initiator_bytes": 496, "last_seen_epoch": "1533965852.336499", "responder_bytes": 411, "first_seen_epoch": "1533965791.004179" }, { "bytes": 907, "stream": 1225, "flow_id": "flow-bef60633744590ad34b96513", "packets": 9, "transport": "tcp", "last_frame": 47093, "first_frame": 46409, "initiator_ip": "192.168.1.95", "responder_ip": "151.236.85.22", "initiator_port": 50373, "responder_port": 443, "initiator_bytes": 496, "last_seen_epoch": "1533965852.336673", "responder_bytes": 411, "first_seen_epoch": "1533965791.004327" }, { "bytes": 5461, "stream": 1226, "flow_id": "flow-eec42bc013ce1f720ae00f8c", "packets": 15, "transport": "tcp", "last_frame": 46984, "first_frame": 46423, "initiator_ip": "192.168.1.95", "responder_ip": "185.99.9.117", "initiator_port": 50374, "responder_port": 443, "initiator_bytes": 630, "last_seen_epoch": "1533965812.120235", "responder_bytes": 4831, "first_seen_epoch": "1533965791.277407" }, { "bytes": 5347, "stream": 1227, "flow_id": "flow-a93780b1a230cbefda30eabf", "packets": 13, "transport": "tcp", "last_frame": 46986, "first_frame": 46424, "initiator_ip": "192.168.1.95", "responder_ip": "185.99.9.117", "initiator_port": 50375, "responder_port": 443, "initiator_bytes": 570, "last_seen_epoch": "1533965812.125932", "responder_bytes": 4777, "first_seen_epoch": "1533965791.277408" }, { "bytes": 1474, "stream": 1228, "flow_id": "flow-cfc9442232232f91182aa909", "packets": 13, "transport": "tcp", "last_frame": 46969, "first_frame": 46887, "initiator_ip": "192.168.1.95", "responder_ip": "185.68.93.18", "initiator_port": 50376, "responder_port": 80, "initiator_bytes": 860, "last_seen_epoch": "1533965799.822032", "responder_bytes": 614, "first_seen_epoch": "1533965793.911801" }, { "bytes": 246, "stream": 366, "flow_id": "flow-699261d745f8622354b75009", "packets": 2, "transport": "udp", "last_frame": 46919, "first_frame": 46918, "initiator_ip": "192.168.1.95", "responder_ip": "192.168.1.6", "initiator_port": 52101, "responder_port": 53, "initiator_bytes": 82, "last_seen_epoch": "1533965798.750795", "responder_bytes": 164, "first_seen_epoch": "1533965798.576687" }, { "bytes": 8811, "stream": 1229, "flow_id": "flow-36c234cbdadd98cef212efa3", "packets": 23, "transport": "tcp", "last_frame": 47160, "first_frame": 46920, "initiator_ip": "192.168.1.95", "responder_ip": "72.21.81.200", "initiator_port": 50378, "responder_port": 443, "initiator_bytes": 1044, "last_seen_epoch": "1533965893.819688", "responder_bytes": 7767, "first_seen_epoch": "1533965798.753051" }, { "bytes": 10187, "stream": 1230, "flow_id": "flow-2d17d748a807190f30fb8837", "packets": 29, "transport": "tcp", "last_frame": 47162, "first_frame": 46921, "initiator_ip": "192.168.1.95", "responder_ip": "72.21.81.200", "initiator_port": 50377, "responder_port": 443, "initiator_bytes": 1831, "last_seen_epoch": "1533965893.89847", "responder_bytes": 8356, "first_seen_epoch": "1533965798.753136" }, { "bytes": 1474, "stream": 1231, "flow_id": "flow-a9d2149e256ca2900ece3a28", "packets": 13, "transport": "tcp", "last_frame": 46990, "first_frame": 46974, "initiator_ip": "192.168.1.95", "responder_ip": "185.68.93.18", "initiator_port": 50379, "responder_port": 80, "initiator_bytes": 860, "last_seen_epoch": "1533965816.083793", "responder_bytes": 614, "first_seen_epoch": "1533965809.907603" }, { "bytes": 1474, "stream": 1232, "flow_id": "flow-99262e024d55a64f24304b60", "packets": 13, "transport": "tcp", "last_frame": 47014, "first_frame": 46995, "initiator_ip": "192.168.1.95", "responder_ip": "185.68.93.18", "initiator_port": 50380, "responder_port": 80, "initiator_bytes": 860, "last_seen_epoch": "1533965832.105146", "responder_bytes": 614, "first_seen_epoch": "1533965826.099709" }, { "bytes": 1474, "stream": 1233, "flow_id": "flow-c5a8262437b3375845bf3770", "packets": 13, "transport": "tcp", "last_frame": 47047, "first_frame": 47015, "initiator_ip": "192.168.1.95", "responder_ip": "185.68.93.18", "initiator_port": 50381, "responder_port": 80, "initiator_bytes": 860, "last_seen_epoch": "1533965848.240656", "responder_bytes": 614, "first_seen_epoch": "1533965842.102068" }, { "bytes": 1474, "stream": 1234, "flow_id": "flow-8cfc8d95fa4de09cfa5994b7", "packets": 13, "transport": "tcp", "last_frame": 47122, "first_frame": 47108, "initiator_ip": "192.168.1.95", "responder_ip": "185.68.93.18", "initiator_port": 50382, "responder_port": 80, "initiator_bytes": 860, "last_seen_epoch": "1533965864.317035", "responder_bytes": 614, "first_seen_epoch": "1533965858.109535" }, { "bytes": 1474, "stream": 1235, "flow_id": "flow-6293261d86ca25376b4ad2c2", "packets": 13, "transport": "tcp", "last_frame": 47147, "first_frame": 47135, "initiator_ip": "192.168.1.95", "responder_ip": "185.68.93.18", "initiator_port": 50383, "responder_port": 80, "initiator_bytes": 860, "last_seen_epoch": "1533965881.351141", "responder_bytes": 614, "first_seen_epoch": "1533965874.209905" }, { "bytes": 1474, "stream": 1236, "flow_id": "flow-d808bb86c4028261b2e3489a", "packets": 13, "transport": "tcp", "last_frame": 47168, "first_frame": 47148, "initiator_ip": "192.168.1.95", "responder_ip": "185.68.93.18", "initiator_port": 50384, "responder_port": 80, "initiator_bytes": 860, "last_seen_epoch": "1533965896.349153", "responder_bytes": 614, "first_seen_epoch": "1533965890.138762" }, { "bytes": 1234, "stream": 1237, "flow_id": "flow-9ab98ade678b7bf8a9947dc9", "packets": 9, "transport": "tcp", "last_frame": 47177, "first_frame": 47169, "initiator_ip": "192.168.1.95", "responder_ip": "185.68.93.18", "initiator_port": 50385, "responder_port": 80, "initiator_bytes": 740, "last_seen_epoch": "1533965907.307885", "responder_bytes": 494, "first_seen_epoch": "1533965906.259263" } ], "events": { "dns": [ { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "isatap.localdomain", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-e7a552a6d96b349d25fd67f8", "src_port": 53526, "tcp_stream": null, "udp_stream": 3, "frame_number": 6, "timestamp_epoch": "1533964508.833900000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.qry.name": "isatap.localdomain", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 53526, "event_id": "evt-f1d63795b38afae86a5a8c00", "src_port": 53, "tcp_stream": null, "udp_stream": 3, "frame_number": 7, "timestamp_epoch": "1533964508.834117000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "_ldap._tcp.dc._msdcs.sputnikhouse.org", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-2a5ebce25209fbca063acee6", "src_port": 61895, "tcp_stream": null, "udp_stream": 5, "frame_number": 13, "timestamp_epoch": "1533964509.082897000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "192.168.1.6", "dns.qry.name": "_ldap._tcp.dc._msdcs.sputnikhouse.org", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 61895, "event_id": "evt-2dadd3dbb0a3e49aca5d16df", "src_port": 53, "tcp_stream": null, "udp_stream": 5, "frame_number": 14, "timestamp_epoch": "1533964509.083115000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "sputnikhouse-dc.sputnikhouse.org", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-e631b8f1e708b59bde782b14", "src_port": 53976, "tcp_stream": null, "udp_stream": 6, "frame_number": 15, "timestamp_epoch": "1533964509.084305000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "192.168.1.6", "dns.qry.name": "sputnikhouse-dc.sputnikhouse.org", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 53976, "event_id": "evt-3633831cb068a46cf9cd7548", "src_port": 53, "tcp_stream": null, "udp_stream": 6, "frame_number": 16, "timestamp_epoch": "1533964509.084490000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.sputnikhouse.org", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-d3585aaed7db814c5b76d629", "src_port": 58563, "tcp_stream": null, "udp_stream": 10, "frame_number": 24, "timestamp_epoch": "1533964509.191540000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "192.168.1.6", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.sputnikhouse.org", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 58563, "event_id": "evt-5f14107b4429cd63924852e8", "src_port": 53, "tcp_stream": null, "udp_stream": 10, "frame_number": 25, "timestamp_epoch": "1533964509.191910000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.Sputnikhouse-DC.sputnikhouse.org", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-26500fdff90fa8552fde8533", "src_port": 54285, "tcp_stream": null, "udp_stream": 13, "frame_number": 179, "timestamp_epoch": "1533964510.590427000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.Sputnikhouse-DC.sputnikhouse.org", "dns.qry.type": "33", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 54285, "event_id": "evt-493d626a20887431fdc3a2a3", "src_port": 53, "tcp_stream": null, "udp_stream": 13, "frame_number": 180, "timestamp_epoch": "1533964510.590731000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "_ldap._tcp.Sputnikhouse-DC.sputnikhouse.org", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-18562f0a6a70152c7530d7ea", "src_port": 54513, "tcp_stream": null, "udp_stream": 14, "frame_number": 181, "timestamp_epoch": "1533964510.591407000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.qry.name": "_ldap._tcp.Sputnikhouse-DC.sputnikhouse.org", "dns.qry.type": "33", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 54513, "event_id": "evt-75171a94fb83c2a0b2af0613", "src_port": 53, "tcp_stream": null, "udp_stream": 14, "frame_number": 182, "timestamp_epoch": "1533964510.591649000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "wpad.sputnikhouse.org", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-54b9b729465c84adc2005c75", "src_port": 56663, "tcp_stream": null, "udp_stream": 17, "frame_number": 290, "timestamp_epoch": "1533964512.093157000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.qry.name": "wpad.sputnikhouse.org", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 56663, "event_id": "evt-45647e2e1b187eab4e60de90", "src_port": 53, "tcp_stream": null, "udp_stream": 17, "frame_number": 291, "timestamp_epoch": "1533964512.093493000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "wpad.localdomain", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-e7dbdc2ed0002a5808cd9f73", "src_port": 52148, "tcp_stream": null, "udp_stream": 18, "frame_number": 292, "timestamp_epoch": "1533964512.094062000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.qry.name": "wpad.localdomain", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 52148, "event_id": "evt-095ad8a9e5ccfd4dfaedba0a", "src_port": 53, "tcp_stream": null, "udp_stream": 18, "frame_number": 293, "timestamp_epoch": "1533964512.094245000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "Sputnikhouse-DC.sputnikhouse.org", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-ca4341316045fc1001869a52", "src_port": 54789, "tcp_stream": null, "udp_stream": 21, "frame_number": 334, "timestamp_epoch": "1533964517.018976000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "192.168.1.6", "dns.qry.name": "Sputnikhouse-DC.sputnikhouse.org", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 54789, "event_id": "evt-4e59154fbd7f3e1dfe9b1df3", "src_port": 53, "tcp_stream": null, "udp_stream": 21, "frame_number": 335, "timestamp_epoch": "1533964517.019178000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "Petrov2018-PC.sputnikhouse.org", "dns.qry.type": "6", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-ee0106ac057f8a3fee76fd0f", "src_port": 49764, "tcp_stream": null, "udp_stream": 22, "frame_number": 374, "timestamp_epoch": "1533964517.089613000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "192.168.1.6", "dns.qry.name": "Petrov2018-PC.sputnikhouse.org", "dns.qry.type": "6", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 49764, "event_id": "evt-43b8cb4ed1d26ab75680efdf", "src_port": 53, "tcp_stream": null, "udp_stream": 22, "frame_number": 375, "timestamp_epoch": "1533964517.089954000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.a": "192.168.1.95", "dns.qry.name": "sputnikhouse.org", "dns.qry.type": "6", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-89f5666eead40bd0864d5a5d", "src_port": 54515, "tcp_stream": null, "udp_stream": 23, "frame_number": 376, "timestamp_epoch": "1533964517.090941000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "192.168.1.95", "dns.qry.name": "sputnikhouse.org", "dns.qry.type": "6", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 54515, "event_id": "evt-8e381b7da574cb1ffb12007c", "src_port": 53, "tcp_stream": null, "udp_stream": 23, "frame_number": 377, "timestamp_epoch": "1533964517.092165000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "www.msftncsi.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-25d74eb6d3d799069f7d3b90", "src_port": 50622, "tcp_stream": null, "udp_stream": 24, "frame_number": 380, "timestamp_epoch": "1533964519.258567000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "198.70.71.161,198.70.71.147", "dns.cname": "www.msftncsi.com.edgesuite.net,a1961.g2.akamai.net", "dns.qry.name": "www.msftncsi.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 50622, "event_id": "evt-9229832a2f4893c366bc3e57", "src_port": 53, "tcp_stream": null, "udp_stream": 24, "frame_number": 381, "timestamp_epoch": "1533964519.500541000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.Sputnikhouse-DC.sputnikhouse.org", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-31511161eb2069d976361d37", "src_port": 59009, "tcp_stream": null, "udp_stream": 25, "frame_number": 454, "timestamp_epoch": "1533964529.514518000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.Sputnikhouse-DC.sputnikhouse.org", "dns.qry.type": "33", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 59009, "event_id": "evt-dc0e3157acc45a28f2b5d2ee", "src_port": 53, "tcp_stream": null, "udp_stream": 25, "frame_number": 455, "timestamp_epoch": "1533964529.514781000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "_ldap._tcp.Sputnikhouse-DC.sputnikhouse.org", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-3159e1e5da2f82d4b09017f7", "src_port": 64881, "tcp_stream": null, "udp_stream": 26, "frame_number": 456, "timestamp_epoch": "1533964529.516117000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.qry.name": "_ldap._tcp.Sputnikhouse-DC.sputnikhouse.org", "dns.qry.type": "33", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 64881, "event_id": "evt-a808e18e37298f06f29ed1fc", "src_port": 53, "tcp_stream": null, "udp_stream": 26, "frame_number": 457, "timestamp_epoch": "1533964529.516362000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "www.rt.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-104633c9a499b65f3570cef2", "src_port": 64657, "tcp_stream": null, "udp_stream": 27, "frame_number": 539, "timestamp_epoch": "1533964544.230776000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "www.rt.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-b36455a8036527ed27786078", "src_port": 55902, "tcp_stream": null, "udp_stream": 28, "frame_number": 541, "timestamp_epoch": "1533964544.571554000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "207.244.80.166", "dns.cname": "wpc.en.rt.com", "dns.qry.name": "www.rt.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 55902, "event_id": "evt-860d9bce23905ba931228fbf", "src_port": 53, "tcp_stream": null, "udp_stream": 28, "frame_number": 542, "timestamp_epoch": "1533964544.690929000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "207.244.80.166", "dns.cname": "wpc.en.rt.com", "dns.qry.name": "www.rt.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 64657, "event_id": "evt-9464e7929b656096940d7971", "src_port": 53, "tcp_stream": null, "udp_stream": 27, "frame_number": 543, "timestamp_epoch": "1533964544.690931000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "pp.lp4.io", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-8c24a9f8a3ef91309a3b374f", "src_port": 53897, "tcp_stream": null, "udp_stream": 29, "frame_number": 593, "timestamp_epoch": "1533964545.560553000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "ajax.googleapis.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-d3c8961bba25cfa22138be90", "src_port": 51271, "tcp_stream": null, "udp_stream": 30, "frame_number": 594, "timestamp_epoch": "1533964545.561585000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "ruptly-d.openx.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-40aa20564e50463a896cc9e7", "src_port": 51444, "tcp_stream": null, "udp_stream": 31, "frame_number": 595, "timestamp_epoch": "1533964545.575227000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "yastatic.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-377c1d8c316b8ac0e6f5c8c3", "src_port": 61736, "tcp_stream": null, "udp_stream": 32, "frame_number": 596, "timestamp_epoch": "1533964545.576638000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "cdni.rt.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-48254615d909f1a079c01d83", "src_port": 59730, "tcp_stream": null, "udp_stream": 33, "frame_number": 599, "timestamp_epoch": "1533964545.580055000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "vk.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-c0de523c53ccc14f21c41834", "src_port": 52723, "tcp_stream": null, "udp_stream": 34, "frame_number": 603, "timestamp_epoch": "1533964545.589318000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "136.243.25.70,176.9.67.12,144.76.121.172,136.243.249.79,136.243.95.174,136.243.95.176", "dns.qry.name": "pp.lp4.io", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 53897, "event_id": "evt-b0ef6ce7d5837cd15b5f2b7f", "src_port": 53, "tcp_stream": null, "udp_stream": 29, "frame_number": 605, "timestamp_epoch": "1533964545.630742000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "178.154.131.215,178.154.131.217,178.154.131.216", "dns.qry.name": "yastatic.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 61736, "event_id": "evt-ade05d84ecfbcb6e58fe95c3", "src_port": 53, "tcp_stream": null, "udp_stream": 32, "frame_number": 608, "timestamp_epoch": "1533964545.638096000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "172.217.0.42,216.58.194.202,216.58.194.170,216.58.195.74,172.217.6.74", "dns.cname": "googleapis.l.google.com", "dns.qry.name": "ajax.googleapis.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 51271, "event_id": "evt-e70f91bde67b5f4a3b78cbf7", "src_port": 53, "tcp_stream": null, "udp_stream": 30, "frame_number": 611, "timestamp_epoch": "1533964545.651017000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "87.240.129.133,87.240.180.136,87.240.129.71,87.240.182.224", "dns.qry.name": "vk.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 52723, "event_id": "evt-0ecddf7412cfacabe1fbbe23", "src_port": 53, "tcp_stream": null, "udp_stream": 34, "frame_number": 614, "timestamp_epoch": "1533964545.653915000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "173.241.250.220", "dns.qry.name": "ruptly-d.openx.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 51444, "event_id": "evt-4a17399285c3e551307ba34e", "src_port": 53, "tcp_stream": null, "udp_stream": 31, "frame_number": 617, "timestamp_epoch": "1533964545.677779000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "185.28.71.53", "dns.cname": "506163eff52ac0e798da9465b8af1d86.lswcdn.net", "dns.qry.name": "cdni.rt.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 59730, "event_id": "evt-355c7a44e1f1ec25f1d0cbdb", "src_port": 53, "tcp_stream": null, "udp_stream": 33, "frame_number": 649, "timestamp_epoch": "1533964545.745951000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "api.bing.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-86ddb900dd32d8a514c0be14", "src_port": 49984, "tcp_stream": null, "udp_stream": 35, "frame_number": 2028, "timestamp_epoch": "1533964548.338132000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "api.bing.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-eab3091174e70292d0e6d522", "src_port": 57214, "tcp_stream": null, "udp_stream": 36, "frame_number": 2029, "timestamp_epoch": "1533964548.338135000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "13.107.5.80", "dns.cname": "api-bing-com.e-0001.e-msedge.net,e-0001.e-msedge.net", "dns.qry.name": "api.bing.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 49984, "event_id": "evt-3720d59152e6797298178445", "src_port": 53, "tcp_stream": null, "udp_stream": 35, "frame_number": 2030, "timestamp_epoch": "1533964548.338547000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-1bb33b61d2e1863f7ca69aea", "src_port": 51198, "tcp_stream": null, "udp_stream": 37, "frame_number": 2031, "timestamp_epoch": "1533964548.338549000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "13.107.5.80", "dns.cname": "api-bing-com.e-0001.e-msedge.net,e-0001.e-msedge.net", "dns.qry.name": "api.bing.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 57214, "event_id": "evt-f01ef44aead3fc57bef3532c", "src_port": 53, "tcp_stream": null, "udp_stream": 36, "frame_number": 2032, "timestamp_epoch": "1533964548.338743000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-b9eee81d1306ed3fd4e2fcd7", "src_port": 60952, "tcp_stream": null, "udp_stream": 38, "frame_number": 2033, "timestamp_epoch": "1533964548.338744000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-8c17837640b53fc3f22bd7a9", "src_port": 52953, "tcp_stream": null, "udp_stream": 39, "frame_number": 2034, "timestamp_epoch": "1533964548.339435000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-d2265b8978dd25df79777fe8", "src_port": 49582, "tcp_stream": null, "udp_stream": 40, "frame_number": 2035, "timestamp_epoch": "1533964548.339533000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "204.79.197.200,13.107.21.200", "dns.cname": "www-bing-com.a-0001.a-msedge.net,a-0001.a-msedge.net", "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 60952, "event_id": "evt-7fdbf0594ad8ac6933c3c59a", "src_port": 53, "tcp_stream": null, "udp_stream": 38, "frame_number": 2263, "timestamp_epoch": "1533964549.230108000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "204.79.197.200,13.107.21.200", "dns.cname": "www-bing-com.a-0001.a-msedge.net,a-0001.a-msedge.net", "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 52953, "event_id": "evt-c0e2f1e60b7e924c7def417d", "src_port": 53, "tcp_stream": null, "udp_stream": 39, "frame_number": 2265, "timestamp_epoch": "1533964549.230112000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "204.79.197.200,13.107.21.200", "dns.cname": "www-bing-com.a-0001.a-msedge.net,a-0001.a-msedge.net", "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 49582, "event_id": "evt-bd5d2633b70390c81be88bae", "src_port": 53, "tcp_stream": null, "udp_stream": 40, "frame_number": 2266, "timestamp_epoch": "1533964549.230247000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "204.79.197.200,13.107.21.200", "dns.cname": "www-bing-com.a-0001.a-msedge.net,a-0001.a-msedge.net", "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 51198, "event_id": "evt-589128a285efbf04a29318f9", "src_port": 53, "tcp_stream": null, "udp_stream": 37, "frame_number": 2268, "timestamp_epoch": "1533964549.230297000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "fonts.googleapis.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-87598624ff114f07174d3c42", "src_port": 64364, "tcp_stream": null, "udp_stream": 41, "frame_number": 2269, "timestamp_epoch": "1533964549.231268000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "216.58.192.10", "dns.cname": "googleadapis.l.google.com", "dns.qry.name": "fonts.googleapis.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 64364, "event_id": "evt-22c9a2b6b52a7e95acd196b4", "src_port": 53, "tcp_stream": null, "udp_stream": 41, "frame_number": 2425, "timestamp_epoch": "1533964549.757857000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "rum-static.pingdom.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-9d880af4ca5399ef4b85e5a0", "src_port": 53239, "tcp_stream": null, "udp_stream": 42, "frame_number": 3056, "timestamp_epoch": "1533964551.845979000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "www.googletagservices.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-d6b2a8c65daa87e6f116fe0c", "src_port": 52188, "tcp_stream": null, "udp_stream": 43, "frame_number": 3061, "timestamp_epoch": "1533964551.909128000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "an.yandex.ru", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-c111c10ccba89addfeca5666", "src_port": 50621, "tcp_stream": null, "udp_stream": 44, "frame_number": 3129, "timestamp_epoch": "1533964552.232112000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "fonts.gstatic.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-d92623d1af07e7847442ca42", "src_port": 58068, "tcp_stream": null, "udp_stream": 45, "frame_number": 3134, "timestamp_epoch": "1533964552.236123000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "www.youtube.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-ea262f02bb54a22b3124429c", "src_port": 58083, "tcp_stream": null, "udp_stream": 46, "frame_number": 3147, "timestamp_epoch": "1533964552.244810000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "104.20.21.239,104.20.20.239", "dns.qry.name": "rum-static.pingdom.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 53239, "event_id": "evt-d1c1811ea9f570b67f52b51e", "src_port": 53, "tcp_stream": null, "udp_stream": 42, "frame_number": 3180, "timestamp_epoch": "1533964552.350754000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "216.58.194.162", "dns.cname": "pagead46.l.doubleclick.net", "dns.qry.name": "www.googletagservices.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 52188, "event_id": "evt-06f73b2902a759ae0ed3f453", "src_port": 53, "tcp_stream": null, "udp_stream": 43, "frame_number": 3185, "timestamp_epoch": "1533964552.354010000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "216.58.192.3", "dns.cname": "gstaticadssl.l.google.com", "dns.qry.name": "fonts.gstatic.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 58068, "event_id": "evt-6f21ba9d41b11d0c4d6598ad", "src_port": 53, "tcp_stream": null, "udp_stream": 45, "frame_number": 3196, "timestamp_epoch": "1533964552.405445000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "213.180.193.90,87.250.250.90,77.88.21.90,213.180.204.90,93.158.134.90", "dns.qry.name": "an.yandex.ru", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 50621, "event_id": "evt-bdc68e9c5d50db2579128f40", "src_port": 53, "tcp_stream": null, "udp_stream": 44, "frame_number": 3197, "timestamp_epoch": "1533964552.405569000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "sb.scorecardresearch.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-32195d1ef8a8b8f4e8f75263", "src_port": 63566, "tcp_stream": null, "udp_stream": 47, "frame_number": 3208, "timestamp_epoch": "1533964552.424918000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "www.google-analytics.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-b050b82624275f3989329fe8", "src_port": 63099, "tcp_stream": null, "udp_stream": 48, "frame_number": 3209, "timestamp_epoch": "1533964552.427007000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "counter.yadro.ru", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-14c36f01ff3d12bef5a74e8f", "src_port": 61662, "tcp_stream": null, "udp_stream": 49, "frame_number": 3210, "timestamp_epoch": "1533964552.428838000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "www.tns-counter.ru", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-40472b1d1e7528c71ca3de30", "src_port": 52084, "tcp_stream": null, "udp_stream": 50, "frame_number": 3211, "timestamp_epoch": "1533964552.429958000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "172.217.6.78,172.217.0.46,216.58.194.174,216.58.195.78", "dns.cname": "youtube-ui.l.google.com", "dns.qry.name": "www.youtube.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 58083, "event_id": "evt-6127712c8d66804844ff7369", "src_port": 53, "tcp_stream": null, "udp_stream": 46, "frame_number": 3212, "timestamp_epoch": "1533964552.430269000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "tru.am", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-cbb30e1d949316e1544ebda8", "src_port": 56031, "tcp_stream": null, "udp_stream": 51, "frame_number": 3215, "timestamp_epoch": "1533964552.431390000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "mc.yandex.ru", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-66542e1290096b4426cd3f40", "src_port": 54363, "tcp_stream": null, "udp_stream": 52, "frame_number": 3216, "timestamp_epoch": "1533964552.432630000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "88.212.196.123,88.212.201.194,88.212.196.122,88.212.201.199,88.212.201.195,88.212.196.72,88.212.196.66,88.212.201.208,88.212.196.105,88.212.196.77,88.212.196.104,88.212.201.205,88.212.196.102,88.212.201.197,88.212.201.193,88.212.196.103,88.212.196.124,88.212.201.207,88.212.201.196,88.212.196.75,88.212.196.69,88.212.196.101", "dns.qry.name": "counter.yadro.ru", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 61662, "event_id": "evt-60394aefbb93ab24be0a2f6b", "src_port": 53, "tcp_stream": null, "udp_stream": 49, "frame_number": 3296, "timestamp_epoch": "1533964552.626454000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "194.226.130.229,194.226.130.228,194.226.130.226,194.226.130.227", "dns.qry.name": "www.tns-counter.ru", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 52084, "event_id": "evt-7e6e0a651f03dfd7b00854fd", "src_port": 53, "tcp_stream": null, "udp_stream": 50, "frame_number": 3303, "timestamp_epoch": "1533964552.639522000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "93.158.134.119,77.88.21.119,87.250.251.119,87.250.250.119", "dns.qry.name": "mc.yandex.ru", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 54363, "event_id": "evt-40946136a2ff060191c9a3d6", "src_port": 53, "tcp_stream": null, "udp_stream": 52, "frame_number": 3310, "timestamp_epoch": "1533964552.683616000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "216.58.192.14", "dns.cname": "www-google-analytics.l.google.com", "dns.qry.name": "www.google-analytics.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 63099, "event_id": "evt-8d3d8acb649598fd05c1fc0d", "src_port": 53, "tcp_stream": null, "udp_stream": 48, "frame_number": 3327, "timestamp_epoch": "1533964552.700183000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "23.55.50.209", "dns.cname": "sb.scorecardresearch.com.edgekey.net,e1879.e7.akamaiedge.net", "dns.qry.name": "sb.scorecardresearch.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 63566, "event_id": "evt-134f6c7ddf2161c6a627e92d", "src_port": 53, "tcp_stream": null, "udp_stream": 47, "frame_number": 3334, "timestamp_epoch": "1533964552.716941000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "104.25.163.34,104.25.162.34", "dns.qry.name": "tru.am", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 56031, "event_id": "evt-13155ae88e64678162bf8c2c", "src_port": 53, "tcp_stream": null, "udp_stream": 51, "frame_number": 3335, "timestamp_epoch": "1533964552.717075000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "adservice.google.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-69b64682a191481af686eda9", "src_port": 51943, "tcp_stream": null, "udp_stream": 53, "frame_number": 3792, "timestamp_epoch": "1533964553.383949000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "securepubads.g.doubleclick.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-66559f342fb613e30d571d54", "src_port": 62657, "tcp_stream": null, "udp_stream": 54, "frame_number": 3793, "timestamp_epoch": "1533964553.386066000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "216.58.194.162", "dns.cname": "pagead46.l.doubleclick.net", "dns.qry.name": "adservice.google.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 51943, "event_id": "evt-a28055fd52fc98e5b610f192", "src_port": 53, "tcp_stream": null, "udp_stream": 53, "frame_number": 3925, "timestamp_epoch": "1533964553.575811000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "216.58.192.2", "dns.cname": "partnerad.l.doubleclick.net", "dns.qry.name": "securepubads.g.doubleclick.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 62657, "event_id": "evt-588791a96919735c3e638214", "src_port": 53, "tcp_stream": null, "udp_stream": 54, "frame_number": 3927, "timestamp_epoch": "1533964553.575840000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "www.download.windowsupdate.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-756481c4aa74d59d2c669d19", "src_port": 49920, "tcp_stream": null, "udp_stream": 55, "frame_number": 4150, "timestamp_epoch": "1533964553.828629000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "www.download.windowsupdate.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-9233d01a2c782238b634572d", "src_port": 52951, "tcp_stream": null, "udp_stream": 56, "frame_number": 4172, "timestamp_epoch": "1533964553.832380000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "stats.g.doubleclick.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-eca66e0303144faa2168b0de", "src_port": 62668, "tcp_stream": null, "udp_stream": 57, "frame_number": 4243, "timestamp_epoch": "1533964554.012005000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "198.70.71.144,198.70.71.161", "dns.cname": "2-01-3cf7-0009.cdx.cedexis.net,download.windowsupdate.com.edgesuite.net,a767.dspw65.akamai.net", "dns.qry.name": "www.download.windowsupdate.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 52951, "event_id": "evt-52d679aee405c387ff35f441", "src_port": 53, "tcp_stream": null, "udp_stream": 56, "frame_number": 4256, "timestamp_epoch": "1533964554.071566000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "198.70.71.144,198.70.71.161", "dns.cname": "2-01-3cf7-0009.cdx.cedexis.net,download.windowsupdate.com.edgesuite.net,a767.dspw65.akamai.net", "dns.qry.name": "www.download.windowsupdate.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 49920, "event_id": "evt-237c87581889af8467619f52", "src_port": 53, "tcp_stream": null, "udp_stream": 55, "frame_number": 4257, "timestamp_epoch": "1533964554.071727000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "74.125.195.156,74.125.195.155,74.125.195.154,74.125.195.157", "dns.cname": "stats.l.doubleclick.net", "dns.qry.name": "stats.g.doubleclick.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 62668, "event_id": "evt-8fc3f41225e893af4fbbec7d", "src_port": 53, "tcp_stream": null, "udp_stream": 57, "frame_number": 4326, "timestamp_epoch": "1533964554.232211000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "www.google.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-13560666831c1b383e2a365e", "src_port": 50766, "tcp_stream": null, "udp_stream": 58, "frame_number": 4677, "timestamp_epoch": "1533964555.194756000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "216.58.192.4", "dns.qry.name": "www.google.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 50766, "event_id": "evt-ff964c16b6bd713fe6f4fca1", "src_port": 53, "tcp_stream": null, "udp_stream": 58, "frame_number": 4750, "timestamp_epoch": "1533964555.307152000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "us-u.openx.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-5466905efc7fd4a1f3a8552f", "src_port": 54043, "tcp_stream": null, "udp_stream": 59, "frame_number": 4853, "timestamp_epoch": "1533964555.557011000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "tpc.googlesyndication.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-7283b10a6420c077a2de0ecb", "src_port": 57996, "tcp_stream": null, "udp_stream": 60, "frame_number": 4895, "timestamp_epoch": "1533964555.650027000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "173.241.250.143", "dns.qry.name": "us-u.openx.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 54043, "event_id": "evt-2ba70d88a8fc9af63b1b4fa5", "src_port": 53, "tcp_stream": null, "udp_stream": 59, "frame_number": 4896, "timestamp_epoch": "1533964555.650800000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "216.58.192.1", "dns.cname": "pagead-googlehosted.l.google.com", "dns.qry.name": "tpc.googlesyndication.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 57996, "event_id": "evt-6ab14b01a79257e8345967a0", "src_port": 53, "tcp_stream": null, "udp_stream": 60, "frame_number": 4936, "timestamp_epoch": "1533964555.714019000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "sync.mathtag.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-738ce800a96a185117911179", "src_port": 60662, "tcp_stream": null, "udp_stream": 61, "frame_number": 5075, "timestamp_epoch": "1533964555.919335000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "ad.turn.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-fad2d1c72e46782266add5e1", "src_port": 64627, "tcp_stream": null, "udp_stream": 62, "frame_number": 5077, "timestamp_epoch": "1533964555.920423000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "sync-tm.everesttech.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-f7179f8eeaea92b3a82ad560", "src_port": 51646, "tcp_stream": null, "udp_stream": 63, "frame_number": 5078, "timestamp_epoch": "1533964555.920668000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "pr-bh.ybp.yahoo.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-37e34ee3a050fbe942026ae5", "src_port": 49504, "tcp_stream": null, "udp_stream": 64, "frame_number": 5079, "timestamp_epoch": "1533964555.921841000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "match.adsrvr.org", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-4b42145544b372ec730dad8c", "src_port": 60137, "tcp_stream": null, "udp_stream": 65, "frame_number": 5080, "timestamp_epoch": "1533964555.922018000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "cm.g.doubleclick.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-d67482a0564c4bcb6a818177", "src_port": 49555, "tcp_stream": null, "udp_stream": 66, "frame_number": 5083, "timestamp_epoch": "1533964555.923820000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "216.200.232.221,216.200.232.235,216.200.232.234,74.121.136.131", "dns.cname": "pixel-origin.mathtag.com", "dns.qry.name": "sync.mathtag.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 60662, "event_id": "evt-875ef92dca5b90a1bb000c99", "src_port": 53, "tcp_stream": null, "udp_stream": 61, "frame_number": 5120, "timestamp_epoch": "1533964555.984165000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "74.6.34.27", "dns.cname": "pr-bh.ybp.gysm.yahoodns.net", "dns.qry.name": "pr-bh.ybp.yahoo.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 49504, "event_id": "evt-b28c9ea38f31812947c1e0fe", "src_port": 53, "tcp_stream": null, "udp_stream": 64, "frame_number": 5121, "timestamp_epoch": "1533964555.984478000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "172.217.6.66", "dns.cname": "pagead.l.doubleclick.net", "dns.qry.name": "cm.g.doubleclick.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 49555, "event_id": "evt-d134dcccef0b5a78c22917ea", "src_port": 53, "tcp_stream": null, "udp_stream": 66, "frame_number": 5140, "timestamp_epoch": "1533964556.025417000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "54.186.116.83,54.68.84.37,52.43.30.37,34.208.13.206,54.187.181.128,54.68.131.249,54.68.83.10,54.149.32.18", "dns.cname": "match-243508202.us-west-2.elb.amazonaws.com", "dns.qry.name": "match.adsrvr.org", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 60137, "event_id": "evt-8e33f7af8bdbb72942da76a4", "src_port": 53, "tcp_stream": null, "udp_stream": 65, "frame_number": 5141, "timestamp_epoch": "1533964556.025527000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "69.194.244.11", "dns.cname": "ad.turn.com.akadns.net", "dns.qry.name": "ad.turn.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 64627, "event_id": "evt-ad95a086db2d75c765cbcf2a", "src_port": 53, "tcp_stream": null, "udp_stream": 62, "frame_number": 5145, "timestamp_epoch": "1533964556.026779000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "151.101.2.49,151.101.66.49,151.101.130.49,151.101.194.49", "dns.cname": "sync.tubemogul.com,syncf.tubemogul.com,h2.shared.global.fastly.net", "dns.qry.name": "sync-tm.everesttech.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 51646, "event_id": "evt-35ab77eba3e74a48d7063fbf", "src_port": 53, "tcp_stream": null, "udp_stream": 63, "frame_number": 5155, "timestamp_epoch": "1533964556.031163000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "ssl.trustwave.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-02f1d32db445cb0134d15c31", "src_port": 63281, "tcp_stream": null, "udp_stream": 67, "frame_number": 5349, "timestamp_epoch": "1533964556.352409000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "ssl.trustwave.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-932cd5ad9902a32cb71ffad5", "src_port": 55405, "tcp_stream": null, "udp_stream": 68, "frame_number": 5350, "timestamp_epoch": "1533964556.353582000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "23.43.176.205", "dns.cname": "login.trustwave.com.edgekey.net,e5631.b.akamaiedge.net", "dns.qry.name": "ssl.trustwave.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 55405, "event_id": "evt-f611880c6bd59634489e72df", "src_port": 53, "tcp_stream": null, "udp_stream": 68, "frame_number": 5371, "timestamp_epoch": "1533964556.454915000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "23.43.176.205", "dns.cname": "login.trustwave.com.edgekey.net,e5631.b.akamaiedge.net", "dns.qry.name": "ssl.trustwave.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 63281, "event_id": "evt-780462aae1016bb25b9605de", "src_port": 53, "tcp_stream": null, "udp_stream": 67, "frame_number": 5372, "timestamp_epoch": "1533964556.455020000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "googleads.g.doubleclick.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-7211cf3342402c7381b62c2f", "src_port": 57467, "tcp_stream": null, "udp_stream": 69, "frame_number": 5430, "timestamp_epoch": "1533964556.819517000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "static.doubleclick.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-7e64ec7755870605e7d72702", "src_port": 62836, "tcp_stream": null, "udp_stream": 70, "frame_number": 5433, "timestamp_epoch": "1533964556.839610000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "216.58.194.162", "dns.cname": "pagead46.l.doubleclick.net", "dns.qry.name": "googleads.g.doubleclick.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 57467, "event_id": "evt-c0281a62ae1d1f4bbca29bdf", "src_port": 53, "tcp_stream": null, "udp_stream": 69, "frame_number": 5441, "timestamp_epoch": "1533964556.880955000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "216.58.192.6", "dns.cname": "static-doubleclick-net.l.google.com", "dns.qry.name": "static.doubleclick.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 62836, "event_id": "evt-f569a239e186d28f68b586ef", "src_port": 53, "tcp_stream": null, "udp_stream": 70, "frame_number": 5456, "timestamp_epoch": "1533964556.909758000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "i.ytimg.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-ffc2afb7da0440bdc54c6d4e", "src_port": 50566, "tcp_stream": null, "udp_stream": 71, "frame_number": 5681, "timestamp_epoch": "1533964558.620590000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "172.217.0.54,216.58.194.214,216.58.194.182,216.58.195.86", "dns.cname": "ytimg-edge-static.l.google.com", "dns.qry.name": "i.ytimg.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 50566, "event_id": "evt-55f4b5006d8a97e39bafa86e", "src_port": 53, "tcp_stream": null, "udp_stream": 71, "frame_number": 5698, "timestamp_epoch": "1533964558.771373000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "static.chartbeat.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-cbb879c616ad7d5dfba39378", "src_port": 59851, "tcp_stream": null, "udp_stream": 72, "frame_number": 5845, "timestamp_epoch": "1533964559.338775000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "rum-collector-2.pingdom.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-467687ba8e35b3c327073e51", "src_port": 53455, "tcp_stream": null, "udp_stream": 73, "frame_number": 5846, "timestamp_epoch": "1533964559.371843000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "rum-collector.pingdom.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-e6a40d8bb6c6815d2a3bd151", "src_port": 62597, "tcp_stream": null, "udp_stream": 74, "frame_number": 5847, "timestamp_epoch": "1533964559.373718000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "um.simpli.fi", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-97a40845f30273bfc4b89971", "src_port": 49575, "tcp_stream": null, "udp_stream": 75, "frame_number": 5852, "timestamp_epoch": "1533964559.407246000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "rtb.openx.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-22f6ea6f1d2ad69ea8a0c2e2", "src_port": 60720, "tcp_stream": null, "udp_stream": 76, "frame_number": 5853, "timestamp_epoch": "1533964559.407270000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "pixel-sync.sitescout.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-74bdb477281e0508545b6270", "src_port": 64530, "tcp_stream": null, "udp_stream": 77, "frame_number": 5854, "timestamp_epoch": "1533964559.409750000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "p.rfihub.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-d8f8490d6000c4dcbbd18d4e", "src_port": 51004, "tcp_stream": null, "udp_stream": 78, "frame_number": 5855, "timestamp_epoch": "1533964559.411454000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "ox.pxl.ace.advertising.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-6c219b1e49bd9daa25ebfc95", "src_port": 58587, "tcp_stream": null, "udp_stream": 79, "frame_number": 5856, "timestamp_epoch": "1533964559.411813000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "13.33.106.254", "dns.cname": "d3f7zc5bbfci5.cloudfront.net", "dns.qry.name": "static.chartbeat.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 59851, "event_id": "evt-c36dc759f8c18458ef347937", "src_port": 53, "tcp_stream": null, "udp_stream": 72, "frame_number": 5857, "timestamp_epoch": "1533964559.422782000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "34.246.244.104,52.209.191.106,52.48.134.100", "dns.cname": "prod-dem-collector-elb-611025824.eu-west-1.elb.amazonaws.com", "dns.qry.name": "rum-collector-2.pingdom.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 53455, "event_id": "evt-2a7a4fecfbea78b8e1364ddc", "src_port": 53, "tcp_stream": null, "udp_stream": 73, "frame_number": 5860, "timestamp_epoch": "1533964559.445991000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "104.20.21.239,104.20.20.239", "dns.qry.name": "rum-collector.pingdom.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 62597, "event_id": "evt-67f863e38d06eb543718b9bd", "src_port": 53, "tcp_stream": null, "udp_stream": 74, "frame_number": 5863, "timestamp_epoch": "1533964559.449101000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "69.174.248.228", "dns.cname": "pixel-a.sitescout.com", "dns.qry.name": "pixel-sync.sitescout.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 64530, "event_id": "evt-d604cfffdaaa4a5bb3ef49d8", "src_port": 53, "tcp_stream": null, "udp_stream": 77, "frame_number": 5866, "timestamp_epoch": "1533964559.464580000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "173.241.250.104", "dns.qry.name": "rtb.openx.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 60720, "event_id": "evt-b36b24fbc769191d686d08ff", "src_port": 53, "tcp_stream": null, "udp_stream": 76, "frame_number": 5871, "timestamp_epoch": "1533964559.485487000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "198.23.90.60,198.23.90.62,198.23.90.56", "dns.qry.name": "um.simpli.fi", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 49575, "event_id": "evt-d56fc463b145b31b109cfd04", "src_port": 53, "tcp_stream": null, "udp_stream": 75, "frame_number": 5872, "timestamp_epoch": "1533964559.485716000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "149.174.66.131,152.163.13.4", "dns.cname": "pxl.ace.advertising.com,pxl.ace.advertising.com.adcom.akadns.net", "dns.qry.name": "ox.pxl.ace.advertising.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 58587, "event_id": "evt-208ad42315838428c005c9e2", "src_port": 53, "tcp_stream": null, "udp_stream": 79, "frame_number": 5893, "timestamp_epoch": "1533964559.525559000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "pixel.sitescout.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-51b0aed8dbabc4cff10e7ec5", "src_port": 52791, "tcp_stream": null, "udp_stream": 80, "frame_number": 6060, "timestamp_epoch": "1533964559.747861000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "ads.yahoo.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-d765c1672a9afad6feee6134", "src_port": 58828, "tcp_stream": null, "udp_stream": 81, "frame_number": 6084, "timestamp_epoch": "1533964559.791256000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "98.136.101.121,67.195.229.45", "dns.cname": "fo-fd-world-new.yax.gysm.yahoodns.net", "dns.qry.name": "ads.yahoo.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 58828, "event_id": "evt-69d9f2bc3b3cf62d1563ce33", "src_port": 53, "tcp_stream": null, "udp_stream": 81, "frame_number": 6113, "timestamp_epoch": "1533964559.840586000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "ping.chartbeat.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-0da2206fef0347ed241aba4d", "src_port": 62628, "tcp_stream": null, "udp_stream": 82, "frame_number": 6127, "timestamp_epoch": "1533964559.866175000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "69.174.248.228", "dns.qry.name": "pixel.sitescout.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 52791, "event_id": "evt-9aaec96c1ba17f3abaa03886", "src_port": 53, "tcp_stream": null, "udp_stream": 80, "frame_number": 6137, "timestamp_epoch": "1533964559.872487000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "50.16.201.198,50.16.185.226,50.16.223.11,50.16.230.124,50.16.204.65,50.16.205.103,23.23.99.70,23.23.98.214", "dns.qry.name": "ping.chartbeat.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 62628, "event_id": "evt-bcc12b4cfd845a0f01c5cfd5", "src_port": 53, "tcp_stream": null, "udp_stream": 82, "frame_number": 6148, "timestamp_epoch": "1533964559.906110000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "x.ss2.us", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-da6283b31000958e9cf29ee1", "src_port": 59619, "tcp_stream": null, "udp_stream": 83, "frame_number": 6226, "timestamp_epoch": "1533964560.094890000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "x.ss2.us", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-6fa91e6958243c3589e486b3", "src_port": 51262, "tcp_stream": null, "udp_stream": 84, "frame_number": 6227, "timestamp_epoch": "1533964560.102934000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "13.33.78.186,13.33.78.214,13.33.78.48,13.33.78.61", "dns.qry.name": "x.ss2.us", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 51262, "event_id": "evt-9f96e6451292856ab5ed4c93", "src_port": 53, "tcp_stream": null, "udp_stream": 84, "frame_number": 6238, "timestamp_epoch": "1533964560.172654000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "13.33.78.186,13.33.78.214,13.33.78.48,13.33.78.61", "dns.qry.name": "x.ss2.us", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 59619, "event_id": "evt-d914f76fd9d39b67a2eab20f", "src_port": 53, "tcp_stream": null, "udp_stream": 83, "frame_number": 6239, "timestamp_epoch": "1533964560.172942000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "cookiex.ngd.yahoo.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-ea2583fab3563adf1cb9a02e", "src_port": 59909, "tcp_stream": null, "udp_stream": 85, "frame_number": 6262, "timestamp_epoch": "1533964560.225311000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "67.195.229.45,98.136.101.121", "dns.cname": "fo-fd-world-new.yax.gysm.yahoodns.net", "dns.qry.name": "cookiex.ngd.yahoo.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 59909, "event_id": "evt-ab8ee8b16fb76db43e23c31e", "src_port": 53, "tcp_stream": null, "udp_stream": 85, "frame_number": 6273, "timestamp_epoch": "1533964560.304978000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "p.rfihub.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-4ebf253e17c62604d737aa10", "src_port": 51004, "tcp_stream": null, "udp_stream": 78, "frame_number": 6294, "timestamp_epoch": "1533964560.407087000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "199.38.167.128", "dns.cname": "a.rfihub.com,a.rfihub.com.akadns.net,a-us-east.rfihub.com.akadns.net", "dns.qry.name": "p.rfihub.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 51004, "event_id": "evt-11f77c97b205a77e79bca284", "src_port": 53, "tcp_stream": null, "udp_stream": 78, "frame_number": 6313, "timestamp_epoch": "1533964560.553014000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "iecvlist.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-4551ec686f5f144db7eac45a", "src_port": 56563, "tcp_stream": null, "udp_stream": 86, "frame_number": 6512, "timestamp_epoch": "1533964574.365606000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "72.21.81.200", "dns.cname": "ie9comview.vo.msecnd.net,cs9.wpc.v0cdn.net", "dns.qry.name": "iecvlist.microsoft.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 56563, "event_id": "evt-c5e57afbb69b4d2e3878de9d", "src_port": 53, "tcp_stream": null, "udp_stream": 86, "frame_number": 6513, "timestamp_epoch": "1533964574.365861000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "pop.yandex.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-8a16ea0b3dbc321165952ab7", "src_port": 51272, "tcp_stream": null, "udp_stream": 87, "frame_number": 6566, "timestamp_epoch": "1533964577.036284000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "87.250.251.37,213.180.204.37,93.158.134.37", "dns.cname": "pop.yandex.ru", "dns.qry.name": "pop.yandex.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 51272, "event_id": "evt-1c8ec344530b53a2675acf17", "src_port": 53, "tcp_stream": null, "udp_stream": 87, "frame_number": 6567, "timestamp_epoch": "1533964577.203660000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "smtp.yandex.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-71dbe81757ff28b642d57f01", "src_port": 50628, "tcp_stream": null, "udp_stream": 88, "frame_number": 7088, "timestamp_epoch": "1533964677.171851000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "77.88.21.38,87.250.250.38,213.180.193.38,213.180.204.38,93.158.134.38", "dns.cname": "smtp.yandex.ru", "dns.qry.name": "smtp.yandex.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 50628, "event_id": "evt-60c6c777c31945cdbdc0aca8", "src_port": 53, "tcp_stream": null, "udp_stream": 88, "frame_number": 7089, "timestamp_epoch": "1533964677.421170000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "r53x.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-f57a34cae8192b8b68e42bb4", "src_port": 64943, "tcp_stream": null, "udp_stream": 89, "frame_number": 7256, "timestamp_epoch": "1533964849.660908000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "149.129.222.112", "dns.qry.name": "r53x.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 64943, "event_id": "evt-1725ede2d7be2d71eaa81869", "src_port": 53, "tcp_stream": null, "udp_stream": 89, "frame_number": 7259, "timestamp_epoch": "1533964850.053278000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "launcher.spot.im", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-1149bccb0e9e303a120fcb51", "src_port": 49524, "tcp_stream": null, "udp_stream": 90, "frame_number": 7484, "timestamp_epoch": "1533964897.219566000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "205.185.216.42,205.185.216.10", "dns.cname": "cds.p5q6b2e4.hwcdn.net", "dns.qry.name": "launcher.spot.im", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 49524, "event_id": "evt-57ffbefa03db9af9bf38ea4b", "src_port": 53, "tcp_stream": null, "udp_stream": 90, "frame_number": 7515, "timestamp_epoch": "1533964897.312123000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "mixi.media", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-d1c3187aee49b18ffb5205a0", "src_port": 51374, "tcp_stream": null, "udp_stream": 91, "frame_number": 7800, "timestamp_epoch": "1533964897.662014000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "widget.engageya.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-3f0f1da2e0904c5d9065edb7", "src_port": 64152, "tcp_stream": null, "udp_stream": 92, "frame_number": 7801, "timestamp_epoch": "1533964897.663527000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "173.0.153.44", "dns.qry.name": "mixi.media", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 51374, "event_id": "evt-387359b0ce32431c9678795a", "src_port": 53, "tcp_stream": null, "udp_stream": 91, "frame_number": 8116, "timestamp_epoch": "1533964897.941119000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "23.220.174.162", "dns.cname": "widget-engageya.edgekey.net,e15247.dscg.akamaiedge.net", "dns.qry.name": "widget.engageya.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 64152, "event_id": "evt-f09bab52aecbc1ea658a3ee6", "src_port": 53, "tcp_stream": null, "udp_stream": 92, "frame_number": 8147, "timestamp_epoch": "1533964897.948811000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "beacon.tru.am", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-dd9ef047340d3c25594ed23f", "src_port": 60978, "tcp_stream": null, "udp_stream": 93, "frame_number": 8439, "timestamp_epoch": "1533964898.292183000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "104.25.163.34,104.25.162.34", "dns.qry.name": "beacon.tru.am", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 60978, "event_id": "evt-29ad3118956053257414d7e6", "src_port": 53, "tcp_stream": null, "udp_stream": 93, "frame_number": 8506, "timestamp_epoch": "1533964898.378728000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "apps.identrust.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-57b6584e35f0f3d48e93bd3b", "src_port": 58610, "tcp_stream": null, "udp_stream": 94, "frame_number": 8557, "timestamp_epoch": "1533964898.439074000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "apps.identrust.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-24bc42ef5e96ab4ffbfb95ff", "src_port": 51723, "tcp_stream": null, "udp_stream": 95, "frame_number": 8558, "timestamp_epoch": "1533964898.441696000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "recs.engageya.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-16c21ebfd954d908e93e4ba3", "src_port": 51524, "tcp_stream": null, "udp_stream": 96, "frame_number": 8579, "timestamp_epoch": "1533964898.482071000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "192.35.177.64", "dns.cname": "apps.digsigtrust.com", "dns.qry.name": "apps.identrust.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 51723, "event_id": "evt-a2baa20218f5a4687b5e6fb7", "src_port": 53, "tcp_stream": null, "udp_stream": 95, "frame_number": 8582, "timestamp_epoch": "1533964898.485160000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "192.35.177.64", "dns.cname": "apps.digsigtrust.com", "dns.qry.name": "apps.identrust.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 58610, "event_id": "evt-770c0b168683ad15aa981953", "src_port": 53, "tcp_stream": null, "udp_stream": 94, "frame_number": 8583, "timestamp_epoch": "1533964898.485161000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "95.142.20.17", "dns.qry.name": "recs.engageya.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 51524, "event_id": "evt-33bd0469018e583cc411bbb6", "src_port": 53, "tcp_stream": null, "udp_stream": 96, "frame_number": 8628, "timestamp_epoch": "1533964898.548203000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "c1.adform.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-9cecaf1c10f263cc8f910df6", "src_port": 56692, "tcp_stream": null, "udp_stream": 97, "frame_number": 8909, "timestamp_epoch": "1533964898.852948000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "pixel.quantserve.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-8e837be89e0e0a826f75ff36", "src_port": 65328, "tcp_stream": null, "udp_stream": 98, "frame_number": 8910, "timestamp_epoch": "1533964898.853770000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "x.bidswitch.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-c5155ce4ab85dc40f0b01aff", "src_port": 50552, "tcp_stream": null, "udp_stream": 99, "frame_number": 8911, "timestamp_epoch": "1533964898.854136000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "ib.adnxs.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-33fe223fbc318b790ce6757a", "src_port": 53829, "tcp_stream": null, "udp_stream": 100, "frame_number": 8912, "timestamp_epoch": "1533964898.855179000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "s.amazon-adsystem.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-3edd1eed3eb712314b893bba", "src_port": 63652, "tcp_stream": null, "udp_stream": 101, "frame_number": 8913, "timestamp_epoch": "1533964898.856145000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "pixel.advertising.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-083758e02ae8ae761b1a2bf4", "src_port": 52861, "tcp_stream": null, "udp_stream": 102, "frame_number": 8916, "timestamp_epoch": "1533964898.857493000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "104.254.150.77,104.254.150.69,104.254.150.37,104.254.150.9,104.254.150.59,104.254.150.11,104.254.150.58,104.254.150.13", "dns.cname": "g.geogslb.com,ib.anycast.adnxs.com", "dns.qry.name": "ib.adnxs.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 53829, "event_id": "evt-2117944378a8706e0ac38cf4", "src_port": 53, "tcp_stream": null, "udp_stream": 100, "frame_number": 8956, "timestamp_epoch": "1533964898.930148000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "52.94.232.32", "dns.qry.name": "s.amazon-adsystem.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 63652, "event_id": "evt-be5934cd9a040ec51876660d", "src_port": 53, "tcp_stream": null, "udp_stream": 101, "frame_number": 8957, "timestamp_epoch": "1533964898.930358000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "52.89.90.109,54.69.93.253,52.27.97.168,52.40.188.201,54.71.113.104,54.69.70.7,34.211.210.144,34.215.18.221", "dns.cname": "global.px.quantserve.com,pixel-usw201-lighttpd.pixel.quantserve.net,pixel-usw201-lighttpd-elb-1486028624.us-west-2.elb.amazonaws.com", "dns.qry.name": "pixel.quantserve.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 65328, "event_id": "evt-63d512cc220ce30d512584be", "src_port": 53, "tcp_stream": null, "udp_stream": 98, "frame_number": 8958, "timestamp_epoch": "1533964898.930359000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "185.167.164.37,185.167.164.39", "dns.cname": "track.adformnet.akadns.net,track-us.adformnet.akadns.net", "dns.qry.name": "c1.adform.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 56692, "event_id": "evt-4f0c9649239a756356b5e85c", "src_port": 53, "tcp_stream": null, "udp_stream": 97, "frame_number": 8972, "timestamp_epoch": "1533964898.937210000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "54.183.95.126,54.241.143.220,54.215.177.163,54.193.14.224,54.241.145.51,54.215.190.205,13.56.1.77,54.193.27.242", "dns.cname": "dmp-pixel.aolp-prd.public.aol.com", "dns.qry.name": "pixel.advertising.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 52861, "event_id": "evt-0e70d3bb645d92e7a9c8b5b0", "src_port": 53, "tcp_stream": null, "udp_stream": 102, "frame_number": 8976, "timestamp_epoch": "1533964898.938935000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "35.185.244.37,35.185.232.105,35.185.219.146,35.185.250.254,35.185.251.80,35.185.199.249,35.185.241.45,35.185.245.217,104.198.109.132,35.185.211.128", "dns.qry.name": "x.bidswitch.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 50552, "event_id": "evt-6a55b1318ba2f13bd4f2d5ee", "src_port": 53, "tcp_stream": null, "udp_stream": 99, "frame_number": 8979, "timestamp_epoch": "1533964898.946941000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "static.mixi.media", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-5e34b4c416273106aea786a9", "src_port": 60204, "tcp_stream": null, "udp_stream": 103, "frame_number": 9215, "timestamp_epoch": "1533964899.117813000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "target.mixi.media", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-f3218610dc6560c5343f8632", "src_port": 58234, "tcp_stream": null, "udp_stream": 104, "frame_number": 9220, "timestamp_epoch": "1533964899.124450000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "stat.media", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-740a4c59ddc94c8e21a9af12", "src_port": 59918, "tcp_stream": null, "udp_stream": 105, "frame_number": 9226, "timestamp_epoch": "1533964899.129114000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "136.243.42.249,136.243.42.207,88.99.95.121,88.99.95.120,88.99.232.10,88.99.210.183", "dns.qry.name": "stat.media", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 59918, "event_id": "evt-30499a34080f89dae8481679", "src_port": 53, "tcp_stream": null, "udp_stream": 105, "frame_number": 9340, "timestamp_epoch": "1533964899.269568000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "pagead2.googlesyndication.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-52d3c01c2212960a092edfd3", "src_port": 53869, "tcp_stream": null, "udp_stream": 106, "frame_number": 9409, "timestamp_epoch": "1533964899.325470000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "cdn.marphezis.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-caf0f800c913c961f2578293", "src_port": 51484, "tcp_stream": null, "udp_stream": 107, "frame_number": 9410, "timestamp_epoch": "1533964899.326173000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "173.0.153.44", "dns.cname": "mixi1-1.s1.mixi.space", "dns.qry.name": "static.mixi.media", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 60204, "event_id": "evt-6ed232cf43ea323b25c9da6f", "src_port": 53, "tcp_stream": null, "udp_stream": 103, "frame_number": 9470, "timestamp_epoch": "1533964899.377567000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "173.0.153.44", "dns.cname": "mixi1-1.s1.mixi.space", "dns.qry.name": "target.mixi.media", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 58234, "event_id": "evt-403f3ba7507f8c5b3d17cc2a", "src_port": 53, "tcp_stream": null, "udp_stream": 104, "frame_number": 9471, "timestamp_epoch": "1533964899.377655000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "2886.tm.zedo.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-3a6e7e40cdf8f8bbacff8e80", "src_port": 59835, "tcp_stream": null, "udp_stream": 108, "frame_number": 9478, "timestamp_epoch": "1533964899.379243000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "216.58.194.162", "dns.cname": "pagead46.l.doubleclick.net", "dns.qry.name": "pagead2.googlesyndication.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 53869, "event_id": "evt-549ef6f03877af1780d9786b", "src_port": 53, "tcp_stream": null, "udp_stream": 106, "frame_number": 9637, "timestamp_epoch": "1533964899.569932000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "23.73.225.194", "dns.cname": "tmgdpr.zedo.net,tm.zedo.edgekey.net,e8969.g.akamaiedge.net", "dns.qry.name": "2886.tm.zedo.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 59835, "event_id": "evt-4bef2da228c855587a7e4f58", "src_port": 53, "tcp_stream": null, "udp_stream": 108, "frame_number": 9752, "timestamp_epoch": "1533964899.625132000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "8.247.90.250", "dns.cname": "ssl.cdn.marphezis.com.c.footprint.net", "dns.qry.name": "cdn.marphezis.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 51484, "event_id": "evt-fe69f9920082ce8dbd60cc37", "src_port": 53, "tcp_stream": null, "udp_stream": 107, "frame_number": 9794, "timestamp_epoch": "1533964899.640925000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "a.company-target.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-93472f2547fcdb266601a2a3", "src_port": 53815, "tcp_stream": null, "udp_stream": 109, "frame_number": 9971, "timestamp_epoch": "1533964899.767493000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "35.186.208.100", "dns.qry.name": "a.company-target.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 53815, "event_id": "evt-1b027268d6b804a15a108f53", "src_port": 53, "tcp_stream": null, "udp_stream": 109, "frame_number": 10021, "timestamp_epoch": "1533964899.857368000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "images9.engageya.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-ad90c3604a477e12b7d83879", "src_port": 50390, "tcp_stream": null, "udp_stream": 110, "frame_number": 10576, "timestamp_epoch": "1533964900.522209000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "teutorigos-cat.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-ef2d033b9dd09e5b7563edec", "src_port": 65362, "tcp_stream": null, "udp_stream": 111, "frame_number": 10577, "timestamp_epoch": "1533964900.523369000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "t.cwkuki.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-be2d857c0ad23b7701f6ee10", "src_port": 62367, "tcp_stream": null, "udp_stream": 112, "frame_number": 10580, "timestamp_epoch": "1533964900.525737000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "b1sync.zemanta.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-ed30cfe5eb81097b7ca55248", "src_port": 57895, "tcp_stream": null, "udp_stream": 113, "frame_number": 10583, "timestamp_epoch": "1533964900.526430000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "ss3.zedo.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-d68819464e773d15f745562a", "src_port": 65289, "tcp_stream": null, "udp_stream": 114, "frame_number": 10605, "timestamp_epoch": "1533964900.561105000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "54.209.71.223,107.23.160.218", "dns.qry.name": "t.cwkuki.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 62367, "event_id": "evt-3086fed152cd4b992091fe7e", "src_port": 53, "tcp_stream": null, "udp_stream": 112, "frame_number": 10606, "timestamp_epoch": "1533964900.584234000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "ucs02.engageya.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-48b40029e70d9b233c8842a2", "src_port": 54072, "tcp_stream": null, "udp_stream": 115, "frame_number": 10615, "timestamp_epoch": "1533964900.592860000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "162.210.199.69,108.59.0.8,162.210.197.137,108.59.4.173,207.244.67.98,207.244.121.25,207.244.94.20,207.244.108.217,207.244.121.27,108.59.4.171,162.210.196.115,108.59.4.172,207.244.110.3,207.244.76.83,108.59.0.12,162.210.196.116,207.244.66.112,198.7.56.229,207.244.67.99", "dns.cname": "b1-lsw-use1.zemanta.com", "dns.qry.name": "b1sync.zemanta.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 57895, "event_id": "evt-585d4d240a5fd3dfc97ce4b9", "src_port": 53, "tcp_stream": null, "udp_stream": 113, "frame_number": 10616, "timestamp_epoch": "1533964900.621029000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "13.33.107.160,13.33.107.209,13.33.107.131,13.33.107.212", "dns.qry.name": "teutorigos-cat.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 65362, "event_id": "evt-dfe4bd93b4dd8a08e484b481", "src_port": 53, "tcp_stream": null, "udp_stream": 111, "frame_number": 10617, "timestamp_epoch": "1533964900.621189000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "23.220.174.162", "dns.cname": "images9.edgekey.net,e15247.dscg.akamaiedge.net", "dns.qry.name": "images9.engageya.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 50390, "event_id": "evt-c2cab8a0a1784b89ba007166", "src_port": 53, "tcp_stream": null, "udp_stream": 110, "frame_number": 10626, "timestamp_epoch": "1533964900.625516000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "95.142.20.29", "dns.qry.name": "ucs02.engageya.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 54072, "event_id": "evt-2d22e1ac67fe63f7bc8f7871", "src_port": 53, "tcp_stream": null, "udp_stream": 115, "frame_number": 10632, "timestamp_epoch": "1533964900.643556000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "s0.2mdn.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-13042e3308ff1f052e49c10b", "src_port": 49991, "tcp_stream": null, "udp_stream": 116, "frame_number": 10635, "timestamp_epoch": "1533964900.651992000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "23.73.239.75", "dns.cname": "wildcard.zedo.com.edgekey.net,e2319.c.akamaiedge.net", "dns.qry.name": "ss3.zedo.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 65289, "event_id": "evt-1a04d1e58106d9c51376dbef", "src_port": 53, "tcp_stream": null, "udp_stream": 114, "frame_number": 10640, "timestamp_epoch": "1533964900.661382000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "216.58.192.6", "dns.cname": "s0-2mdn-net.l.google.com", "dns.qry.name": "s0.2mdn.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 49991, "event_id": "evt-66bc367db81009910d78250a", "src_port": 53, "tcp_stream": null, "udp_stream": 116, "frame_number": 10721, "timestamp_epoch": "1533964900.718497000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "ads.deliverimp.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-b21c07b77f03377c5c624291", "src_port": 54833, "tcp_stream": null, "udp_stream": 117, "frame_number": 10975, "timestamp_epoch": "1533964900.961738000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "widgets.outbrain.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-2033610f76cfcd82cb53a959", "src_port": 63302, "tcp_stream": null, "udp_stream": 118, "frame_number": 10976, "timestamp_epoch": "1533964900.966203000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "54.175.110.202,50.19.205.30,52.202.121.146,52.20.201.251,54.165.113.198,35.169.196.58", "dns.qry.name": "ads.deliverimp.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 54833, "event_id": "evt-4b62d68b128787ba7636a41e", "src_port": 53, "tcp_stream": null, "udp_stream": 117, "frame_number": 11114, "timestamp_epoch": "1533964901.056360000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "delivery-us-west-1.openx.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-02b5ae7de985957a377c7a02", "src_port": 57200, "tcp_stream": null, "udp_stream": 119, "frame_number": 11119, "timestamp_epoch": "1533964901.057490000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "173.241.250.220", "dns.qry.name": "delivery-us-west-1.openx.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 57200, "event_id": "evt-8114b29f92448900aef7921c", "src_port": 53, "tcp_stream": null, "udp_stream": 119, "frame_number": 11261, "timestamp_epoch": "1533964901.134370000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "23.54.22.209", "dns.cname": "wildcard.outbrain.com.edgekey.net,e10883.g.akamaiedge.net", "dns.qry.name": "widgets.outbrain.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 63302, "event_id": "evt-c29d6674539b1579e689df02", "src_port": 53, "tcp_stream": null, "udp_stream": 118, "frame_number": 11285, "timestamp_epoch": "1533964901.153957000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "crt.comodoca.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-cf8cf1d1c9ac3b29ce2886bf", "src_port": 58531, "tcp_stream": null, "udp_stream": 120, "frame_number": 11334, "timestamp_epoch": "1533964901.171968000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "crt.comodoca.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-dddd2a8a0bd001d7a38a00f9", "src_port": 55087, "tcp_stream": null, "udp_stream": 121, "frame_number": 11335, "timestamp_epoch": "1533964901.173416000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "smi2.ru", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-6fcede9198ba4e3d18778523", "src_port": 57621, "tcp_stream": null, "udp_stream": 122, "frame_number": 11425, "timestamp_epoch": "1533964901.268836000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "net.finam.ru", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-dd38c0887e37726b53f8a02c", "src_port": 58464, "tcp_stream": null, "udp_stream": 123, "frame_number": 11426, "timestamp_epoch": "1533964901.269111000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "smi2.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-68191bf682257a829adafc79", "src_port": 63479, "tcp_stream": null, "udp_stream": 124, "frame_number": 11427, "timestamp_epoch": "1533964901.269376000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "104.16.90.188,104.16.91.188,104.16.89.188,104.16.93.188,104.16.92.188", "dns.cname": "crt.comodoca.com.cdn.cloudflare.net", "dns.qry.name": "crt.comodoca.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 55087, "event_id": "evt-3f62f2e6187c712ab06c9974", "src_port": 53, "tcp_stream": null, "udp_stream": 121, "frame_number": 11428, "timestamp_epoch": "1533964901.270602000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "104.16.90.188,104.16.91.188,104.16.89.188,104.16.93.188,104.16.92.188", "dns.cname": "crt.comodoca.com.cdn.cloudflare.net", "dns.qry.name": "crt.comodoca.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 58531, "event_id": "evt-cfec894309487beb99373f4c", "src_port": 53, "tcp_stream": null, "udp_stream": 120, "frame_number": 11429, "timestamp_epoch": "1533964901.270707000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "148.251.82.59", "dns.cname": "smi2.net", "dns.qry.name": "net.finam.ru", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 58464, "event_id": "evt-494358469caefc3599e56a5a", "src_port": 53, "tcp_stream": null, "udp_stream": 123, "frame_number": 11477, "timestamp_epoch": "1533964901.323587000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "148.251.82.59", "dns.qry.name": "smi2.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 63479, "event_id": "evt-66952f3338040a83d501dd01", "src_port": 53, "tcp_stream": null, "udp_stream": 124, "frame_number": 11530, "timestamp_epoch": "1533964901.340738000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "z.moatads.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-075159b96e9f854e89877b26", "src_port": 65131, "tcp_stream": null, "udp_stream": 125, "frame_number": 11727, "timestamp_epoch": "1533964901.537832000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "googleads4.g.doubleclick.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-5fe88a61cfc890f3618c26cc", "src_port": 54153, "tcp_stream": null, "udp_stream": 126, "frame_number": 11738, "timestamp_epoch": "1533964901.548766000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "46.161.36.8,95.213.222.9,95.213.222.11,95.213.222.13,95.213.222.17,95.213.222.27,95.213.222.29,88.212.252.78,88.212.252.69,88.212.252.70,136.243.7.47,136.243.73.56,88.99.56.120,46.161.36.4,46.161.36.6", "dns.qry.name": "smi2.ru", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 57621, "event_id": "evt-94072e57f2ee559cc23f1e4f", "src_port": 53, "tcp_stream": null, "udp_stream": 122, "frame_number": 11789, "timestamp_epoch": "1533964901.574246000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "stags.bluekai.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-53fc1ef461f25087a961d60b", "src_port": 54251, "tcp_stream": null, "udp_stream": 127, "frame_number": 11860, "timestamp_epoch": "1533964901.603537000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "23.54.23.55", "dns.cname": "wildcard.moatads.com.edgekey.net,e13136.g.akamaiedge.net", "dns.qry.name": "z.moatads.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 65131, "event_id": "evt-778046947e6007460b9bba2c", "src_port": 53, "tcp_stream": null, "udp_stream": 125, "frame_number": 11930, "timestamp_epoch": "1533964901.698652000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "216.58.192.2", "dns.cname": "pagead.l.doubleclick.net", "dns.qry.name": "googleads4.g.doubleclick.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 54153, "event_id": "evt-9737a0db426668fc8886ce9a", "src_port": 53, "tcp_stream": null, "udp_stream": 126, "frame_number": 11931, "timestamp_epoch": "1533964901.698739000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "image2.pubmatic.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-5d5675cc4478b0addbb61e33", "src_port": 57805, "tcp_stream": null, "udp_stream": 128, "frame_number": 11954, "timestamp_epoch": "1533964901.706900000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "104.110.128.239", "dns.cname": "tags.bluekai.com.edgekey.net,e13541.x.akamaiedge.net", "dns.qry.name": "stags.bluekai.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 54251, "event_id": "evt-ebb1f273ab19eb39be73b76f", "src_port": 53, "tcp_stream": null, "udp_stream": 127, "frame_number": 11957, "timestamp_epoch": "1533964901.767352000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "104.36.113.17", "dns.cname": "pug33000nfc.pubmatic.com,pug33000nf.pubmatic.com", "dns.qry.name": "image2.pubmatic.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 57805, "event_id": "evt-5a60774bf89d88792f23eb7b", "src_port": 53, "tcp_stream": null, "udp_stream": 128, "frame_number": 11978, "timestamp_epoch": "1533964901.783846000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "saxp.zedo.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-d9aeaffe33b1deea50ff1377", "src_port": 54920, "tcp_stream": null, "udp_stream": 129, "frame_number": 11983, "timestamp_epoch": "1533964901.806285000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "static4.mixi.media", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-bea3fc3ae9a8e37c37270d67", "src_port": 56531, "tcp_stream": null, "udp_stream": 130, "frame_number": 12052, "timestamp_epoch": "1533964901.855110000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "static2.mixi.media", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-0d1423e1ca7d2a16bb92df2e", "src_port": 52282, "tcp_stream": null, "udp_stream": 131, "frame_number": 12058, "timestamp_epoch": "1533964901.857130000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "code.createjs.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-5519c08a454a58383031e13e", "src_port": 59302, "tcp_stream": null, "udp_stream": 132, "frame_number": 12096, "timestamp_epoch": "1533964901.899258000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "54.176.157.57,54.176.31.176", "dns.cname": "ztlb.zedo.net,adxprs-nc-298422198.us-west-1.elb.amazonaws.com", "dns.qry.name": "saxp.zedo.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 54920, "event_id": "evt-bcb75a62fdc221f43f59364c", "src_port": 53, "tcp_stream": null, "udp_stream": 129, "frame_number": 12104, "timestamp_epoch": "1533964901.906766000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "173.0.153.44", "dns.cname": "mixi1-1.s1.mixi.space", "dns.qry.name": "static2.mixi.media", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 52282, "event_id": "evt-f3c77fad6f34cb72a7fea1aa", "src_port": 53, "tcp_stream": null, "udp_stream": 131, "frame_number": 12208, "timestamp_epoch": "1533964901.980409000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "173.0.153.44", "dns.cname": "mixi1-1.s1.mixi.space", "dns.qry.name": "static4.mixi.media", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 56531, "event_id": "evt-6190562f76debe7128da6b71", "src_port": 53, "tcp_stream": null, "udp_stream": 130, "frame_number": 12212, "timestamp_epoch": "1533964901.981250000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "23.35.180.245", "dns.cname": "san-download.adobe.com.edgekey.net,e4937.d.akamaiedge.net", "dns.qry.name": "code.createjs.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 59302, "event_id": "evt-d9edde23c080bfc228efda23", "src_port": 53, "tcp_stream": null, "udp_stream": 132, "frame_number": 12260, "timestamp_epoch": "1533964902.009546000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "px.moatads.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-7b12e918f988e813db8724f1", "src_port": 63593, "tcp_stream": null, "udp_stream": 133, "frame_number": 12552, "timestamp_epoch": "1533964902.453057000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "23.54.23.55", "dns.cname": "wildcard.moatads.com.edgekey.net,e13136.g.akamaiedge.net", "dns.qry.name": "px.moatads.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 63593, "event_id": "evt-59fc98b5d20d6f7831c8ab29", "src_port": 53, "tcp_stream": null, "udp_stream": 133, "frame_number": 12591, "timestamp_epoch": "1533964902.539371000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "static5.mixi.media", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-2dda45429ae3e997a5746c64", "src_port": 56191, "tcp_stream": null, "udp_stream": 134, "frame_number": 12649, "timestamp_epoch": "1533964902.596451000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "173.0.153.44", "dns.cname": "mixi1-1.s1.mixi.space", "dns.qry.name": "static5.mixi.media", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 56191, "event_id": "evt-e4438cc59c4463608a361df7", "src_port": 53, "tcp_stream": null, "udp_stream": 134, "frame_number": 12763, "timestamp_epoch": "1533964902.706045000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "tt1.zedo.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-08916170d0d2c43f403c4a2e", "src_port": 51474, "tcp_stream": null, "udp_stream": 135, "frame_number": 12773, "timestamp_epoch": "1533964902.709304000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "ads.rubiconproject.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-51bd0047a4f7989dd159e395", "src_port": 60063, "tcp_stream": null, "udp_stream": 136, "frame_number": 12778, "timestamp_epoch": "1533964902.711278000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "64.41.197.55,64.41.197.60", "dns.qry.name": "tt1.zedo.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 51474, "event_id": "evt-6d177436b3a2e0538ae9de42", "src_port": 53, "tcp_stream": null, "udp_stream": 135, "frame_number": 12799, "timestamp_epoch": "1533964902.763199000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "23.220.187.187", "dns.cname": "digicertwc.rubiconproject.com.edgekey.net,e8960.e2.akamaiedge.net", "dns.qry.name": "ads.rubiconproject.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 60063, "event_id": "evt-3d2bce1ef69fade3e4625337", "src_port": 53, "tcp_stream": null, "udp_stream": 136, "frame_number": 12842, "timestamp_epoch": "1533964902.809158000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "tag.1rx.io", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-78861a2d1b8da5dba8bbd651", "src_port": 49409, "tcp_stream": null, "udp_stream": 137, "frame_number": 12971, "timestamp_epoch": "1533964902.913737000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "204.2.250.100", "dns.qry.name": "tag.1rx.io", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 49409, "event_id": "evt-d41389f6a2722ced1b05437c", "src_port": 53, "tcp_stream": null, "udp_stream": 137, "frame_number": 13018, "timestamp_epoch": "1533964902.980837000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "odb.outbrain.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-c9d1adfe3a8c4c454ea20ed9", "src_port": 50030, "tcp_stream": null, "udp_stream": 138, "frame_number": 13204, "timestamp_epoch": "1533964903.157823000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "zedo-d.openx.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-b39ab06556b19768024451b5", "src_port": 59421, "tcp_stream": null, "udp_stream": 139, "frame_number": 13252, "timestamp_epoch": "1533964903.183367000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "imasdk.googleapis.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-9a91edf90a8ced337d8c01b5", "src_port": 52631, "tcp_stream": null, "udp_stream": 140, "frame_number": 13322, "timestamp_epoch": "1533964903.228307000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "151.101.2.2,151.101.66.2,151.101.130.2,151.101.194.2", "dns.cname": "prod.outbrain.map.fastlylb.net", "dns.qry.name": "odb.outbrain.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 50030, "event_id": "evt-1b4c3e2a83d2edccdb7a29fb", "src_port": 53, "tcp_stream": null, "udp_stream": 138, "frame_number": 13349, "timestamp_epoch": "1533964903.242983000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "173.241.250.220", "dns.qry.name": "zedo-d.openx.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 59421, "event_id": "evt-72b0f27f2cc155347773c4b4", "src_port": 53, "tcp_stream": null, "udp_stream": 139, "frame_number": 13383, "timestamp_epoch": "1533964903.261260000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "216.58.192.10", "dns.cname": "googleadapis.l.google.com", "dns.qry.name": "imasdk.googleapis.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 52631, "event_id": "evt-6058bcbd7ccd272f49603c6f", "src_port": 53, "tcp_stream": null, "udp_stream": 140, "frame_number": 13400, "timestamp_epoch": "1533964903.310256000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "fastlane-adv.rubiconproject.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-b32d955a2dfe8f5eedbbe48b", "src_port": 53377, "tcp_stream": null, "udp_stream": 141, "frame_number": 13443, "timestamp_epoch": "1533964903.409461000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "qcx.quantserve.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-a0fad0a9c30309f57000ca9c", "src_port": 50064, "tcp_stream": null, "udp_stream": 142, "frame_number": 13463, "timestamp_epoch": "1533964903.459819000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "bidder.criteo.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-a01043008438b72bdae862bc", "src_port": 55203, "tcp_stream": null, "udp_stream": 143, "frame_number": 13464, "timestamp_epoch": "1533964903.460980000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "bid.contextweb.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-4bc91d3a58efd14becc52b80", "src_port": 57665, "tcp_stream": null, "udp_stream": 144, "frame_number": 13486, "timestamp_epoch": "1533964903.479648000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "g2.gumgum.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-802cd9252413adc501080f8e", "src_port": 62052, "tcp_stream": null, "udp_stream": 145, "frame_number": 13493, "timestamp_epoch": "1533964903.481648000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "13.57.70.199,52.8.189.11", "dns.qry.name": "fastlane-adv.rubiconproject.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 53377, "event_id": "evt-8021f3fb3493fb2c88ced69a", "src_port": 53, "tcp_stream": null, "udp_stream": 141, "frame_number": 13494, "timestamp_epoch": "1533964903.481649000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "hb-api.omnitagjs.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-684b2cc44c90dac1e3f80756", "src_port": 59715, "tcp_stream": null, "udp_stream": 146, "frame_number": 13502, "timestamp_epoch": "1533964903.485569000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "74.119.117.70", "dns.qry.name": "bidder.criteo.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 55203, "event_id": "evt-f4efffaf0789721716fc0790", "src_port": 53, "tcp_stream": null, "udp_stream": 143, "frame_number": 13517, "timestamp_epoch": "1533964903.515128000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "64.7.205.2,192.184.65.2,192.184.65.3,64.7.200.4,64.7.201.4,192.184.65.5,64.7.200.3,64.7.201.5,63.251.95.4,63.251.95.3,64.7.200.5,64.7.201.2,64.7.201.3,63.251.95.2,64.7.200.2,192.184.65.4", "dns.qry.name": "qcx.quantserve.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 50064, "event_id": "evt-ae0c8a739fb51e76a096febf", "src_port": 53, "tcp_stream": null, "udp_stream": 142, "frame_number": 13537, "timestamp_epoch": "1533964903.535108000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "35.164.209.30,34.210.7.129,35.165.34.205,34.213.95.197,54.68.91.165,35.160.51.142,34.211.69.152,54.70.199.124", "dns.qry.name": "g2.gumgum.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 62052, "event_id": "evt-47a204a4bbdeeb0e1ff7e226", "src_port": 53, "tcp_stream": null, "udp_stream": 145, "frame_number": 13562, "timestamp_epoch": "1533964903.558314000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "195.244.31.10,195.244.31.11", "dns.cname": "hb-api-usa02.omnitagjs.com", "dns.qry.name": "hb-api.omnitagjs.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 59715, "event_id": "evt-e0ac3044b0c16201878db988", "src_port": 53, "tcp_stream": null, "udp_stream": 146, "frame_number": 13566, "timestamp_epoch": "1533964903.560435000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "74.214.196.133,74.214.196.134", "dns.cname": "sjc-bid-weighted.contextweb.com,sjc-bid-bgp.contextweb.com", "dns.qry.name": "bid.contextweb.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 57665, "event_id": "evt-934cd771e46ce9641f2965c0", "src_port": 53, "tcp_stream": null, "udp_stream": 144, "frame_number": 13593, "timestamp_epoch": "1533964903.573032000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "images.outbrainimg.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-6238c68249c6c79d251eaf03", "src_port": 50852, "tcp_stream": null, "udp_stream": 147, "frame_number": 13640, "timestamp_epoch": "1533964903.629499000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "23.35.182.113", "dns.cname": "wildcard.outbrainimg.com.edgekey.net,e15144.d.akamaiedge.net", "dns.qry.name": "images.outbrainimg.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 50852, "event_id": "evt-52dd8926126e05d2e6bdc21e", "src_port": 53, "tcp_stream": null, "udp_stream": 147, "frame_number": 13794, "timestamp_epoch": "1533964903.730026000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "pix.spot.im", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-3a5e456177b9cfa275549c3e", "src_port": 57347, "tcp_stream": null, "udp_stream": 148, "frame_number": 14316, "timestamp_epoch": "1533964904.262876000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "34.194.201.62,52.207.120.98", "dns.qry.name": "pix.spot.im", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 57347, "event_id": "evt-c1847137af328791b2f45f7c", "src_port": 53, "tcp_stream": null, "udp_stream": 148, "frame_number": 14376, "timestamp_epoch": "1533964904.333194000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "ads.scorecardresearch.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-189b3ae29a6a384cfa27c9cb", "src_port": 53856, "tcp_stream": null, "udp_stream": 149, "frame_number": 14513, "timestamp_epoch": "1533964904.540196000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "id.rlcdn.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-b19ccb61819f96f20b196847", "src_port": 59818, "tcp_stream": null, "udp_stream": 150, "frame_number": 14516, "timestamp_epoch": "1533964904.554032000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "csi.gstatic.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-9fbedf3de2b67db79c008f8b", "src_port": 61209, "tcp_stream": null, "udp_stream": 151, "frame_number": 14517, "timestamp_epoch": "1533964904.556113000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "contextual.media.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-cb177b2d9b1617b06020949b", "src_port": 60584, "tcp_stream": null, "udp_stream": 152, "frame_number": 14557, "timestamp_epoch": "1533964904.585739000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "oxp.mxptint.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-4a8c47aa0a821741ec73f6f1", "src_port": 54810, "tcp_stream": null, "udp_stream": 153, "frame_number": 14558, "timestamp_epoch": "1533964904.586500000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "magnetic.t.domdex.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-e82a124dd08567d4af2ec76b", "src_port": 59592, "tcp_stream": null, "udp_stream": 154, "frame_number": 14564, "timestamp_epoch": "1533964904.594862000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "rtb.gumgum.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-42c3a1f707dfbbe14ec7cf12", "src_port": 64916, "tcp_stream": null, "udp_stream": 155, "frame_number": 14565, "timestamp_epoch": "1533964904.595064000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "i.w55c.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-4b46389a6e5ecd48a3cc4ed0", "src_port": 54464, "tcp_stream": null, "udp_stream": 156, "frame_number": 14568, "timestamp_epoch": "1533964904.596445000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "23.213.38.151", "dns.cname": "sb.scorecardresearch.com.edgekey.net,e1879.e7.akamaiedge.net", "dns.qry.name": "ads.scorecardresearch.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 53856, "event_id": "evt-20bbb95ff402d11560192753", "src_port": 53, "tcp_stream": null, "udp_stream": 149, "frame_number": 14601, "timestamp_epoch": "1533964904.629602000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "4.78.226.232", "dns.qry.name": "oxp.mxptint.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 54810, "event_id": "evt-9d00f1f6884a845c87b93848", "src_port": 53, "tcp_stream": null, "udp_stream": 153, "frame_number": 14611, "timestamp_epoch": "1533964904.637605000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "54.186.237.130,52.24.137.134,52.37.19.179,52.25.151.172,52.38.108.180,52.40.243.130,52.43.107.250,34.213.2.162", "dns.cname": "dxedge-prod-lb-1585771072.us-west-2.elb.amazonaws.com", "dns.qry.name": "i.w55c.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 54464, "event_id": "evt-a016997216148bbc22889daa", "src_port": 53, "tcp_stream": null, "udp_stream": 156, "frame_number": 14613, "timestamp_epoch": "1533964904.637787000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "54.191.4.242,52.41.250.17,52.32.152.21,52.24.57.89,34.208.49.173,54.148.121.12,35.162.194.159,54.187.102.150", "dns.qry.name": "id.rlcdn.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 59818, "event_id": "evt-e56eb35ddc3829612c2b91be", "src_port": 53, "tcp_stream": null, "udp_stream": 150, "frame_number": 14614, "timestamp_epoch": "1533964904.637907000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "v.lkqd.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-f007cd02c2b3cc603c3d5d52", "src_port": 59186, "tcp_stream": null, "udp_stream": 157, "frame_number": 14624, "timestamp_epoch": "1533964904.640864000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "64.233.184.94,64.233.184.120,74.125.126.94,74.125.126.120,108.177.12.94,108.177.12.120,74.125.23.94,74.125.23.120,74.125.200.94,74.125.200.120,74.125.28.94,74.125.28.120,64.233.171.94,64.233.171.120,64.233.161.94,64.233.161.120", "dns.qry.name": "csi.gstatic.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 61209, "event_id": "evt-552a0e6665c2bca0ea28e465", "src_port": 53, "tcp_stream": null, "udp_stream": 151, "frame_number": 14626, "timestamp_epoch": "1533964904.641770000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "optimized-by.rubiconproject.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-ca16ee656cdb0f60adb68eab", "src_port": 53358, "tcp_stream": null, "udp_stream": 158, "frame_number": 14636, "timestamp_epoch": "1533964904.647012000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "52.9.78.114,52.9.113.206,52.9.96.194,52.52.14.142,50.18.110.80,52.8.138.67", "dns.cname": "tracking-prod-public-741746200.us-west-1.elb.amazonaws.com", "dns.qry.name": "magnetic.t.domdex.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 59592, "event_id": "evt-964d2642f40b9931d4325ddf", "src_port": 53, "tcp_stream": null, "udp_stream": 154, "frame_number": 14640, "timestamp_epoch": "1533964904.663956000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "34.211.69.152,35.160.51.142,52.33.181.135,35.164.209.30,52.36.43.94,34.213.95.197,52.36.228.150,35.165.34.205", "dns.qry.name": "rtb.gumgum.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 64916, "event_id": "evt-3be19e7af8730ca9a4598ec8", "src_port": 53, "tcp_stream": null, "udp_stream": 155, "frame_number": 14641, "timestamp_epoch": "1533964904.664048000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "23.8.170.84", "dns.cname": "wildcard.media.net.edgekey.net,e607.e11.akamaiedge.net", "dns.qry.name": "contextual.media.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 60584, "event_id": "evt-21742e0771a5aa8c63b09d49", "src_port": 53, "tcp_stream": null, "udp_stream": 152, "frame_number": 14656, "timestamp_epoch": "1533964904.683765000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "146.20.133.87,146.20.133.97,146.20.133.83,146.20.133.94,146.20.133.85,146.20.133.82,146.20.133.96,146.20.133.89,146.20.133.88,146.20.133.91,146.20.133.95,146.20.133.93,146.20.133.86,146.20.133.92,146.20.133.90,146.20.133.84", "dns.cname": "rs-lb-b.lkqd.net", "dns.qry.name": "v.lkqd.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 59186, "event_id": "evt-1da058f89ce6aeb06c7abafd", "src_port": 53, "tcp_stream": null, "udp_stream": 157, "frame_number": 14679, "timestamp_epoch": "1533964904.689217000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "8.39.36.145,8.39.36.144", "dns.cname": "optimized-by.rubiconproject.net.akadns.net,perf-optimized-by.rubiconproject.net.akadns.net", "dns.qry.name": "optimized-by.rubiconproject.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 53358, "event_id": "evt-1afee07a0ab5f4df3cd61da3", "src_port": 53, "tcp_stream": null, "udp_stream": 158, "frame_number": 14749, "timestamp_epoch": "1533964904.736366000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "tt3.zedo.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-397e2940baf841d5dfbf7dcb", "src_port": 51231, "tcp_stream": null, "udp_stream": 159, "frame_number": 14974, "timestamp_epoch": "1533964904.971944000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "23.73.239.75", "dns.cname": "wildcard.zedo.com.edgekey.net,e2319.c.akamaiedge.net", "dns.qry.name": "tt3.zedo.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 51231, "event_id": "evt-2377073fbfb69ed436e5fa3b", "src_port": 53, "tcp_stream": null, "udp_stream": 159, "frame_number": 15053, "timestamp_epoch": "1533964905.068551000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "ad.lkqd.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-05a7aa01fed9f5bf6c3625d3", "src_port": 52262, "tcp_stream": null, "udp_stream": 160, "frame_number": 15185, "timestamp_epoch": "1533964905.944747000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "205.185.216.10,205.185.216.42", "dns.cname": "cds.n3g2w2j5.hwcdn.net", "dns.qry.name": "ad.lkqd.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 52262, "event_id": "evt-8586b30afd8a5c0a5fb3fc47", "src_port": 53, "tcp_stream": null, "udp_stream": 160, "frame_number": 15186, "timestamp_epoch": "1533964906.152257000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "static.criteo.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-445ee1b8045188cc94863ff9", "src_port": 49373, "tcp_stream": null, "udp_stream": 161, "frame_number": 15268, "timestamp_epoch": "1533964906.418364000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "hbevents.1rx.io", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-9e97292679dbfa410dae91bf", "src_port": 62271, "tcp_stream": null, "udp_stream": 162, "frame_number": 15389, "timestamp_epoch": "1533964906.550970000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "74.119.117.129", "dns.qry.name": "static.criteo.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 49373, "event_id": "evt-2801007573d0d22157d7cc82", "src_port": 53, "tcp_stream": null, "udp_stream": 161, "frame_number": 15402, "timestamp_epoch": "1533964906.564513000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "54.214.11.239,54.244.245.107,54.214.247.4,54.214.30.198,54.244.243.41,54.203.249.16", "dns.cname": "ztag-trackedevents-enterprise-1441845540.us-west-2.elb.amazonaws.com", "dns.qry.name": "hbevents.1rx.io", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 62271, "event_id": "evt-c9e4abb4b5a574114227a2a2", "src_port": 53, "tcp_stream": null, "udp_stream": 162, "frame_number": 15556, "timestamp_epoch": "1533964906.746311000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "t.lkqd.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-3a179a3f1517187cc6fc2814", "src_port": 56281, "tcp_stream": null, "udp_stream": 163, "frame_number": 15606, "timestamp_epoch": "1533964906.852301000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "146.20.132.243,146.20.132.253,146.20.132.251,146.20.132.245,146.20.132.246,146.20.132.247,146.20.132.244,146.20.132.255,146.20.132.250,146.20.132.248,146.20.132.252,146.20.132.242,146.20.132.254,146.20.132.249,146.20.133.0,146.20.133.1", "dns.qry.name": "t.lkqd.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 56281, "event_id": "evt-0407bf745c0d9a038ed8a48e", "src_port": 53, "tcp_stream": null, "udp_stream": 163, "frame_number": 15635, "timestamp_epoch": "1533964906.967863000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "ads.pubmatic.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-53fcc81082f5743cd41eb10d", "src_port": 51692, "tcp_stream": null, "udp_stream": 164, "frame_number": 15784, "timestamp_epoch": "1533964907.606307000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "23.54.21.180", "dns.cname": "pubmatic.edgekey.net,e6603.g.akamaiedge.net", "dns.qry.name": "ads.pubmatic.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 51692, "event_id": "evt-0ba7f692a2fc3fcc3f965615", "src_port": 53, "tcp_stream": null, "udp_stream": 164, "frame_number": 15826, "timestamp_epoch": "1533964907.702394000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "image6.pubmatic.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-3f9666b9613c89bfcad63a50", "src_port": 61160, "tcp_stream": null, "udp_stream": 165, "frame_number": 15919, "timestamp_epoch": "1533964907.947302000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "104.36.113.23", "dns.cname": "pugm33000nfc.pubmatic.com,pugm33000nf.pubmatic.com", "dns.qry.name": "image6.pubmatic.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 61160, "event_id": "evt-38d42d7f43d68a0a075164ea", "src_port": 53, "tcp_stream": null, "udp_stream": 165, "frame_number": 15930, "timestamp_epoch": "1533964908.051426000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "p.adsymptotic.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-cb775c020fc57802c066a6d6", "src_port": 64922, "tcp_stream": null, "udp_stream": 166, "frame_number": 15967, "timestamp_epoch": "1533964908.323614000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "dis.criteo.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-0d08879c7364b3c08a1d17fa", "src_port": 57433, "tcp_stream": null, "udp_stream": 167, "frame_number": 15982, "timestamp_epoch": "1533964908.334286000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "pubmatic-match.dotomi.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-e891630fefd60b1c3917c57a", "src_port": 63507, "tcp_stream": null, "udp_stream": 168, "frame_number": 15985, "timestamp_epoch": "1533964908.336781000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "pubmatic2waycm-atl.netmng.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-92358182b61e4425aff12406", "src_port": 54525, "tcp_stream": null, "udp_stream": 169, "frame_number": 15986, "timestamp_epoch": "1533964908.338567000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "74.119.117.94", "dns.qry.name": "dis.criteo.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 57433, "event_id": "evt-4a8edb1f0d7be86799ac2563", "src_port": 53, "tcp_stream": null, "udp_stream": 167, "frame_number": 15991, "timestamp_epoch": "1533964908.383676000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "simage2.pubmatic.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-a46992e9cb9799b2b031dc93", "src_port": 54474, "tcp_stream": null, "udp_stream": 170, "frame_number": 16023, "timestamp_epoch": "1533964908.405443000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "104.193.83.156,104.193.83.157", "dns.cname": "j2waycm.netmng.com,j2waycm-us-wdc.netmng.com", "dns.qry.name": "pubmatic2waycm-atl.netmng.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 54525, "event_id": "evt-2b11b49d6c5247759e547d46", "src_port": 53, "tcp_stream": null, "udp_stream": 169, "frame_number": 16028, "timestamp_epoch": "1533964908.406114000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "52.44.44.54,52.54.127.128,52.22.107.11,52.206.55.46,52.44.213.64,52.54.208.77,52.23.112.47,52.203.238.185", "dns.cname": "p-awse-ebs.adsymptotic.com,awseb-e-3-awsebloa-8y5luacxamgu-1960109003.us-east-1.elb.amazonaws.com", "dns.qry.name": "p.adsymptotic.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 64922, "event_id": "evt-815750be8a8ad75c9017d91a", "src_port": 53, "tcp_stream": null, "udp_stream": 166, "frame_number": 16032, "timestamp_epoch": "1533964908.406611000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "205.180.87.137", "dns.cname": "afp.dotomi.weighted.com.akadns.net,afp.us.sjc.dotomi.weighted.com.akadns.net,sjc02-usadmm-ds.dotomi.com", "dns.qry.name": "pubmatic-match.dotomi.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 63507, "event_id": "evt-b1add2e7a6d137a18ecdfe88", "src_port": 53, "tcp_stream": null, "udp_stream": 168, "frame_number": 16039, "timestamp_epoch": "1533964908.424347000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "104.36.113.17", "dns.cname": "pug33000nfc.pubmatic.com,pug33000nf.pubmatic.com", "dns.qry.name": "simage2.pubmatic.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 54474, "event_id": "evt-a5481ae0b07b1b49fa9d9858", "src_port": 53, "tcp_stream": null, "udp_stream": 170, "frame_number": 16092, "timestamp_epoch": "1533964908.469322000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "image4.pubmatic.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-626e928295c6d2670cdb83cd", "src_port": 52094, "tcp_stream": null, "udp_stream": 171, "frame_number": 16362, "timestamp_epoch": "1533964908.826784000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "104.36.113.24", "dns.cname": "spug33000nfc.pubmatic.com,spug33000nf.pubmatic.com", "dns.qry.name": "image4.pubmatic.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 52094, "event_id": "evt-11516a157c734dc122618663", "src_port": 53, "tcp_stream": null, "udp_stream": 171, "frame_number": 16389, "timestamp_epoch": "1533964908.885044000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "eus.rubiconproject.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-10c9b2d286235f5a3136268e", "src_port": 52816, "tcp_stream": null, "udp_stream": 172, "frame_number": 16422, "timestamp_epoch": "1533964908.974972000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "184.26.122.58", "dns.cname": "eus.rubiconproject.com.edgekey.net,e8960.d.akamaiedge.net", "dns.qry.name": "eus.rubiconproject.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 52816, "event_id": "evt-5d305f96d8200266f6216052", "src_port": 53, "tcp_stream": null, "udp_stream": 172, "frame_number": 16445, "timestamp_epoch": "1533964909.104131000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "dpm.demdex.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-8b79e3d89670ca7adeb4dff0", "src_port": 57868, "tcp_stream": null, "udp_stream": 173, "frame_number": 16523, "timestamp_epoch": "1533964909.665205000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "54.246.133.167,52.51.131.19,34.251.231.74,46.51.193.164,52.16.89.247,52.17.182.129,34.248.66.236,34.247.143.160", "dns.cname": "gslb.demdex.net,irl1.demdex.net,dcs-edge-irl1-876252164.eu-west-1.elb.amazonaws.com", "dns.qry.name": "dpm.demdex.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 57868, "event_id": "evt-d80cc73cf33a2fda0a0f36a6", "src_port": 53, "tcp_stream": null, "udp_stream": 173, "frame_number": 16524, "timestamp_epoch": "1533964909.718959000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "token.rubiconproject.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-11a3a817d8ef58b2379fc4f7", "src_port": 64055, "tcp_stream": null, "udp_stream": 174, "frame_number": 16538, "timestamp_epoch": "1533964909.995908000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "pixel.rubiconproject.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-9fd0b43377cb2f5571ef262f", "src_port": 50164, "tcp_stream": null, "udp_stream": 175, "frame_number": 16557, "timestamp_epoch": "1533964910.070782000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "8.39.36.172,8.39.36.173", "dns.cname": "perf-token.rubiconproject.net.akadns.net", "dns.qry.name": "token.rubiconproject.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 64055, "event_id": "evt-1bfc79b8491ea5251414a1ca", "src_port": 53, "tcp_stream": null, "udp_stream": 174, "frame_number": 16558, "timestamp_epoch": "1533964910.093175000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "8.39.36.143,8.39.36.142", "dns.cname": "pixel.rubiconproject.net.akadns.net", "dns.qry.name": "pixel.rubiconproject.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 50164, "event_id": "evt-c0c12c6243c9e1db0450db94", "src_port": 53, "tcp_stream": null, "udp_stream": 175, "frame_number": 16602, "timestamp_epoch": "1533964910.201908000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "simage4.pubmatic.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-141fdbc53700583e1313c3ef", "src_port": 63097, "tcp_stream": null, "udp_stream": 176, "frame_number": 16707, "timestamp_epoch": "1533964910.343517000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "104.36.113.24", "dns.cname": "spug33000nfc.pubmatic.com,spug33000nf.pubmatic.com", "dns.qry.name": "simage4.pubmatic.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 63097, "event_id": "evt-a7e2cf4db19f8fc912dfd711", "src_port": 53, "tcp_stream": null, "udp_stream": 176, "frame_number": 16722, "timestamp_epoch": "1533964910.397514000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "ade.googlesyndication.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-e6fcdd9745e0e3eb128a480e", "src_port": 64276, "tcp_stream": null, "udp_stream": 177, "frame_number": 16943, "timestamp_epoch": "1533964912.828553000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "216.58.192.2", "dns.cname": "pagead.l.doubleclick.net", "dns.qry.name": "ade.googlesyndication.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 64276, "event_id": "evt-df7598610532a940c2ca97ff", "src_port": 53, "tcp_stream": null, "udp_stream": 177, "frame_number": 16951, "timestamp_epoch": "1533964912.917076000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "cdn.jsdelivr.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-d735b68bf0871531879d4c5b", "src_port": 54690, "tcp_stream": null, "udp_stream": 178, "frame_number": 17308, "timestamp_epoch": "1533964955.786374000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "94.31.29.138", "dns.cname": "2-01-2cd3-000f.cdx.cedexis.net,jsdelivr3.dak.netdna-cdn.com", "dns.qry.name": "cdn.jsdelivr.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 54690, "event_id": "evt-331470c44d449ee0873e4d94", "src_port": 53, "tcp_stream": null, "udp_stream": 178, "frame_number": 17309, "timestamp_epoch": "1533964955.900897000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "uat-secure.technoratimedia.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-c10df0b35850519ed60ff0e5", "src_port": 62175, "tcp_stream": null, "udp_stream": 179, "frame_number": 17346, "timestamp_epoch": "1533964956.246434000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "35.171.141.177,52.44.165.199,52.73.148.73,34.226.179.16,34.201.202.206,52.72.198.167,54.175.140.118,54.209.175.196", "dns.cname": "uat-net.technoratimedia.com,ads-east1-132899269.us-east-1.elb.amazonaws.com", "dns.qry.name": "uat-secure.technoratimedia.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 62175, "event_id": "evt-da75964aceaf8631a12ec89c", "src_port": 53, "tcp_stream": null, "udp_stream": 179, "frame_number": 17349, "timestamp_epoch": "1533964956.315471000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "vid-io.springserve.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-00b0774ea9942c1dcdbd9d88", "src_port": 55133, "tcp_stream": null, "udp_stream": 180, "frame_number": 17429, "timestamp_epoch": "1533964956.524984000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "52.27.237.90,52.26.10.3,52.32.135.110,52.25.46.76,52.32.112.140,52.25.205.181,52.27.59.211,52.26.246.54", "dns.qry.name": "vid-io.springserve.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 55133, "event_id": "evt-ea30a0ad685d2d4a1317e1fb", "src_port": 53, "tcp_stream": null, "udp_stream": 180, "frame_number": 17691, "timestamp_epoch": "1533964957.010961000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "vid.springserve.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-75204252a969c8038babc9f5", "src_port": 56338, "tcp_stream": null, "udp_stream": 181, "frame_number": 17792, "timestamp_epoch": "1533964957.237351000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "uat-net.technoratimedia.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-cde5960577b8d57c3a1655c7", "src_port": 55099, "tcp_stream": null, "udp_stream": 182, "frame_number": 17854, "timestamp_epoch": "1533964957.358429000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "52.44.165.199,52.73.148.73,34.226.179.16,34.201.202.206,52.72.198.167,54.175.140.118,54.209.175.196,35.171.141.177", "dns.cname": "ads-east1-132899269.us-east-1.elb.amazonaws.com", "dns.qry.name": "uat-net.technoratimedia.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 55099, "event_id": "evt-03cbfa24724508c716458e41", "src_port": 53, "tcp_stream": null, "udp_stream": 182, "frame_number": 17855, "timestamp_epoch": "1533964957.358759000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "35.164.52.21,52.88.9.91,35.163.160.113,34.210.171.204,35.164.101.53,52.25.41.120,35.161.228.236,35.160.145.246", "dns.qry.name": "vid.springserve.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 56338, "event_id": "evt-9af6840d569c6ac4d0869b65", "src_port": 53, "tcp_stream": null, "udp_stream": 181, "frame_number": 17890, "timestamp_epoch": "1533964957.470463000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "pubads.g.doubleclick.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-7a1a15368505d7f2179061b7", "src_port": 52348, "tcp_stream": null, "udp_stream": 183, "frame_number": 18026, "timestamp_epoch": "1533964957.807117000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "216.58.192.2", "dns.cname": "partnerad.l.doubleclick.net", "dns.qry.name": "pubads.g.doubleclick.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 52348, "event_id": "evt-c56efe3f2710e645495ebf1b", "src_port": 53, "tcp_stream": null, "udp_stream": 183, "frame_number": 18111, "timestamp_epoch": "1533964958.070258000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "secure.adnxs.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-79d53723a9d43993ed7d63aa", "src_port": 54018, "tcp_stream": null, "udp_stream": 184, "frame_number": 18164, "timestamp_epoch": "1533964958.349333000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "sync.springserve.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-cd1bfc62461f9cdc65d6818d", "src_port": 50522, "tcp_stream": null, "udp_stream": 185, "frame_number": 18167, "timestamp_epoch": "1533964958.352142000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "sync.1rx.io", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-468e2fe4caa26cb942a6b6d2", "src_port": 54759, "tcp_stream": null, "udp_stream": 186, "frame_number": 18168, "timestamp_epoch": "1533964958.352910000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "sync.aralego.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-88c5c3e3cd61f5350e2ebb14", "src_port": 55876, "tcp_stream": null, "udp_stream": 187, "frame_number": 18169, "timestamp_epoch": "1533964958.353897000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "secure-assets.rubiconproject.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-e27a216ff21c4cd29c0fcb46", "src_port": 65054, "tcp_stream": null, "udp_stream": 188, "frame_number": 18172, "timestamp_epoch": "1533964958.356489000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "8.41.222.241", "dns.qry.name": "sync.1rx.io", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 54759, "event_id": "evt-fdedc9a1fee8f98827f22463", "src_port": 53, "tcp_stream": null, "udp_stream": 186, "frame_number": 18183, "timestamp_epoch": "1533964958.434721000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "104.254.150.69,104.254.150.37,104.254.150.9,104.254.150.59,104.254.150.11,104.254.150.58,104.254.150.13,104.254.150.77", "dns.cname": "g.geogslb.com,ib.anycast.adnxs.com", "dns.qry.name": "secure.adnxs.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 54018, "event_id": "evt-8f81a7ad4f1df6579a42817c", "src_port": 53, "tcp_stream": null, "udp_stream": 184, "frame_number": 18186, "timestamp_epoch": "1533964958.450245000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "207.244.102.143", "dns.qry.name": "sync.aralego.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 55876, "event_id": "evt-1399db3e1882b09a9b1a92be", "src_port": 53, "tcp_stream": null, "udp_stream": 187, "frame_number": 18189, "timestamp_epoch": "1533964958.450799000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "52.26.87.58,34.212.77.105", "dns.qry.name": "sync.springserve.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 50522, "event_id": "evt-1dd6f79074da76a48c3bea3d", "src_port": 53, "tcp_stream": null, "udp_stream": 185, "frame_number": 18200, "timestamp_epoch": "1533964958.477773000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "23.220.187.187", "dns.cname": "digicertwc.rubiconproject.com.edgekey.net,e8960.e2.akamaiedge.net", "dns.qry.name": "secure-assets.rubiconproject.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 65054, "event_id": "evt-159a7349e286efd47e39b1db", "src_port": 53, "tcp_stream": null, "udp_stream": 188, "frame_number": 18210, "timestamp_epoch": "1533964958.485955000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "vpaid.springserve.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-e92a2d3612176e0a5b5b94f9", "src_port": 53354, "tcp_stream": null, "udp_stream": 189, "frame_number": 18233, "timestamp_epoch": "1533964958.535877000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "94.31.29.250", "dns.cname": "vpaid-springserve-net.ssmb.netdna-cdn.com", "dns.qry.name": "vpaid.springserve.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 53354, "event_id": "evt-799a8a59cc244a7da88b8638", "src_port": 53, "tcp_stream": null, "udp_stream": 189, "frame_number": 18270, "timestamp_epoch": "1533964958.600112000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "idsync.rlcdn.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-8801526257fc7b02e02cd3e3", "src_port": 52730, "tcp_stream": null, "udp_stream": 190, "frame_number": 18440, "timestamp_epoch": "1533964959.043665000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "match.basebanner.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-d1b842ef76bab6b7feff8045", "src_port": 64499, "tcp_stream": null, "udp_stream": 191, "frame_number": 18461, "timestamp_epoch": "1533964959.050612000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "idpix.media6degrees.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-e451d8f85386d97b15881d38", "src_port": 59433, "tcp_stream": null, "udp_stream": 192, "frame_number": 18474, "timestamp_epoch": "1533964959.055539000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "a.tribalfusion.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-e3dd536d5fd7b1107bda055d", "src_port": 60504, "tcp_stream": null, "udp_stream": 193, "frame_number": 18475, "timestamp_epoch": "1533964959.057459000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "34.207.5.71,107.23.83.163,34.193.232.33,34.233.6.212,35.169.19.220,52.207.61.182,54.84.37.167,54.210.58.162", "dns.cname": "idsync-ext-weight-2.rlcdn.com", "dns.qry.name": "idsync.rlcdn.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 52730, "event_id": "evt-adc21422bf7446ef3660f0e6", "src_port": 53, "tcp_stream": null, "udp_stream": 190, "frame_number": 18568, "timestamp_epoch": "1533964959.365164000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "151.101.2.49,151.101.66.49,151.101.130.49,151.101.194.49", "dns.cname": "trc.taboola.map.fastly.net", "dns.qry.name": "match.basebanner.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 64499, "event_id": "evt-071ef3b339418afdee35c4d0", "src_port": 53, "tcp_stream": null, "udp_stream": 191, "frame_number": 18574, "timestamp_epoch": "1533964959.368247000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "204.2.197.201", "dns.cname": "map.media6degrees.com,map.dynectmedia6degrees.com", "dns.qry.name": "idpix.media6degrees.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 59433, "event_id": "evt-8a7a6fb6c5455d93b0115db3", "src_port": 53, "tcp_stream": null, "udp_stream": 192, "frame_number": 18626, "timestamp_epoch": "1533964959.502753000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "204.11.109.68,204.11.109.65,204.11.109.66,204.11.109.67", "dns.cname": "a-lb.tribalfusion.com.akadns.net,a-scl1.tribalfusion.com.akadns.net", "dns.qry.name": "a.tribalfusion.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 60504, "event_id": "evt-87dbab7da72a67d24fca11c2", "src_port": 53, "tcp_stream": null, "udp_stream": 193, "frame_number": 18627, "timestamp_epoch": "1533964959.502881000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "cdn-ssl.vidible.tv", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-295a138656de94fc010c13e1", "src_port": 58483, "tcp_stream": null, "udp_stream": 194, "frame_number": 18662, "timestamp_epoch": "1533964959.545185000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "a1.adform.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-b29f189b6554e7f7de5c3e5b", "src_port": 54211, "tcp_stream": null, "udp_stream": 195, "frame_number": 18665, "timestamp_epoch": "1533964959.603319000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "pixel-us-east.rubiconproject.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-37e41747533ededbc8044607", "src_port": 60199, "tcp_stream": null, "udp_stream": 196, "frame_number": 18671, "timestamp_epoch": "1533964959.616289000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "216.115.100.123,216.115.100.124", "dns.cname": "s.gycs.b.yahoodns.net", "dns.qry.name": "cdn-ssl.vidible.tv", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 58483, "event_id": "evt-973ffba9e82acc3a8d264b40", "src_port": 53, "tcp_stream": null, "udp_stream": 194, "frame_number": 18742, "timestamp_epoch": "1533964959.980701000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "185.167.164.39,185.167.164.37", "dns.cname": "a1.adformnet.akadns.net,track-us.adformnet.akadns.net", "dns.qry.name": "a1.adform.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 54211, "event_id": "evt-231165f31a808f522492a5d1", "src_port": 53, "tcp_stream": null, "udp_stream": 195, "frame_number": 18760, "timestamp_epoch": "1533964960.021343000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "208.185.50.80,208.185.50.90", "dns.cname": "pixel-us-east.rubiconproject.net.akadns.net", "dns.qry.name": "pixel-us-east.rubiconproject.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 60199, "event_id": "evt-43cd487bcfdf79c4a9210eb4", "src_port": 53, "tcp_stream": null, "udp_stream": 196, "frame_number": 18786, "timestamp_epoch": "1533964960.049215000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "ads.adaptv.advertising.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-94b231c852dd5f46f44fe5b1", "src_port": 52694, "tcp_stream": null, "udp_stream": 197, "frame_number": 19011, "timestamp_epoch": "1533964960.452739000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "54.183.210.45,52.9.204.110,52.8.70.179,54.193.79.237,52.8.197.244,52.9.74.88,52.52.177.27,52.9.0.53", "dns.cname": "control.adap.tv,control.adap.tv.akadns.net,control-wc-local.adap.tv.akadns.net,ads-zone-b-241530161.us-west-1.elb.amazonaws.com", "dns.qry.name": "ads.adaptv.advertising.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 52694, "event_id": "evt-c8045aba6d2413260e2eddfa", "src_port": 53, "tcp_stream": null, "udp_stream": 197, "frame_number": 19066, "timestamp_epoch": "1533964960.516077000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "s2.adform.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-d556e60d7bcefe50a9e13f55", "src_port": 53160, "tcp_stream": null, "udp_stream": 198, "frame_number": 19141, "timestamp_epoch": "1533964960.729475000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "185.167.166.41,185.167.166.40", "dns.cname": "s2.adformnet.akadns.net,uscdnw.adformnet.akadns.net", "dns.qry.name": "s2.adform.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 53160, "event_id": "evt-eb4160d3b7dca8c4970347d2", "src_port": 53, "tcp_stream": null, "udp_stream": 198, "frame_number": 19168, "timestamp_epoch": "1533964960.869060000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "vid-io.springserve.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-f125eb05614a7307bde9169b", "src_port": 55469, "tcp_stream": null, "udp_stream": 199, "frame_number": 19230, "timestamp_epoch": "1533964961.289231000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "34.213.12.32,35.161.139.221,34.213.219.1,34.214.108.62,34.216.116.50,35.160.44.27,35.160.46.147,34.212.197.102", "dns.qry.name": "vid-io.springserve.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 55469, "event_id": "evt-5e59649d588b6605e326d0b4", "src_port": 53, "tcp_stream": null, "udp_stream": 199, "frame_number": 19231, "timestamp_epoch": "1533964961.387623000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "mm.melia.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-6fbaf28bc7ed8e7e52dc3e39", "src_port": 58479, "tcp_stream": null, "udp_stream": 200, "frame_number": 19245, "timestamp_epoch": "1533964961.545252000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "109.232.197.110,109.232.197.33", "dns.cname": "melia.eulerian.net,ml.eulerian.net", "dns.qry.name": "mm.melia.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 58479, "event_id": "evt-74267d4e2af29f49ce6e5b40", "src_port": 53, "tcp_stream": null, "udp_stream": 200, "frame_number": 19258, "timestamp_epoch": "1533964961.633523000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "acdn.adnxs.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-da5e8e297362067eddf9c868", "src_port": 51059, "tcp_stream": null, "udp_stream": 201, "frame_number": 19272, "timestamp_epoch": "1533964961.686987000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "lax1-ib.adnxs.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-3107061b2e55e5c5ba25bd2c", "src_port": 55753, "tcp_stream": null, "udp_stream": 202, "frame_number": 19273, "timestamp_epoch": "1533964961.687478000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "cdn.adnxs.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-25c974cbcc8a0ccbd846e2cc", "src_port": 56945, "tcp_stream": null, "udp_stream": 203, "frame_number": 19274, "timestamp_epoch": "1533964961.688095000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "tags.crwdcntrl.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-0dcd4a28acbc99799b253b28", "src_port": 56940, "tcp_stream": null, "udp_stream": 204, "frame_number": 19275, "timestamp_epoch": "1533964961.689236000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "104.254.150.77,104.254.150.69,104.254.150.11,104.254.150.9,104.254.150.58,104.254.150.4,104.254.150.37,104.254.150.70", "dns.qry.name": "lax1-ib.adnxs.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 55753, "event_id": "evt-3abd829fedc3d3985c1fa48a", "src_port": 53, "tcp_stream": null, "udp_stream": 202, "frame_number": 19300, "timestamp_epoch": "1533964961.756585000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "151.101.53.108", "dns.cname": "prod.appnexus.map.fastly.net", "dns.qry.name": "acdn.adnxs.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 51059, "event_id": "evt-e321b96e04a73cac817c15d0", "src_port": 53, "tcp_stream": null, "udp_stream": 201, "frame_number": 19305, "timestamp_epoch": "1533964961.766961000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "23.54.20.214", "dns.cname": "secure-adnxs.edgekey.net,e6115.g.akamaiedge.net", "dns.qry.name": "cdn.adnxs.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 56945, "event_id": "evt-ee8e1bfcaf81a432016afe56", "src_port": 53, "tcp_stream": null, "udp_stream": 203, "frame_number": 19312, "timestamp_epoch": "1533964961.782585000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "72.21.91.113", "dns.cname": "cs84.wac.edgecastcdn.net", "dns.qry.name": "tags.crwdcntrl.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 56940, "event_id": "evt-dc36d2433b5ec86d35e7754c", "src_port": 53, "tcp_stream": null, "udp_stream": 204, "frame_number": 19335, "timestamp_epoch": "1533964961.815071000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "melia.sp1.convertro.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-fc3bd5ecbe424418a45092e8", "src_port": 53820, "tcp_stream": null, "udp_stream": 205, "frame_number": 19606, "timestamp_epoch": "1533964962.543898000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "34.237.234.13,52.86.196.91,52.87.104.142,52.3.171.209,34.197.131.250,52.22.167.180,54.236.168.144,54.165.0.72", "dns.qry.name": "melia.sp1.convertro.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 53820, "event_id": "evt-7415776a38aa2c48e8376e3e", "src_port": 53, "tcp_stream": null, "udp_stream": 205, "frame_number": 19619, "timestamp_epoch": "1533964962.605621000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "c.bing.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-613c830f4b745ddeba391a11", "src_port": 54180, "tcp_stream": null, "udp_stream": 206, "frame_number": 19648, "timestamp_epoch": "1533964962.773029000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "odr.mookie1.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-58be6463bf5d491e34f31543", "src_port": 56627, "tcp_stream": null, "udp_stream": 207, "frame_number": 19653, "timestamp_epoch": "1533964962.787255000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "beacon.walmart.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-69fcbc8a225b33d30c5127e9", "src_port": 56345, "tcp_stream": null, "udp_stream": 208, "frame_number": 19654, "timestamp_epoch": "1533964962.787413000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "sync.search.spotxchange.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-2257ae8f1934811a9706e91a", "src_port": 62526, "tcp_stream": null, "udp_stream": 209, "frame_number": 19655, "timestamp_epoch": "1533964962.787611000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "204.79.197.200,13.107.21.200", "dns.cname": "c-bing-com.a-0001.a-msedge.net,a-0001.a-msedge.net", "dns.qry.name": "c.bing.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 54180, "event_id": "evt-882efa64a8569c8323a82312", "src_port": 53, "tcp_stream": null, "udp_stream": 206, "frame_number": 19673, "timestamp_epoch": "1533964962.856769000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "54.209.46.223,52.55.182.21,52.4.188.134,54.209.142.208,52.3.56.159,52.44.175.211,52.22.246.227,54.210.242.59", "dns.cname": "odr-712357372.us-east-1.elb.amazonaws.com", "dns.qry.name": "odr.mookie1.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 56627, "event_id": "evt-848e46b6c5cb8b56533ea784", "src_port": 53, "tcp_stream": null, "udp_stream": 207, "frame_number": 19702, "timestamp_epoch": "1533964962.896098000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "161.170.239.188", "dns.cname": "beacon-cdn.walmart.com.akadns.net", "dns.qry.name": "beacon.walmart.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 56345, "event_id": "evt-4887963d15bd8a209becb5c4", "src_port": 53, "tcp_stream": null, "udp_stream": 208, "frame_number": 19705, "timestamp_epoch": "1533964962.898059000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "198.54.12.145,198.54.12.127", "dns.cname": "sync.search-gtm.spotxchange.com.akadns.net,den01.sync.search.spotxchange.com", "dns.qry.name": "sync.search.spotxchange.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 62526, "event_id": "evt-00018475dedf7365bd16a002", "src_port": 53, "tcp_stream": null, "udp_stream": 209, "frame_number": 19708, "timestamp_epoch": "1533964962.901909000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "m.adnxs.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-b236554a3beedaf5a6e4ef11", "src_port": 58722, "tcp_stream": null, "udp_stream": 210, "frame_number": 19905, "timestamp_epoch": "1533964963.453564000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "104.254.150.179,104.254.150.108", "dns.cname": "microsoft.geo.appnexusgslb.net,m.anycast.adnxs.com", "dns.qry.name": "m.adnxs.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 58722, "event_id": "evt-5f01d288ebe38e2195e521de", "src_port": 53, "tcp_stream": null, "udp_stream": 210, "frame_number": 19910, "timestamp_epoch": "1533964963.540458000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "pixel.tapad.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-9611d63d80cfbc9bf0185889", "src_port": 62801, "tcp_stream": null, "udp_stream": 211, "frame_number": 20027, "timestamp_epoch": "1533964964.071735000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "35.227.197.177", "dns.qry.name": "pixel.tapad.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 62801, "event_id": "evt-c92d480da5c231f6e224e569", "src_port": 53, "tcp_stream": null, "udp_stream": 211, "frame_number": 20032, "timestamp_epoch": "1533964964.154372000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "bcp.crwdcntrl.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-b002f92e499d8eb6d6158e4b", "src_port": 49902, "tcp_stream": null, "udp_stream": 212, "frame_number": 20064, "timestamp_epoch": "1533964964.377258000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "52.8.202.139,52.52.136.196,52.53.134.30,52.8.251.186,13.57.103.80,52.9.185.0", "dns.cname": "td.crwdcntrl.net,nginx-bcp-stacka-1836152436.us-west-1.elb.amazonaws.com", "dns.qry.name": "bcp.crwdcntrl.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 49902, "event_id": "evt-13e131a1f9de01768cac76d9", "src_port": 53, "tcp_stream": null, "udp_stream": 212, "frame_number": 20071, "timestamp_epoch": "1533964964.450971000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "da4pli3l5vc0d.cloudfront.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-9a66278d905df1b6f6928e0d", "src_port": 65220, "tcp_stream": null, "udp_stream": 213, "frame_number": 20088, "timestamp_epoch": "1533964964.561974000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "small-video.edgecast.syn-cdn.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-81568a13d00def8ae4d4f46b", "src_port": 49516, "tcp_stream": null, "udp_stream": 214, "frame_number": 20089, "timestamp_epoch": "1533964964.568163000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "13.33.78.101,13.33.78.217,13.33.78.144,13.33.78.38", "dns.qry.name": "da4pli3l5vc0d.cloudfront.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 65220, "event_id": "evt-e4f8658131ddcaa205683a19", "src_port": 53, "tcp_stream": null, "udp_stream": 213, "frame_number": 20107, "timestamp_epoch": "1533964964.633293000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "192.229.210.158", "dns.cname": "cs574.wpc.edgecastcdn.net", "dns.qry.name": "small-video.edgecast.syn-cdn.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 49516, "event_id": "evt-37e8e72c84135aa8554a3b1b", "src_port": 53, "tcp_stream": null, "udp_stream": 214, "frame_number": 20116, "timestamp_epoch": "1533964964.705871000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "aa.agkn.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-dd61d7ca99303b3074b627ab", "src_port": 55133, "tcp_stream": null, "udp_stream": 180, "frame_number": 20176, "timestamp_epoch": "1533964964.882244000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "ml314.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-3dc9591d524e86949b833a16", "src_port": 62477, "tcp_stream": null, "udp_stream": 215, "frame_number": 20177, "timestamp_epoch": "1533964964.882716000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "loadm.exelator.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-e24bb19ec5a647b62146ad9c", "src_port": 55972, "tcp_stream": null, "udp_stream": 216, "frame_number": 20180, "timestamp_epoch": "1533964964.890981000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "x.skimresources.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-008c0a3734befca0cd9adea7", "src_port": 64873, "tcp_stream": null, "udp_stream": 217, "frame_number": 20181, "timestamp_epoch": "1533964964.890983000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "54.183.248.197,52.9.158.123,54.183.102.11,13.57.96.247,54.183.154.61,54.177.34.72", "dns.qry.name": "x.skimresources.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 64873, "event_id": "evt-31dc58b865d7d140b867e0b1", "src_port": 53, "tcp_stream": null, "udp_stream": 217, "frame_number": 20227, "timestamp_epoch": "1533964965.012520000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "156.154.202.36,156.154.136.36", "dns.qry.name": "aa.agkn.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 55133, "event_id": "evt-08919561cb987206f861df0d", "src_port": 53, "tcp_stream": null, "udp_stream": 180, "frame_number": 20228, "timestamp_epoch": "1533964965.012614000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "54.191.20.146,52.34.250.5", "dns.qry.name": "ml314.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 62477, "event_id": "evt-af7ae51dcd46384ebfc39028", "src_port": 53, "tcp_stream": null, "udp_stream": 215, "frame_number": 20229, "timestamp_epoch": "1533964965.012616000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "63.251.252.12", "dns.cname": "loadus.tm.ssl.exelator.com,us-west.load.exelator.com,load.scexp.exelator.com", "dns.qry.name": "loadm.exelator.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 55972, "event_id": "evt-5dd5efe058cc55bae8c71839", "src_port": 53, "tcp_stream": null, "udp_stream": 216, "frame_number": 20234, "timestamp_epoch": "1533964965.013702000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "pippio.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-b12821f806639a9a5de571b8", "src_port": 50728, "tcp_stream": null, "udp_stream": 218, "frame_number": 20280, "timestamp_epoch": "1533964965.146026000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "107.178.254.65", "dns.qry.name": "pippio.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 50728, "event_id": "evt-e79461f68d61e12c4bd57aca", "src_port": 53, "tcp_stream": null, "udp_stream": 218, "frame_number": 20323, "timestamp_epoch": "1533964965.297460000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "synacor.autoplay-plugins.static-origin.syn-cdn.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-f3bccd4351dc01cacaf0e962", "src_port": 59567, "tcp_stream": null, "udp_stream": 219, "frame_number": 20426, "timestamp_epoch": "1533964965.457165000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "69.168.106.81", "dns.cname": "static-origin.syn-cdn.com,static-origin.bos.syn-cdn.com", "dns.qry.name": "synacor.autoplay-plugins.static-origin.syn-cdn.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 59567, "event_id": "evt-642ced93440c825479f7b50f", "src_port": 53, "tcp_stream": null, "udp_stream": 219, "frame_number": 20551, "timestamp_epoch": "1533964965.682355000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "p.skimresources.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-bab202455a5a1d9018ddcc66", "src_port": 52869, "tcp_stream": null, "udp_stream": 220, "frame_number": 20585, "timestamp_epoch": "1533964965.733767000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "35.190.91.160", "dns.qry.name": "p.skimresources.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 52869, "event_id": "evt-452ef7880e639551db1b994e", "src_port": 53, "tcp_stream": null, "udp_stream": 220, "frame_number": 20725, "timestamp_epoch": "1533964966.306264000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "load77.exelator.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-5b049a279d6ad5de3efcca71", "src_port": 54159, "tcp_stream": null, "udp_stream": 221, "frame_number": 20905, "timestamp_epoch": "1533964966.935817000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "185.180.13.28", "dns.cname": "1605158521.rsc.cdn77.org", "dns.qry.name": "load77.exelator.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 54159, "event_id": "evt-637d8866cc89837fa9e47e75", "src_port": 53, "tcp_stream": null, "udp_stream": 221, "frame_number": 21150, "timestamp_epoch": "1533964967.906377000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "pm.w55c.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-592f8304dd1105a8e1f22f5d", "src_port": 62101, "tcp_stream": null, "udp_stream": 222, "frame_number": 22986, "timestamp_epoch": "1533964996.335466000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "px.adhigh.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-40c59b2c989f0cba76222071", "src_port": 57318, "tcp_stream": null, "udp_stream": 223, "frame_number": 22987, "timestamp_epoch": "1533964996.337677000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "pmp.mxptint.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-2fd5c36ce67705f2a5d6e17c", "src_port": 56506, "tcp_stream": null, "udp_stream": 224, "frame_number": 22988, "timestamp_epoch": "1533964996.338424000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "52.39.151.69,35.162.109.147,54.201.23.177,52.11.94.156,52.88.205.160,52.89.134.163,54.149.176.112,34.209.105.94", "dns.cname": "dxedge-prod-lb-1585771072.us-west-2.elb.amazonaws.com", "dns.qry.name": "pm.w55c.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 62101, "event_id": "evt-0ff69e2761fda397144b17f4", "src_port": 53, "tcp_stream": null, "udp_stream": 222, "frame_number": 23033, "timestamp_epoch": "1533964996.474799000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "4.78.226.233", "dns.qry.name": "pmp.mxptint.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 56506, "event_id": "evt-a108e3f72c50e4007816b761", "src_port": 53, "tcp_stream": null, "udp_stream": 224, "frame_number": 23034, "timestamp_epoch": "1533964996.474895000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "209.58.136.30,209.58.136.29,209.58.139.154,209.58.136.32,23.108.190.222,23.108.190.223,23.108.108.218", "dns.cname": "px-us-ca.adhigh.net", "dns.qry.name": "px.adhigh.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 57318, "event_id": "evt-22e137819b46de87bae0a62c", "src_port": 53, "tcp_stream": null, "udp_stream": 223, "frame_number": 23086, "timestamp_epoch": "1533964996.618558000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "dmp.brand-display.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-a1c40a57a804d79d25eb984f", "src_port": 59274, "tcp_stream": null, "udp_stream": 225, "frame_number": 23095, "timestamp_epoch": "1533964996.653876000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "52.74.108.147,52.221.38.91,52.221.28.32", "dns.qry.name": "dmp.brand-display.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 59274, "event_id": "evt-db39fa15e7de6a7702a6d65e", "src_port": 53, "tcp_stream": null, "udp_stream": 225, "frame_number": 23149, "timestamp_epoch": "1533964996.948203000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "vcdn.adnxs.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-e2f68e5a6faef56c57f83b6d", "src_port": 55703, "tcp_stream": null, "udp_stream": 226, "frame_number": 23164, "timestamp_epoch": "1533964996.955481000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "151.101.41.108", "dns.cname": "prod.appnexus.map.fastly.net", "dns.qry.name": "vcdn.adnxs.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 55703, "event_id": "evt-d7c4ba5bead193528620fb18", "src_port": 53, "tcp_stream": null, "udp_stream": 226, "frame_number": 23216, "timestamp_epoch": "1533964997.081499000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "sync.ipredictive.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-5c9438bea5ea001be2741d14", "src_port": 65067, "tcp_stream": null, "udp_stream": 227, "frame_number": 23249, "timestamp_epoch": "1533964997.188987000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "pixel-a.sitescout.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-cd7d544839b06dabd84f11db", "src_port": 54121, "tcp_stream": null, "udp_stream": 228, "frame_number": 23250, "timestamp_epoch": "1533964997.189399000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "rub.pxl.ace.advertising.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-4810970738c66c6830887d09", "src_port": 50088, "tcp_stream": null, "udp_stream": 229, "frame_number": 23251, "timestamp_epoch": "1533964997.190207000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "rbp.mxptint.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-7999bd92e019552032a83577", "src_port": 56749, "tcp_stream": null, "udp_stream": 230, "frame_number": 23262, "timestamp_epoch": "1533964997.192053000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "52.206.38.25,52.204.11.61,52.204.188.86,52.22.146.31,52.44.153.144,52.45.111.226,52.4.138.39,52.4.92.244", "dns.qry.name": "sync.ipredictive.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 65067, "event_id": "evt-42441ea6e33e407ee9a34370", "src_port": 53, "tcp_stream": null, "udp_stream": 227, "frame_number": 23293, "timestamp_epoch": "1533964997.291196000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "4.78.226.234", "dns.qry.name": "rbp.mxptint.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 56749, "event_id": "evt-d75382c43418d976ed606b30", "src_port": 53, "tcp_stream": null, "udp_stream": 230, "frame_number": 23300, "timestamp_epoch": "1533964997.294014000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "69.174.248.224", "dns.qry.name": "pixel-a.sitescout.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 54121, "event_id": "evt-341d86126eb02888b957d514", "src_port": 53, "tcp_stream": null, "udp_stream": 228, "frame_number": 23321, "timestamp_epoch": "1533964997.328339000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "149.174.66.131,152.163.13.4", "dns.cname": "pxl.ace.advertising.com,pxl.ace.advertising.com.adcom.akadns.net", "dns.qry.name": "rub.pxl.ace.advertising.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 50088, "event_id": "evt-71434d1fd8cce136f7e220f2", "src_port": 53, "tcp_stream": null, "udp_stream": 229, "frame_number": 23322, "timestamp_epoch": "1533964997.328492000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "cms.quantserve.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-6145aba1a68a3b3cae83edb6", "src_port": 55513, "tcp_stream": null, "udp_stream": 231, "frame_number": 23547, "timestamp_epoch": "1533964997.685605000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "t.wayfair.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-bf260e52696b628a01c737c6", "src_port": 49240, "tcp_stream": null, "udp_stream": 232, "frame_number": 23567, "timestamp_epoch": "1533964997.736160000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "e1.emxdgt.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-2f0dee7e20634cf6f5feb169", "src_port": 56729, "tcp_stream": null, "udp_stream": 233, "frame_number": 23568, "timestamp_epoch": "1533964997.737064000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "t.mookie1.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-731d812dddc83b10b6f04512", "src_port": 56042, "tcp_stream": null, "udp_stream": 234, "frame_number": 23569, "timestamp_epoch": "1533964997.744678000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "cm.adform.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-3b2f5ad124b179952c4461cd", "src_port": 61650, "tcp_stream": null, "udp_stream": 235, "frame_number": 23570, "timestamp_epoch": "1533964997.745243000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "ad.360yield.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-69c6b1c63593d556859fb50f", "src_port": 58531, "tcp_stream": null, "udp_stream": 120, "frame_number": 23571, "timestamp_epoch": "1533964997.745387000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "54.69.70.7,54.69.174.218,54.71.113.104,52.40.188.201,34.215.18.221,34.211.210.144,54.69.93.253,52.27.97.168", "dns.cname": "2kpixel.quantserve.com,global.px.quantserve.com,pixel-usw201-lighttpd.pixel.quantserve.net,pixel-usw201-lighttpd-elb-1486028624.us-west-2.elb.amazonaws.com", "dns.qry.name": "cms.quantserve.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 55513, "event_id": "evt-46933837ba1647093876fd08", "src_port": 53, "tcp_stream": null, "udp_stream": 231, "frame_number": 23599, "timestamp_epoch": "1533964997.757167000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "52.20.63.23,52.70.11.152,34.196.187.76,52.206.139.43,18.211.105.159,34.206.215.186,34.196.110.17,54.164.252.1", "dns.cname": "xs2-1096111735.us-east-1.elb.amazonaws.com", "dns.qry.name": "t.mookie1.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 56042, "event_id": "evt-0132b902280b3b82c0753fa4", "src_port": 53, "tcp_stream": null, "udp_stream": 234, "frame_number": 23623, "timestamp_epoch": "1533964997.803829000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "54.196.242.147", "dns.qry.name": "e1.emxdgt.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 56729, "event_id": "evt-510ccefc6ac0de3a5f450d0f", "src_port": 53, "tcp_stream": null, "udp_stream": 233, "frame_number": 23633, "timestamp_epoch": "1533964997.811829000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "23.54.21.179", "dns.cname": "san.wayfair.com.edgekey.net,e6550.g.akamaiedge.net", "dns.qry.name": "t.wayfair.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 49240, "event_id": "evt-5ac2427dbae7fb311a8cc52f", "src_port": 53, "tcp_stream": null, "udp_stream": 232, "frame_number": 23638, "timestamp_epoch": "1533964997.826472000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "37.157.2.234,37.157.6.251,37.157.4.40,37.157.6.245,37.157.4.39", "dns.cname": "track-eu.adformnet.akadns.net", "dns.qry.name": "cm.adform.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 61650, "event_id": "evt-b6bd56ed0d34583654db8bd3", "src_port": 53, "tcp_stream": null, "udp_stream": 235, "frame_number": 23649, "timestamp_epoch": "1533964997.831687000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "52.21.201.75,52.73.178.249,52.73.182.32,52.73.123.67,50.19.51.56,52.55.152.195,52.45.217.171", "dns.cname": "pool.tokyo.iponweb.net", "dns.qry.name": "ad.360yield.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 58531, "event_id": "evt-ff6e672a29d62addfd77702f", "src_port": 53, "tcp_stream": null, "udp_stream": 120, "frame_number": 23682, "timestamp_epoch": "1533964997.887170000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "cacerts.digicert.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-3578d8c048e0dfb3d8158ee8", "src_port": 64308, "tcp_stream": null, "udp_stream": 236, "frame_number": 23933, "timestamp_epoch": "1533964998.322007000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "cacerts.digicert.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-5ec552431c303a4cdb2aa673", "src_port": 54782, "tcp_stream": null, "udp_stream": 237, "frame_number": 23938, "timestamp_epoch": "1533964998.332011000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "104.16.240.184,104.16.237.184,104.16.238.184,104.16.239.184,104.16.241.184", "dns.cname": "cdn.digicertcdn.com", "dns.qry.name": "cacerts.digicert.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 54782, "event_id": "evt-8801feea73cc69f1ec343242", "src_port": 53, "tcp_stream": null, "udp_stream": 237, "frame_number": 23970, "timestamp_epoch": "1533964998.468790000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "104.16.240.184,104.16.237.184,104.16.238.184,104.16.239.184,104.16.241.184", "dns.cname": "cdn.digicertcdn.com", "dns.qry.name": "cacerts.digicert.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 64308, "event_id": "evt-3ff5c1ff524ef83de114e9b3", "src_port": 53, "tcp_stream": null, "udp_stream": 236, "frame_number": 23971, "timestamp_epoch": "1533964998.468958000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "su.addthis.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-8e8b2e1a38456f00d20677cb", "src_port": 57447, "tcp_stream": null, "udp_stream": 238, "frame_number": 24025, "timestamp_epoch": "1533964999.378086000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "r.nexac.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-d96241fa65eea7925161f7cd", "src_port": 51522, "tcp_stream": null, "udp_stream": 239, "frame_number": 24026, "timestamp_epoch": "1533964999.378273000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "thrtle.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-156db7fe6e54fa1bce1fb5cd", "src_port": 60472, "tcp_stream": null, "udp_stream": 240, "frame_number": 24027, "timestamp_epoch": "1533964999.378366000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "tags.bluekai.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-dee721a9a68b6eb119dc6759", "src_port": 64173, "tcp_stream": null, "udp_stream": 241, "frame_number": 24028, "timestamp_epoch": "1533964999.378484000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "54.191.223.36,54.69.219.111,52.43.21.121,54.148.146.218,52.36.101.222,52.36.116.231,54.200.4.214,54.69.22.79", "dns.cname": "gtm01.nexac.com,reach-redirect-service-alb-1568243832.us-west-2.elb.amazonaws.com", "dns.qry.name": "r.nexac.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 51522, "event_id": "evt-7b5810e0cff539549257b03f", "src_port": 53, "tcp_stream": null, "udp_stream": 239, "frame_number": 24037, "timestamp_epoch": "1533964999.457617000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "54.84.105.44,52.7.2.46,107.21.48.136,52.205.207.146,34.193.227.152,54.236.143.74", "dns.qry.name": "thrtle.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 60472, "event_id": "evt-8cf308e1f8100590e985e2a7", "src_port": 53, "tcp_stream": null, "udp_stream": 240, "frame_number": 24040, "timestamp_epoch": "1533964999.467395000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "23.55.114.34", "dns.cname": "m.addthisedge.com,ds-m.addthisedge.com.edgekey.net,e3615.a.akamaiedge.net", "dns.qry.name": "su.addthis.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 57447, "event_id": "evt-fede7bb5c7d2624f9924e4ee", "src_port": 53, "tcp_stream": null, "udp_stream": 238, "frame_number": 24043, "timestamp_epoch": "1533964999.497119000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "104.110.128.239", "dns.cname": "tags.bluekai.com.edgekey.net,e13541.x.akamaiedge.net", "dns.qry.name": "tags.bluekai.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 64173, "event_id": "evt-f32c1752eb9470d2176c4493", "src_port": 53, "tcp_stream": null, "udp_stream": 241, "frame_number": 24044, "timestamp_epoch": "1533964999.506406000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "sync.crwdcntrl.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-8e7562bab46482657abf2d4a", "src_port": 56968, "tcp_stream": null, "udp_stream": 242, "frame_number": 24211, "timestamp_epoch": "1533965000.652945000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "sync.crwdcntrl.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-885a21eecf7b2cdcfab15ed2", "src_port": 56968, "tcp_stream": null, "udp_stream": 242, "frame_number": 24227, "timestamp_epoch": "1533965001.652660000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "52.52.136.196,52.9.185.0,52.8.251.186,52.8.202.139,52.53.134.30,13.57.103.80", "dns.cname": "td.crwdcntrl.net,nginx-bcp-stacka-1836152436.us-west-1.elb.amazonaws.com", "dns.qry.name": "sync.crwdcntrl.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 56968, "event_id": "evt-988b7983e59c407557f7cdae", "src_port": 53, "tcp_stream": null, "udp_stream": 242, "frame_number": 24228, "timestamp_epoch": "1533965001.681775000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "px.owneriq.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-32ede6c96cfe41a5c1d82ed6", "src_port": 49792, "tcp_stream": null, "udp_stream": 243, "frame_number": 26358, "timestamp_epoch": "1533965032.569139000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "match.prod.bidr.io", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-7df1807218b4b24b61103ba1", "src_port": 63504, "tcp_stream": null, "udp_stream": 244, "frame_number": 26359, "timestamp_epoch": "1533965032.570113000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "cookie.brealtime.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-e85d6bce56e56c1df49f16b2", "src_port": 62925, "tcp_stream": null, "udp_stream": 245, "frame_number": 26370, "timestamp_epoch": "1533965032.574941000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "bh.contextweb.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-1a63f274b971035f0cfb9cab", "src_port": 63866, "tcp_stream": null, "udp_stream": 246, "frame_number": 26371, "timestamp_epoch": "1533965032.576510000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "104.24.246.16,104.24.247.16", "dns.cname": "cookie.brealtime.com.cdn.cloudflare.net", "dns.qry.name": "cookie.brealtime.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 62925, "event_id": "evt-aee5ab9d68c47f97e17d8e54", "src_port": 53, "tcp_stream": null, "udp_stream": 245, "frame_number": 26408, "timestamp_epoch": "1533965032.676936000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "52.42.116.214,52.33.53.65,54.200.173.146", "dns.qry.name": "match.prod.bidr.io", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 63504, "event_id": "evt-6477e388650d6a1e61c770c2", "src_port": 53, "tcp_stream": null, "udp_stream": 244, "frame_number": 26411, "timestamp_epoch": "1533965032.677118000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "23.73.231.65", "dns.cname": "wildcard.owneriq.net.edgekey.net,e11294.g.akamaiedge.net", "dns.qry.name": "px.owneriq.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 49792, "event_id": "evt-09f2257c88bb104cc2000576", "src_port": 53, "tcp_stream": null, "udp_stream": 243, "frame_number": 26414, "timestamp_epoch": "1533965032.677681000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "151.101.0.166,151.101.64.166,151.101.128.166,151.101.192.166", "dns.cname": "prod.contextweb.map.fastlylb.net", "dns.qry.name": "bh.contextweb.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 63866, "event_id": "evt-e1d49aa4bc9ab624e3dc1899", "src_port": 53, "tcp_stream": null, "udp_stream": 246, "frame_number": 26420, "timestamp_epoch": "1533965032.696494000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "adserver.adtech.advertising.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-da4081c1101e16f03cff2afb", "src_port": 57749, "tcp_stream": null, "udp_stream": 247, "frame_number": 26598, "timestamp_epoch": "1533965032.986172000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "152.195.14.112", "dns.cname": "glb-ads.one.adtechus.com,cs671.wac.thetacdn.net,cs671.lb.wac.apr-1b09e.edgecastdns.net,cs936.wac.thetacdn.net", "dns.qry.name": "adserver.adtech.advertising.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 57749, "event_id": "evt-0d3fb498a2d3dd337ba2062f", "src_port": 53, "tcp_stream": null, "udp_stream": 247, "frame_number": 26644, "timestamp_epoch": "1533965033.203044000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "track.eyeviewads.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-8d3a2f2de707a02e4f3b9462", "src_port": 58904, "tcp_stream": null, "udp_stream": 248, "frame_number": 26698, "timestamp_epoch": "1533965033.400951000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "rubicon-match.dotomi.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-8ec4735c97e2ee4748e53b22", "src_port": 51545, "tcp_stream": null, "udp_stream": 249, "frame_number": 26699, "timestamp_epoch": "1533965033.401595000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "sync.extend.tv", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-b5dd5759cb0da6050a53b04b", "src_port": 58467, "tcp_stream": null, "udp_stream": 250, "frame_number": 26700, "timestamp_epoch": "1533965033.402325000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "pix.impdesk.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-69b0ee184bfe7437c740b295", "src_port": 50059, "tcp_stream": null, "udp_stream": 251, "frame_number": 26701, "timestamp_epoch": "1533965033.402780000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "sync.tidaltv.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-a76431671dd827c57b08c9ff", "src_port": 65195, "tcp_stream": null, "udp_stream": 252, "frame_number": 26702, "timestamp_epoch": "1533965033.403252000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "54.236.177.89,52.70.2.4,52.72.75.34,54.209.175.132,52.71.249.74,52.7.157.238", "dns.cname": "cookiesyncing-1395500543.us-east-1.elb.amazonaws.com", "dns.qry.name": "sync.extend.tv", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 58467, "event_id": "evt-f66afa5a4d4f8e09fc2b8bf6", "src_port": 53, "tcp_stream": null, "udp_stream": 250, "frame_number": 26727, "timestamp_epoch": "1533965033.481280000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "34.236.230.194,52.203.231.138,52.44.93.202,52.200.135.6,34.195.63.41,34.199.147.44,34.231.203.163,52.3.158.250", "dns.cname": "alb-vpc-pixel-tracker-front-prod-1906776940.us-east-1.elb.amazonaws.com", "dns.qry.name": "track.eyeviewads.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 58904, "event_id": "evt-9247b7b03fadddc0075a5fd8", "src_port": 53, "tcp_stream": null, "udp_stream": 248, "frame_number": 26728, "timestamp_epoch": "1533965033.481510000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "35.190.74.53", "dns.qry.name": "pix.impdesk.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 50059, "event_id": "evt-ff9bcbe284596dfb28a98c92", "src_port": 53, "tcp_stream": null, "udp_stream": 251, "frame_number": 26729, "timestamp_epoch": "1533965033.481704000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "52.11.229.48,52.24.120.129,54.191.120.89,54.191.224.161", "dns.cname": "usorlzdiprd-external-190420686.us-west-2.elb.amazonaws.com", "dns.qry.name": "sync.tidaltv.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 65195, "event_id": "evt-e8ef3d929c5902a1aab87510", "src_port": 53, "tcp_stream": null, "udp_stream": 252, "frame_number": 26736, "timestamp_epoch": "1533965033.496493000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "rp.gwallet.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-851f4401285cdb5a54d87d20", "src_port": 64876, "tcp_stream": null, "udp_stream": 253, "frame_number": 26769, "timestamp_epoch": "1533965033.590617000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "205.180.87.204", "dns.cname": "afp.dotomi.weighted.com.akadns.net,afp.us.sjc.dotomi.weighted.com.akadns.net,sjc06-login-ds.dotomi.com", "dns.qry.name": "rubicon-match.dotomi.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 51545, "event_id": "evt-d03a2974af1f58de543c3d54", "src_port": 53, "tcp_stream": null, "udp_stream": 249, "frame_number": 26802, "timestamp_epoch": "1533965033.625618000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "72.5.64.63", "dns.qry.name": "rp.gwallet.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 64876, "event_id": "evt-c100e0616a8f3934b9f643f2", "src_port": 53, "tcp_stream": null, "udp_stream": 253, "frame_number": 26821, "timestamp_epoch": "1533965033.693499000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "pixeltrack.eyeviewads.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-02bb4be64e24d6909294dc23", "src_port": 56210, "tcp_stream": null, "udp_stream": 254, "frame_number": 26990, "timestamp_epoch": "1533965034.039742000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "52.203.231.138,52.44.93.202,52.200.135.6,34.195.63.41,34.199.147.44,34.231.203.163,52.3.158.250,34.236.230.194", "dns.cname": "alb-vpc-pixel-tracker-front-prod-1906776940.us-east-1.elb.amazonaws.com", "dns.qry.name": "pixeltrack.eyeviewads.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 56210, "event_id": "evt-5b2935462827e093bdf0ead3", "src_port": 53, "tcp_stream": null, "udp_stream": 254, "frame_number": 27021, "timestamp_epoch": "1533965034.135661000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "a1.seadform.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-a2de96480083483d8d2ce368", "src_port": 58225, "tcp_stream": null, "udp_stream": 255, "frame_number": 27153, "timestamp_epoch": "1533965034.720415000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "185.167.164.37,185.167.164.39", "dns.cname": "a1.adformnet.akadns.net,track-us.adformnet.akadns.net", "dns.qry.name": "a1.seadform.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 58225, "event_id": "evt-7179af286edb785483058810", "src_port": 53, "tcp_stream": null, "udp_stream": 255, "frame_number": 27166, "timestamp_epoch": "1533965034.849432000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "dsum-sec.casalemedia.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-7e7787b5a0bec0b38e826851", "src_port": 64986, "tcp_stream": null, "udp_stream": 256, "frame_number": 27296, "timestamp_epoch": "1533965035.302382000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "ads.stickyadstv.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-4fa5d923d660245b5ea70248", "src_port": 54746, "tcp_stream": null, "udp_stream": 257, "frame_number": 27300, "timestamp_epoch": "1533965035.315723000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "appnexus-partners.tremorhub.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-728102a59f7b0f9c44813660", "src_port": 63190, "tcp_stream": null, "udp_stream": 258, "frame_number": 27302, "timestamp_epoch": "1533965035.335814000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "eb2.3lift.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-f550ccb122ff46700dbd6bf7", "src_port": 64652, "tcp_stream": null, "udp_stream": 259, "frame_number": 27303, "timestamp_epoch": "1533965035.335816000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "s.thebrighttag.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-35a5ea289a9dd170a75ec0b6", "src_port": 53507, "tcp_stream": null, "udp_stream": 260, "frame_number": 27304, "timestamp_epoch": "1533965035.353563000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "dh.serving-sys.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-f6dfaa3597aa8cce508dbe8a", "src_port": 64924, "tcp_stream": null, "udp_stream": 261, "frame_number": 27305, "timestamp_epoch": "1533965035.353791000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "jadserve.postrelease.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-5b8d690410d2040e571ee21e", "src_port": 60951, "tcp_stream": null, "udp_stream": 262, "frame_number": 27306, "timestamp_epoch": "1533965035.354027000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "34.236.123.105,34.194.151.202,34.233.214.90,52.3.24.219,35.168.109.209,34.193.211.130,52.3.167.150,52.4.123.24", "dns.cname": "partners-1732315393.us-east-1.elb.amazonaws.com", "dns.qry.name": "appnexus-partners.tremorhub.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 63190, "event_id": "evt-330301b9934351f9b4934759", "src_port": 53, "tcp_stream": null, "udp_stream": 258, "frame_number": 27323, "timestamp_epoch": "1533965035.406624000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "54.241.31.242,50.18.61.120,50.18.61.141,50.18.173.83", "dns.cname": "td.thebrighttag.com", "dns.qry.name": "s.thebrighttag.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 53507, "event_id": "evt-f139354ff6ec824fa95ec708", "src_port": 53, "tcp_stream": null, "udp_stream": 260, "frame_number": 27324, "timestamp_epoch": "1533965035.406855000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "23.54.22.27", "dns.cname": "dsum-sec.casalemedia.com.edgekey.net,e8037.g.akamaiedge.net", "dns.qry.name": "dsum-sec.casalemedia.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 64986, "event_id": "evt-b201726d5dfbdc6f48f78986", "src_port": 53, "tcp_stream": null, "udp_stream": 256, "frame_number": 27329, "timestamp_epoch": "1533965035.426932000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "52.22.112.153,54.173.10.244,35.171.120.51,34.194.88.13,52.203.113.55,34.192.56.110,52.45.218.154,52.202.36.55", "dns.cname": "na-eb2.3lift.com", "dns.qry.name": "eb2.3lift.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 64652, "event_id": "evt-ff36a9f3c7193f3243d05897", "src_port": 53, "tcp_stream": null, "udp_stream": 259, "frame_number": 27332, "timestamp_epoch": "1533965035.434545000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "52.58.174.155,52.29.182.113,18.185.181.189,18.197.74.2", "dns.cname": "haproxy-dmp-euprodfr.sizmdx.com,dmp-eupro-haproxyd-16fgltvm0s4xx-617771131.eu-central-1.elb.amazonaws.com", "dns.qry.name": "dh.serving-sys.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 64924, "event_id": "evt-eeda6c99694c7e1bbd7f8cd1", "src_port": 53, "tcp_stream": null, "udp_stream": 261, "frame_number": 27339, "timestamp_epoch": "1533965035.445254000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "54.193.113.6,54.193.88.44,204.236.186.16,54.241.184.236", "dns.cname": "jadserve.postrelease.com.akadns.net", "dns.qry.name": "jadserve.postrelease.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 60951, "event_id": "evt-c23897467974b5a8ae37ebe2", "src_port": 53, "tcp_stream": null, "udp_stream": 262, "frame_number": 27340, "timestamp_epoch": "1533965035.445360000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "38.106.34.105,38.106.34.163,38.106.34.164,38.106.34.104,38.106.34.155,38.106.34.125,38.106.34.142,38.106.34.160", "dns.cname": "ip1.ads.stickyadstv.com.akadns.net,fp3.ads.stickyadstv.com.akadns.net", "dns.qry.name": "ads.stickyadstv.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 54746, "event_id": "evt-3567059d4532357e1d79d4d0", "src_port": 53, "tcp_stream": null, "udp_stream": 257, "frame_number": 27357, "timestamp_epoch": "1533965035.496495000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "prod.y-medialink.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-bc0c9e141fddc0f1586dc3fa", "src_port": 59597, "tcp_stream": null, "udp_stream": 263, "frame_number": 27451, "timestamp_epoch": "1533965035.621107000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "e.nexac.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-dfad4efe41cb8900730af551", "src_port": 59072, "tcp_stream": null, "udp_stream": 264, "frame_number": 27454, "timestamp_epoch": "1533965035.627357000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "rtb-csync.smartadserver.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-35c160e31a0ea1448e4f5376", "src_port": 61326, "tcp_stream": null, "udp_stream": 265, "frame_number": 27457, "timestamp_epoch": "1533965035.633952000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "sync.teads.tv", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-84fa1b20827cf99c60cf37dd", "src_port": 58648, "tcp_stream": null, "udp_stream": 266, "frame_number": 27458, "timestamp_epoch": "1533965035.636894000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "apnx-match.dotomi.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-3757176666f3b1b8df0d1284", "src_port": 64038, "tcp_stream": null, "udp_stream": 267, "frame_number": 27461, "timestamp_epoch": "1533965035.641721000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "pxl.connexity.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-978cbecf4bd768b00d8c98d8", "src_port": 56863, "tcp_stream": null, "udp_stream": 268, "frame_number": 27462, "timestamp_epoch": "1533965035.643053000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "adventori.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-54886b13dd91d6aa602ec977", "src_port": 50162, "tcp_stream": null, "udp_stream": 269, "frame_number": 27493, "timestamp_epoch": "1533965035.666698000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "54.148.146.218,54.187.42.255,54.187.200.180,54.187.213.9,54.149.127.255,54.191.223.36,54.200.4.214,54.69.219.111", "dns.cname": "gtm02.nexac.com,reach-redirect-service-alb-1568243832.us-west-2.elb.amazonaws.com", "dns.qry.name": "e.nexac.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 59072, "event_id": "evt-41639caf8afb7587d842f13f", "src_port": 53, "tcp_stream": null, "udp_stream": 264, "frame_number": 27522, "timestamp_epoch": "1533965035.690340000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "35.186.202.217", "dns.qry.name": "prod.y-medialink.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 59597, "event_id": "evt-74c6065bf804abedea880bc3", "src_port": 53, "tcp_stream": null, "udp_stream": 263, "frame_number": 27526, "timestamp_epoch": "1533965035.690931000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "185.86.137.43,185.86.137.32,185.86.137.42,185.86.137.17", "dns.cname": "geoced.smartadserver.com,2-01-275d-0017.cdx.cedexis.net,eqx.smartadserver.com", "dns.qry.name": "rtb-csync.smartadserver.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 61326, "event_id": "evt-4a259e291889e6aab018e5bf", "src_port": 53, "tcp_stream": null, "udp_stream": 265, "frame_number": 27532, "timestamp_epoch": "1533965035.693277000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "34.198.191.149,34.237.159.145,54.173.104.93,34.205.99.3,34.196.181.242,52.0.244.217,54.236.222.119,34.198.228.49", "dns.qry.name": "sync.teads.tv", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 58648, "event_id": "evt-95e6e6ea7fb288cd957f3ca2", "src_port": 53, "tcp_stream": null, "udp_stream": 266, "frame_number": 27558, "timestamp_epoch": "1533965035.720501000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "205.180.87.204", "dns.cname": "afp.dotomi.weighted.com.akadns.net,afp.us.sjc.dotomi.weighted.com.akadns.net,sjc06-login-ds.dotomi.com", "dns.qry.name": "apnx-match.dotomi.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 64038, "event_id": "evt-a505b1376c5c2018c06939e5", "src_port": 53, "tcp_stream": null, "udp_stream": 267, "frame_number": 27573, "timestamp_epoch": "1533965035.747066000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "38.106.10.132", "dns.qry.name": "pxl.connexity.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 56863, "event_id": "evt-dfcbc46856ff1144d4cda90d", "src_port": 53, "tcp_stream": null, "udp_stream": 268, "frame_number": 27576, "timestamp_epoch": "1533965035.747687000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "5.39.44.195,217.182.126.163,5.39.44.194,217.182.126.162", "dns.qry.name": "adventori.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 50162, "event_id": "evt-b3832c8b26e102e6cdc70455", "src_port": 53, "tcp_stream": null, "udp_stream": 269, "frame_number": 27577, "timestamp_epoch": "1533965035.747708000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "x.dlx.addthis.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-887d4c93af27e77a335c459f", "src_port": 65108, "tcp_stream": null, "udp_stream": 270, "frame_number": 27879, "timestamp_epoch": "1533965036.166310000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "54.187.167.76,52.89.92.187,52.26.143.166,54.149.221.157,54.68.251.4,54.69.25.207", "dns.cname": "gtm06.nexac.com,reach-tag-service-alb-1521620785.us-west-2.elb.amazonaws.com", "dns.qry.name": "x.dlx.addthis.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 65108, "event_id": "evt-1925b705fcfb5cfd140fe47d", "src_port": 53, "tcp_stream": null, "udp_stream": 270, "frame_number": 27927, "timestamp_epoch": "1533965036.249006000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "www.download.windowsupdate.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-e0b3bc52b269dcc93ba2c90d", "src_port": 53210, "tcp_stream": null, "udp_stream": 271, "frame_number": 27969, "timestamp_epoch": "1533965036.476052000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "www.download.windowsupdate.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-497a8bf8d08d50d55588bb2b", "src_port": 49213, "tcp_stream": null, "udp_stream": 272, "frame_number": 27970, "timestamp_epoch": "1533965036.476055000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "13.107.4.50", "dns.cname": "2-01-3cf7-0009.cdx.cedexis.net,b1ns.au-msedge.net,b1ns.c-0001.c-msedge.net,c-0001.c-msedge.net", "dns.qry.name": "www.download.windowsupdate.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 49213, "event_id": "evt-9fd66831df579ace94800d1f", "src_port": 53, "tcp_stream": null, "udp_stream": 272, "frame_number": 27994, "timestamp_epoch": "1533965036.569466000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "13.107.4.50", "dns.cname": "2-01-3cf7-0009.cdx.cedexis.net,b1ns.au-msedge.net,b1ns.c-0001.c-msedge.net,c-0001.c-msedge.net", "dns.qry.name": "www.download.windowsupdate.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 53210, "event_id": "evt-c0412e8920c8437e04c98a26", "src_port": 53, "tcp_stream": null, "udp_stream": 271, "frame_number": 27995, "timestamp_epoch": "1533965036.569468000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "px.powerlinks.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-c65e2e04f15052a490a5de12", "src_port": 50453, "tcp_stream": null, "udp_stream": 273, "frame_number": 30390, "timestamp_epoch": "1533965098.616151000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "ads.creative-serving.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-87db16643f4bc4c46c33c880", "src_port": 65481, "tcp_stream": null, "udp_stream": 274, "frame_number": 30393, "timestamp_epoch": "1533965098.617525000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "bttrack.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-0ab66519453e0a0810e86615", "src_port": 64067, "tcp_stream": null, "udp_stream": 275, "frame_number": 30402, "timestamp_epoch": "1533965098.634262000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "cm.adgrx.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-7d5dd9e1fb36a87e6b3ca115", "src_port": 64828, "tcp_stream": null, "udp_stream": 276, "frame_number": 30492, "timestamp_epoch": "1533965098.783727000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "match.rundsp.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-b60e62daf37b1aab3ec8561d", "src_port": 57379, "tcp_stream": null, "udp_stream": 277, "frame_number": 30493, "timestamp_epoch": "1533965098.783956000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "match.bnmla.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-5f2aec94057296f97722e4bf", "src_port": 65175, "tcp_stream": null, "udp_stream": 278, "frame_number": 30496, "timestamp_epoch": "1533965098.787226000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "64.38.119.27", "dns.qry.name": "bttrack.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 64067, "event_id": "evt-e1c2fc04ff6aeb78f5ab938e", "src_port": 53, "tcp_stream": null, "udp_stream": 275, "frame_number": 30649, "timestamp_epoch": "1533965099.045804000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "34.234.149.11,52.4.234.47,52.0.134.142,52.71.116.75,52.22.78.109,52.203.152.20,34.234.134.91,54.82.13.247", "dns.qry.name": "px.powerlinks.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 50453, "event_id": "evt-4ceeb178691951ee636beea5", "src_port": 53, "tcp_stream": null, "udp_stream": 273, "frame_number": 30652, "timestamp_epoch": "1533965099.045919000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "52.8.226.99,52.9.116.187", "dns.cname": "elb-aws-ca-clickdistrict-2095435364.us-west-1.elb.amazonaws.com", "dns.qry.name": "ads.creative-serving.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 65481, "event_id": "evt-5e23d4c933ae109065113b08", "src_port": 53, "tcp_stream": null, "udp_stream": 274, "frame_number": 30691, "timestamp_epoch": "1533965099.093757000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "74.217.250.126", "dns.qry.name": "match.bnmla.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 65175, "event_id": "evt-f8c6b1067c128f1b71e8fa81", "src_port": 53, "tcp_stream": null, "udp_stream": 278, "frame_number": 30782, "timestamp_epoch": "1533965099.269249000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "216.52.31.73", "dns.cname": "rtb.adgrx.com", "dns.qry.name": "cm.adgrx.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 64828, "event_id": "evt-6904d2311b65b74dca3db26c", "src_port": 53, "tcp_stream": null, "udp_stream": 276, "frame_number": 30803, "timestamp_epoch": "1533965099.278838000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "52.9.59.235,54.67.106.41,13.57.162.22,52.52.130.100", "dns.cname": "matchuswest-922949909.us-west-1.elb.amazonaws.com", "dns.qry.name": "match.rundsp.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 57379, "event_id": "evt-4154d29ab7742d147dcfdc4e", "src_port": 53, "tcp_stream": null, "udp_stream": 277, "frame_number": 30810, "timestamp_epoch": "1533965099.289135000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "trc.taboola.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-f6b225c5bd5dcf945a75cdcb", "src_port": 62396, "tcp_stream": null, "udp_stream": 279, "frame_number": 31566, "timestamp_epoch": "1533965100.651079000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "match.sharethrough.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-c6e42c4f06d3a0082bdd3b20", "src_port": 54660, "tcp_stream": null, "udp_stream": 280, "frame_number": 31606, "timestamp_epoch": "1533965100.694552000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "ebdr3.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-254410988c5a711377c55fbe", "src_port": 55294, "tcp_stream": null, "udp_stream": 281, "frame_number": 31607, "timestamp_epoch": "1533965100.694974000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "ads.lfstmedia.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-4a957b8592bb6f49943b740e", "src_port": 55284, "tcp_stream": null, "udp_stream": 282, "frame_number": 31608, "timestamp_epoch": "1533965100.695068000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "dsp.adkernel.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-c2022da481b8829133126306", "src_port": 57899, "tcp_stream": null, "udp_stream": 283, "frame_number": 31609, "timestamp_epoch": "1533965100.695251000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "ce.lijit.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-203b03e5d39210384775ce1c", "src_port": 59026, "tcp_stream": null, "udp_stream": 284, "frame_number": 31610, "timestamp_epoch": "1533965100.695463000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "ad.sxp.smartclip.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-3c66073a23a74c3baa015f07", "src_port": 64297, "tcp_stream": null, "udp_stream": 285, "frame_number": 31611, "timestamp_epoch": "1533965100.695737000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "sync.ligadx.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-1394684bfbddcf33e48a37d7", "src_port": 51951, "tcp_stream": null, "udp_stream": 286, "frame_number": 31612, "timestamp_epoch": "1533965100.695740000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "107.178.242.85", "dns.qry.name": "sync.ligadx.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 51951, "event_id": "evt-f06ebaf58ce699b929512b44", "src_port": 53, "tcp_stream": null, "udp_stream": 286, "frame_number": 31668, "timestamp_epoch": "1533965100.795644000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "173.239.42.221", "dns.qry.name": "dsp.adkernel.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 57899, "event_id": "evt-0a9ce272f6499fc0e36a819f", "src_port": 53, "tcp_stream": null, "udp_stream": 283, "frame_number": 31670, "timestamp_epoch": "1533965100.795818000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "209.191.163.209,209.191.163.213,209.191.163.208", "dns.cname": "vap.lijit.com", "dns.qry.name": "ce.lijit.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 59026, "event_id": "evt-ebc273acc717e984fe033964", "src_port": 53, "tcp_stream": null, "udp_stream": 284, "frame_number": 31672, "timestamp_epoch": "1533965100.795928000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "151.101.2.2,151.101.66.2,151.101.130.2,151.101.194.2", "dns.cname": "f2.shared.global.fastly.net", "dns.qry.name": "trc.taboola.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 62396, "event_id": "evt-c7852e46b4e107701d661f88", "src_port": 53, "tcp_stream": null, "udp_stream": 279, "frame_number": 31673, "timestamp_epoch": "1533965100.796418000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "54.217.217.143,54.217.236.197,46.51.169.56,46.51.174.75,54.217.209.217,54.217.228.98,54.228.184.13,54.228.212.156", "dns.qry.name": "ad.sxp.smartclip.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 64297, "event_id": "evt-aa99d642b08030cfbdf3407b", "src_port": 53, "tcp_stream": null, "udp_stream": 285, "frame_number": 31674, "timestamp_epoch": "1533965100.796522000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "70.42.132.5", "dns.qry.name": "ebdr3.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 55294, "event_id": "evt-2d16aa8b676119821bd8f3fe", "src_port": 53, "tcp_stream": null, "udp_stream": 281, "frame_number": 31703, "timestamp_epoch": "1533965100.814252000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "52.201.177.113,54.210.250.119,34.239.239.138,50.19.167.223,23.20.105.102,52.202.74.78,54.175.180.42,34.235.70.251", "dns.cname": "match-us-east-1.sharethrough.com", "dns.qry.name": "match.sharethrough.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 54660, "event_id": "evt-6c3cd48fcaf00f1abcbe8840", "src_port": 53, "tcp_stream": null, "udp_stream": 280, "frame_number": 31704, "timestamp_epoch": "1533965100.817951000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "63.251.253.231,63.251.253.232", "dns.qry.name": "ads.lfstmedia.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 55284, "event_id": "evt-7e548e969dad1f6cadedd546", "src_port": 53, "tcp_stream": null, "udp_stream": 282, "frame_number": 31833, "timestamp_epoch": "1533965100.973117000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "match.taboola.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-c6a692683315251041c5daee", "src_port": 60867, "tcp_stream": null, "udp_stream": 287, "frame_number": 32116, "timestamp_epoch": "1533965101.584554000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "151.101.2.49,151.101.66.49,151.101.130.49,151.101.194.49", "dns.cname": "trc.taboola.map.fastly.net", "dns.qry.name": "match.taboola.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 60867, "event_id": "evt-0a723b482b944e25a7cebb94", "src_port": 53, "tcp_stream": null, "udp_stream": 287, "frame_number": 32144, "timestamp_epoch": "1533965101.694508000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "pixel-sc2.adsymptotic.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-65dd41f75df643a12e15527a", "src_port": 49459, "tcp_stream": null, "udp_stream": 288, "frame_number": 32216, "timestamp_epoch": "1533965102.093914000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "64.125.223.109", "dns.cname": "ads-sc2-lb9.adsymptotic.com", "dns.qry.name": "pixel-sc2.adsymptotic.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 49459, "event_id": "evt-57c9aca5ad3df2eaffaac2fa", "src_port": 53, "tcp_stream": null, "udp_stream": 288, "frame_number": 32219, "timestamp_epoch": "1533965102.184319000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "bid.g.doubleclick.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-b862a116ddcb0f170bd83443", "src_port": 55805, "tcp_stream": null, "udp_stream": 289, "frame_number": 32650, "timestamp_epoch": "1533965134.154546000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "74.125.195.154,74.125.195.157,74.125.195.155,74.125.195.156", "dns.cname": "ads-bid.l.doubleclick.net", "dns.qry.name": "bid.g.doubleclick.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 55805, "event_id": "evt-0d598f370b4a1d2762862d5f", "src_port": 53, "tcp_stream": null, "udp_stream": 289, "frame_number": 32653, "timestamp_epoch": "1533965134.234653000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "rtr.innovid.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-58b11c08ad2121b9e02794cb", "src_port": 57107, "tcp_stream": null, "udp_stream": 290, "frame_number": 32699, "timestamp_epoch": "1533965134.785276000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "52.24.61.237,52.11.73.127,52.42.185.39,34.208.25.6,52.34.60.103,52.34.79.42,52.35.100.30,35.166.4.4", "dns.cname": "rtr-4-split-vohn.rtr.innovid.com.akadns.net,aws-oregon-jrtr.rtr.innovid.com.akadns.net,jrtr-oreg-prod.inbake.com,rtrapp-prod-or-lbj.inbake.com,servingpr-rtrapppr-lpfkrf8kf254-308364978.us-west-2.elb.amazonaws.com", "dns.qry.name": "rtr.innovid.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 57107, "event_id": "evt-91dab3d55d415943a03ee1bb", "src_port": 53, "tcp_stream": null, "udp_stream": 290, "frame_number": 32701, "timestamp_epoch": "1533965134.862529000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "s-static.innovid.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-d0aaf950fe86dc13785ac570", "src_port": 63185, "tcp_stream": null, "udp_stream": 291, "frame_number": 32735, "timestamp_epoch": "1533965135.331791000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "23.54.21.240", "dns.cname": "s-static.innovid.com.edgekey.net,e7614.g.akamaiedge.net", "dns.qry.name": "s-static.innovid.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 63185, "event_id": "evt-2eb7b54c785069eda30258a2", "src_port": 53, "tcp_stream": null, "udp_stream": 291, "frame_number": 32736, "timestamp_epoch": "1533965135.439362000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "cdn.doubleverify.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-3e54658e6c236ba8c757ccd1", "src_port": 63648, "tcp_stream": null, "udp_stream": 292, "frame_number": 32836, "timestamp_epoch": "1533965136.002564000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "s.innovid.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-2157e546036c171674357cf8", "src_port": 60164, "tcp_stream": null, "udp_stream": 293, "frame_number": 32839, "timestamp_epoch": "1533965136.010238000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "18.218.6.11,18.220.35.131,13.59.169.161,18.219.146.238,18.221.66.92,52.15.253.50,13.59.61.143,52.15.46.161", "dns.cname": "stats-geo-split.s.innovid.com.akadns.net,aws-ohio-virginia-oregon.s.innovid.com.akadns.net,stats-ohio-prod.inbake.com,stats-prod-oh-lbj.inbake.com,servingpr-statspro-86bjq6b4uyjt-596993143.us-east-2.elb.amazonaws.com", "dns.qry.name": "s.innovid.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 60164, "event_id": "evt-6fb0043ee23b4b9d3fcc83be", "src_port": 53, "tcp_stream": null, "udp_stream": 293, "frame_number": 32841, "timestamp_epoch": "1533965136.087192000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "23.54.20.74", "dns.cname": "wildcard.doubleverify.com.edgekey.net,e990.g.akamaiedge.net", "dns.qry.name": "cdn.doubleverify.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 63648, "event_id": "evt-a8bc910eed2e9b59f63dc236", "src_port": 53, "tcp_stream": null, "udp_stream": 292, "frame_number": 32847, "timestamp_epoch": "1533965136.094373000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "cdn3.doubleverify.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-5d2c28ce35e21506d38cd7ec", "src_port": 58966, "tcp_stream": null, "udp_stream": 294, "frame_number": 32943, "timestamp_epoch": "1533965136.507812000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "rtb0.doubleverify.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-75df585aed7adfce41afe861", "src_port": 55715, "tcp_stream": null, "udp_stream": 295, "frame_number": 32944, "timestamp_epoch": "1533965136.578793000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "23.54.20.74", "dns.cname": "wildcard.doubleverify.com.edgekey.net,e990.g.akamaiedge.net", "dns.qry.name": "cdn3.doubleverify.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 58966, "event_id": "evt-924debc8622bb84bffb08715", "src_port": 53, "tcp_stream": null, "udp_stream": 294, "frame_number": 32947, "timestamp_epoch": "1533965136.618382000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "63.251.109.87", "dns.cname": "bs-geo.dvgtm.akadns.net,bs-wlb-uswest.dvgtm.akadns.net,cacp-hlb.dvgtm.akadns.net", "dns.qry.name": "rtb0.doubleverify.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 55715, "event_id": "evt-740c3a71f439c83bb78429d5", "src_port": 53, "tcp_stream": null, "udp_stream": 295, "frame_number": 32962, "timestamp_epoch": "1533965136.678702000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "ag.innovid.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-5871520fd01aa13f2533ea1e", "src_port": 52153, "tcp_stream": null, "udp_stream": 296, "frame_number": 32965, "timestamp_epoch": "1533965136.705665000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "52.33.44.132,52.25.98.6,52.35.138.60,52.35.48.81,52.43.42.188,52.35.251.146,52.11.6.29,52.25.20.224", "dns.cname": "ag-3-split.ag.innovid.com.akadns.net,aws-oreg-cali-virg.ag.innovid.com.akadns.net,aragorn-oreg-prod.inbake.com,aragornapp-prod-or-lbj.inbake.com,servingpr-aragorna-1r7of9fkz4kos-735852295.us-west-2.elb.amazonaws.com", "dns.qry.name": "ag.innovid.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 52153, "event_id": "evt-f7593598570d97c5a4d41fb1", "src_port": 53, "tcp_stream": null, "udp_stream": 296, "frame_number": 32987, "timestamp_epoch": "1533965136.794310000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "tps702.doubleverify.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-cd7188f8ba113fceefa16c1d", "src_port": 62916, "tcp_stream": null, "udp_stream": 297, "frame_number": 33067, "timestamp_epoch": "1533965137.026488000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "63.251.109.87", "dns.cname": "cacp-hlb.doubleverify.com,cacp-hlb.dvgtm.akadns.net", "dns.qry.name": "tps702.doubleverify.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 62916, "event_id": "evt-6a992b0d29341f5a35864f3f", "src_port": 53, "tcp_stream": null, "udp_stream": 297, "frame_number": 33093, "timestamp_epoch": "1533965137.114452000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "tps.doubleverify.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-5b291f01974ee5eb5d5846c2", "src_port": 50313, "tcp_stream": null, "udp_stream": 298, "frame_number": 33372, "timestamp_epoch": "1533965137.714649000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "63.251.109.87", "dns.cname": "tps30.doubleverify.com,tps-geo.dvgtm.akadns.net,tps-wlb-uswest.dvgtm.akadns.net,cacp-hlb.dvgtm.akadns.net", "dns.qry.name": "tps.doubleverify.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 50313, "event_id": "evt-1e643c93ed088d315aa76111", "src_port": 53, "tcp_stream": null, "udp_stream": 298, "frame_number": 33377, "timestamp_epoch": "1533965137.904526000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "cm.eyereturn.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-34f32ca5dde53adf84e6fa61", "src_port": 58667, "tcp_stream": null, "udp_stream": 299, "frame_number": 33838, "timestamp_epoch": "1533965157.679632000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "rtb.adentifi.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-02c327cbd476985284047fcb", "src_port": 56854, "tcp_stream": null, "udp_stream": 300, "frame_number": 33846, "timestamp_epoch": "1533965157.683154000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "35.186.239.238", "dns.qry.name": "cm.eyereturn.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 58667, "event_id": "evt-389db1921380c75888bc52db", "src_port": 53, "tcp_stream": null, "udp_stream": 299, "frame_number": 33923, "timestamp_epoch": "1533965157.846245000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "52.4.175.160,34.226.161.213,34.226.50.209,34.224.45.36,34.239.209.246,35.169.72.130,34.235.5.53,54.165.9.33", "dns.qry.name": "rtb.adentifi.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 56854, "event_id": "evt-eb391e7f481e90fa3b54724f", "src_port": 53, "tcp_stream": null, "udp_stream": 300, "frame_number": 33970, "timestamp_epoch": "1533965157.910445000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "dsp.adfarm1.adition.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-df953c5a39df2da6040b4745", "src_port": 51799, "tcp_stream": null, "udp_stream": 301, "frame_number": 35492, "timestamp_epoch": "1533965160.270599000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "delivery.h.switchadhub.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-deb0242dfd40b943c6831af5", "src_port": 55777, "tcp_stream": null, "udp_stream": 302, "frame_number": 35493, "timestamp_epoch": "1533965160.270758000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "sync.adotmob.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-7c17420f6aa82ab15fce382b", "src_port": 63711, "tcp_stream": null, "udp_stream": 303, "frame_number": 35494, "timestamp_epoch": "1533965160.271065000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "cs.adingo.jp", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-6cfcfccf75e81be2d9d9dfdc", "src_port": 55252, "tcp_stream": null, "udp_stream": 304, "frame_number": 35495, "timestamp_epoch": "1533965160.271382000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "synchroscript.deliveryengine.adswizz.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-e476aa1cbab811e64f82f7dc", "src_port": 49468, "tcp_stream": null, "udp_stream": 305, "frame_number": 35496, "timestamp_epoch": "1533965160.271640000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "pre-usermatch.targeting.unrulymedia.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-6602998dffd60df6f9605281", "src_port": 64655, "tcp_stream": null, "udp_stream": 306, "frame_number": 35497, "timestamp_epoch": "1533965160.271885000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "d5p.de17a.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-d23b368c7f0594ded4db9992", "src_port": 49792, "tcp_stream": null, "udp_stream": 243, "frame_number": 35499, "timestamp_epoch": "1533965160.272196000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "54.92.93.205,54.65.114.208,54.64.66.233,54.64.58.164", "dns.qry.name": "cs.adingo.jp", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 55252, "event_id": "evt-07148db689b9e65cb0cbcf19", "src_port": 53, "tcp_stream": null, "udp_stream": 304, "frame_number": 35517, "timestamp_epoch": "1533965160.353225000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "85.114.159.93,85.114.159.118", "dns.qry.name": "dsp.adfarm1.adition.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 51799, "event_id": "evt-9ed0675b2a7637ca02297e44", "src_port": 53, "tcp_stream": null, "udp_stream": 301, "frame_number": 35520, "timestamp_epoch": "1533965160.354275000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "35.201.123.46", "dns.qry.name": "delivery.h.switchadhub.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 55777, "event_id": "evt-1599f19178deab9dfdf2b3e4", "src_port": 53, "tcp_stream": null, "udp_stream": 302, "frame_number": 35521, "timestamp_epoch": "1533965160.354413000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "213.155.156.164,213.155.156.180,213.155.156.165,213.155.156.184,213.155.156.169,213.155.156.168,213.155.156.166,213.155.156.181,213.155.156.185,213.155.156.183,213.155.156.182,213.155.156.167", "dns.qry.name": "d5p.de17a.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 49792, "event_id": "evt-fe3649cdb54a1a0ba62b60a3", "src_port": 53, "tcp_stream": null, "udp_stream": 243, "frame_number": 35522, "timestamp_epoch": "1533965160.354549000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "18.218.60.224,18.218.252.177", "dns.qry.name": "sync.adotmob.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 63711, "event_id": "evt-27ac52fbb5a55f90c129ef51", "src_port": 53, "tcp_stream": null, "udp_stream": 303, "frame_number": 35536, "timestamp_epoch": "1533965160.370088000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "52.211.165.177,52.212.134.173,34.246.164.247,34.246.74.216,52.48.186.5,52.212.137.44", "dns.cname": "ec2eu-de-1.deliveryengine.adswizz.com,ec2eu-de-1-vpc-20170223.deliveryengine.adswizz.com,ec2eu-de-delivery-mj3yhpnl6lxc-1867114727.eu-west-1.elb.amazonaws.com", "dns.qry.name": "synchroscript.deliveryengine.adswizz.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 49468, "event_id": "evt-03cb3ab6e87b2de85ba56b40", "src_port": 53, "tcp_stream": null, "udp_stream": 305, "frame_number": 35537, "timestamp_epoch": "1533965160.370309000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "23.20.36.175,34.206.197.3,52.44.246.171,34.236.75.36", "dns.qry.name": "pre-usermatch.targeting.unrulymedia.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 64655, "event_id": "evt-6bbd4e6e1a4d97ce670fdaa1", "src_port": 53, "tcp_stream": null, "udp_stream": 306, "frame_number": 35556, "timestamp_epoch": "1533965160.381946000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "tps700.doubleverify.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-c2b44ef05bf38c348071c374", "src_port": 54687, "tcp_stream": null, "udp_stream": 307, "frame_number": 38808, "timestamp_epoch": "1533965240.128848000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "63.251.109.87", "dns.cname": "cacp-hlb.doubleverify.com,cacp-hlb.dvgtm.akadns.net", "dns.qry.name": "tps700.doubleverify.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 54687, "event_id": "evt-5dccc2fffda15f58a9dba017", "src_port": 53, "tcp_stream": null, "udp_stream": 307, "frame_number": 38809, "timestamp_epoch": "1533965240.205005000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "www.download.windowsupdate.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-97338a6cca0c129c067576fe", "src_port": 64315, "tcp_stream": null, "udp_stream": 308, "frame_number": 39481, "timestamp_epoch": "1533965400.871842000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "205.185.216.42,205.185.216.10", "dns.cname": "2-01-3cf7-0009.cdx.cedexis.net,cds.d2s7q6s2.hwcdn.net", "dns.qry.name": "www.download.windowsupdate.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 64315, "event_id": "evt-a58900cdaac8851f1b130a56", "src_port": 53, "tcp_stream": null, "udp_stream": 308, "frame_number": 39482, "timestamp_epoch": "1533965401.063902000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.ForestDnsZones.sputnikhouse.org", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-162e07e745282ff5eb95f145", "src_port": 52847, "tcp_stream": null, "udp_stream": 309, "frame_number": 39582, "timestamp_epoch": "1533965407.390401000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "192.168.1.6", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.ForestDnsZones.sputnikhouse.org", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 52847, "event_id": "evt-ca2a08d2323135186e2d7837", "src_port": 53, "tcp_stream": null, "udp_stream": 309, "frame_number": 39583, "timestamp_epoch": "1533965407.390593000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.DomainDnsZones.sputnikhouse.org", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-79de5f4d2e460149dd8f3f48", "src_port": 65030, "tcp_stream": null, "udp_stream": 311, "frame_number": 39594, "timestamp_epoch": "1533965407.491461000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "192.168.1.6", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.DomainDnsZones.sputnikhouse.org", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 65030, "event_id": "evt-ef4cda494b83286d6c096d04", "src_port": 53, "tcp_stream": null, "udp_stream": 311, "frame_number": 39595, "timestamp_epoch": "1533965407.491736000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "Petrov2018-PC.sputnikhouse.org", "dns.qry.type": "6", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-bcf177f40b6698be07b606c9", "src_port": 49595, "tcp_stream": null, "udp_stream": 314, "frame_number": 39653, "timestamp_epoch": "1533965410.182850000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "192.168.1.6", "dns.qry.name": "Petrov2018-PC.sputnikhouse.org", "dns.qry.type": "6", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 49595, "event_id": "evt-f483d77ce96734f32cffa6ec", "src_port": 53, "tcp_stream": null, "udp_stream": 314, "frame_number": 39654, "timestamp_epoch": "1533965410.183053000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.a": "192.168.1.95", "dns.qry.name": "sputnikhouse.org", "dns.qry.type": "6", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-4932e4cf39ea3a5bf9d7f665", "src_port": 64650, "tcp_stream": null, "udp_stream": 315, "frame_number": 39655, "timestamp_epoch": "1533965410.183603000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "192.168.1.95", "dns.qry.name": "sputnikhouse.org", "dns.qry.type": "6", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 64650, "event_id": "evt-a82561990c7bbb36f18a4b83", "src_port": 53, "tcp_stream": null, "udp_stream": 315, "frame_number": 39656, "timestamp_epoch": "1533965410.184627000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "Petrov2018-PC.sputnikhouse.org", "dns.qry.type": "6", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-94e06cc727f181dc2d07c0f5", "src_port": 53076, "tcp_stream": null, "udp_stream": 316, "frame_number": 39657, "timestamp_epoch": "1533965410.185413000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "192.168.1.6", "dns.qry.name": "Petrov2018-PC.sputnikhouse.org", "dns.qry.type": "6", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 53076, "event_id": "evt-b0c0aba176291f2ce101b7d3", "src_port": 53, "tcp_stream": null, "udp_stream": 316, "frame_number": 39658, "timestamp_epoch": "1533965410.185581000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.a": "192.168.1.95", "dns.qry.name": "sputnikhouse.org", "dns.qry.type": "6", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-fff808a7f606182f920669bb", "src_port": 52195, "tcp_stream": null, "udp_stream": 317, "frame_number": 39659, "timestamp_epoch": "1533965410.186117000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "192.168.1.95", "dns.qry.name": "sputnikhouse.org", "dns.qry.type": "6", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 52195, "event_id": "evt-b6a7f4d3b778ca4cdcf48335", "src_port": 53, "tcp_stream": null, "udp_stream": 317, "frame_number": 39660, "timestamp_epoch": "1533965410.186527000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "pop.yandex.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-cbd65c4646d719b02d924cf8", "src_port": 52726, "tcp_stream": null, "udp_stream": 318, "frame_number": 39813, "timestamp_epoch": "1533965567.110094000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "87.250.251.37,93.158.134.37,213.180.204.37", "dns.cname": "pop.yandex.ru", "dns.qry.name": "pop.yandex.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 52726, "event_id": "evt-2fee84a0cc98295e0e3d43cc", "src_port": 53, "tcp_stream": null, "udp_stream": 318, "frame_number": 39814, "timestamp_epoch": "1533965567.514714000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "smtp.yandex.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-bf016fb47b90ec707a87737f", "src_port": 51194, "tcp_stream": null, "udp_stream": 319, "frame_number": 39903, "timestamp_epoch": "1533965605.526057000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "93.158.134.38,213.180.193.38,213.180.204.38,77.88.21.38,87.250.250.38", "dns.cname": "smtp.yandex.ru", "dns.qry.name": "smtp.yandex.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 51194, "event_id": "evt-22fd58d512b188b59f41c63c", "src_port": 53, "tcp_stream": null, "udp_stream": 319, "frame_number": 39904, "timestamp_epoch": "1533965605.965885000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "tass.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-146f2691b18bd18f873c829d", "src_port": 54153, "tcp_stream": null, "udp_stream": 126, "frame_number": 40086, "timestamp_epoch": "1533965768.345089000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "103.5.149.72", "dns.qry.name": "tass.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 54153, "event_id": "evt-d0671c82c5f1fe284362a125", "src_port": 53, "tcp_stream": null, "udp_stream": 126, "frame_number": 40087, "timestamp_epoch": "1533965768.408215000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "wpad.sputnikhouse.org", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-30577b50900ae69aea2af2f0", "src_port": 55923, "tcp_stream": null, "udp_stream": 320, "frame_number": 40088, "timestamp_epoch": "1533965768.474387000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.qry.name": "wpad.sputnikhouse.org", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 55923, "event_id": "evt-38740de6944b3445fc83d6ce", "src_port": 53, "tcp_stream": null, "udp_stream": 320, "frame_number": 40089, "timestamp_epoch": "1533965768.474612000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "wpad.localdomain", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-b96bb52ce06ea38a799275d2", "src_port": 50302, "tcp_stream": null, "udp_stream": 321, "frame_number": 40090, "timestamp_epoch": "1533965768.474924000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.qry.name": "wpad.localdomain", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 50302, "event_id": "evt-ad4e540e1b82660ea87cfce5", "src_port": 53, "tcp_stream": null, "udp_stream": 321, "frame_number": 40095, "timestamp_epoch": "1533965768.531747000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "vk.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-96175df4a2afbe0962ce6327", "src_port": 50599, "tcp_stream": null, "udp_stream": 323, "frame_number": 40119, "timestamp_epoch": "1533965770.058014000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "87.240.129.133,87.240.129.71,87.240.180.136,87.240.182.224", "dns.qry.name": "vk.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 50599, "event_id": "evt-77d2ff1cd74bf3eeeb796e6d", "src_port": 53, "tcp_stream": null, "udp_stream": 323, "frame_number": 40120, "timestamp_epoch": "1533965770.136548000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "phototass1.cdnvideo.ru", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-ad9095748d7f216929fb1765", "src_port": 50685, "tcp_stream": null, "udp_stream": 324, "frame_number": 40130, "timestamp_epoch": "1533965770.287434000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "cdn1.tass.ru", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-ce0241664c48f2a43c64579c", "src_port": 58360, "tcp_stream": null, "udp_stream": 325, "frame_number": 40131, "timestamp_epoch": "1533965770.288010000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "phototass4.cdnvideo.ru", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-ed785c0e6d2f54af18421715", "src_port": 54862, "tcp_stream": null, "udp_stream": 326, "frame_number": 40132, "timestamp_epoch": "1533965770.289792000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "cdn2.tass.ru", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-dc43fe0086505e53b5fc2a2c", "src_port": 61950, "tcp_stream": null, "udp_stream": 327, "frame_number": 40133, "timestamp_epoch": "1533965770.289999000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "phototass3.cdnvideo.ru", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-41ec8095db0a488d9781142e", "src_port": 61598, "tcp_stream": null, "udp_stream": 328, "frame_number": 40134, "timestamp_epoch": "1533965770.290547000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "phototass2.cdnvideo.ru", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-21da2f915b4cc54f8b93f58a", "src_port": 61124, "tcp_stream": null, "udp_stream": 329, "frame_number": 40137, "timestamp_epoch": "1533965770.291819000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "151.236.85.22", "dns.qry.name": "phototass1.cdnvideo.ru", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 50685, "event_id": "evt-3aaf4e821c83578eae74afe1", "src_port": 53, "tcp_stream": null, "udp_stream": 324, "frame_number": 40193, "timestamp_epoch": "1533965770.483961000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "91.216.130.22", "dns.qry.name": "cdn2.tass.ru", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 61950, "event_id": "evt-da5a0dde9f52159824bccb6a", "src_port": 53, "tcp_stream": null, "udp_stream": 327, "frame_number": 40215, "timestamp_epoch": "1533965770.562042000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "151.236.120.42", "dns.qry.name": "phototass4.cdnvideo.ru", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 54862, "event_id": "evt-16fedd6aac97f1b9e40a8c44", "src_port": 53, "tcp_stream": null, "udp_stream": 326, "frame_number": 40222, "timestamp_epoch": "1533965770.569135000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "91.216.130.21", "dns.qry.name": "cdn1.tass.ru", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 58360, "event_id": "evt-2bce10999f3759e23029c6e6", "src_port": 53, "tcp_stream": null, "udp_stream": 325, "frame_number": 40223, "timestamp_epoch": "1533965770.569360000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "151.236.98.22", "dns.qry.name": "phototass3.cdnvideo.ru", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 61598, "event_id": "evt-e83414c46c32a554ecb2f940", "src_port": 53, "tcp_stream": null, "udp_stream": 328, "frame_number": 40224, "timestamp_epoch": "1533965770.569362000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "109.201.156.81", "dns.qry.name": "phototass2.cdnvideo.ru", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 61124, "event_id": "evt-93f2c6ad3dbd20427d568396", "src_port": 53, "tcp_stream": null, "udp_stream": 329, "frame_number": 40243, "timestamp_epoch": "1533965770.575466000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "api.bing.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-c1f50246b2f496fa7e9f20ee", "src_port": 54139, "tcp_stream": null, "udp_stream": 330, "frame_number": 41222, "timestamp_epoch": "1533965772.517902000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "api.bing.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-6e41a453cd12f330f88b0ec0", "src_port": 54958, "tcp_stream": null, "udp_stream": 331, "frame_number": 41223, "timestamp_epoch": "1533965772.517905000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-e8e21db507893e13adde5a3a", "src_port": 65367, "tcp_stream": null, "udp_stream": 332, "frame_number": 41224, "timestamp_epoch": "1533965772.518384000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-305359fd028210eb87666b3f", "src_port": 64470, "tcp_stream": null, "udp_stream": 333, "frame_number": 41225, "timestamp_epoch": "1533965772.518739000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-6903cbd8a427d4cb547c7a67", "src_port": 56128, "tcp_stream": null, "udp_stream": 334, "frame_number": 41226, "timestamp_epoch": "1533965772.519191000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-ce997229db3219663dda5c15", "src_port": 64483, "tcp_stream": null, "udp_stream": 335, "frame_number": 41227, "timestamp_epoch": "1533965772.519388000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "api.bing.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-5553b523a6dd6d2bcd688542", "src_port": 54958, "tcp_stream": null, "udp_stream": 331, "frame_number": 41443, "timestamp_epoch": "1533965773.530763000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "api.bing.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-488faeb9ecca9a4eeeb5d90f", "src_port": 54139, "tcp_stream": null, "udp_stream": 330, "frame_number": 41444, "timestamp_epoch": "1533965773.530766000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-f87893615e627646ee513c10", "src_port": 65367, "tcp_stream": null, "udp_stream": 332, "frame_number": 41445, "timestamp_epoch": "1533965773.531006000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-e7a5b46bbce3135b05c46b62", "src_port": 64470, "tcp_stream": null, "udp_stream": 333, "frame_number": 41446, "timestamp_epoch": "1533965773.531031000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-5fa1f152a8cbc54a09848d14", "src_port": 56128, "tcp_stream": null, "udp_stream": 334, "frame_number": 41447, "timestamp_epoch": "1533965773.531293000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-c558185b043af0f3e32e88d1", "src_port": 64483, "tcp_stream": null, "udp_stream": 335, "frame_number": 41448, "timestamp_epoch": "1533965773.531295000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "13.107.5.80", "dns.cname": "api-bing-com.e-0001.e-msedge.net,e-0001.e-msedge.net", "dns.qry.name": "api.bing.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 54958, "event_id": "evt-d8d3148c9391bd8cb8ac3b36", "src_port": 53, "tcp_stream": null, "udp_stream": 331, "frame_number": 41615, "timestamp_epoch": "1533965774.364547000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "13.107.5.80", "dns.cname": "api-bing-com.e-0001.e-msedge.net,e-0001.e-msedge.net", "dns.qry.name": "api.bing.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 54958, "event_id": "evt-8a5b57a6dc8e9e84870479a4", "src_port": 53, "tcp_stream": null, "udp_stream": 331, "frame_number": 41618, "timestamp_epoch": "1533965774.364689000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "13.107.5.80", "dns.cname": "api-bing-com.e-0001.e-msedge.net,e-0001.e-msedge.net", "dns.qry.name": "api.bing.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 54139, "event_id": "evt-fbdc6f9487203aaedb4f607a", "src_port": 53, "tcp_stream": null, "udp_stream": 330, "frame_number": 41619, "timestamp_epoch": "1533965774.364956000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-697c4905b7cdda82c6e68320", "src_port": 65367, "tcp_stream": null, "udp_stream": 332, "frame_number": 41730, "timestamp_epoch": "1533965774.543297000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-e9287f20a4df2a027d092c37", "src_port": 56128, "tcp_stream": null, "udp_stream": 334, "frame_number": 41731, "timestamp_epoch": "1533965774.543389000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-4c96764e42e07f3d71d35fb3", "src_port": 64470, "tcp_stream": null, "udp_stream": 333, "frame_number": 41732, "timestamp_epoch": "1533965774.543470000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-1ec7379d0463bb62db7706f5", "src_port": 64483, "tcp_stream": null, "udp_stream": 335, "frame_number": 41733, "timestamp_epoch": "1533965774.543565000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-e0d9ed2618847d51d6927352", "src_port": 64470, "tcp_stream": null, "udp_stream": 333, "frame_number": 42562, "timestamp_epoch": "1533965776.555335000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-360e59d89e5630d7a42e0f74", "src_port": 64483, "tcp_stream": null, "udp_stream": 335, "frame_number": 42563, "timestamp_epoch": "1533965776.555337000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-0dd824a0df6ce7ee77db77e7", "src_port": 56128, "tcp_stream": null, "udp_stream": 334, "frame_number": 42564, "timestamp_epoch": "1533965776.555580000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-feb337f68c1428c39659988f", "src_port": 65367, "tcp_stream": null, "udp_stream": 332, "frame_number": 42565, "timestamp_epoch": "1533965776.555582000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "204.79.197.229", "dns.cname": "afddnsperftest-a.trafficmanager.net,www-bing-com.a-0026.a-msedge.net,a-0026.a-msedge.net", "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 64483, "event_id": "evt-a4ead3666674f5acda363e1c", "src_port": 53, "tcp_stream": null, "udp_stream": 335, "frame_number": 42737, "timestamp_epoch": "1533965777.047036000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "204.79.197.229", "dns.cname": "afddnsperftest-a.trafficmanager.net,www-bing-com.a-0026.a-msedge.net,a-0026.a-msedge.net", "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 56128, "event_id": "evt-cc1fc8e9782fbe71641c22ed", "src_port": 53, "tcp_stream": null, "udp_stream": 334, "frame_number": 42738, "timestamp_epoch": "1533965777.047173000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "204.79.197.229", "dns.cname": "afddnsperftest-a.trafficmanager.net,www-bing-com.a-0026.a-msedge.net,a-0026.a-msedge.net", "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 65367, "event_id": "evt-94b1ce5909d9faac78fffaa5", "src_port": 53, "tcp_stream": null, "udp_stream": 332, "frame_number": 42739, "timestamp_epoch": "1533965777.047205000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "204.79.197.229", "dns.cname": "afddnsperftest-a.trafficmanager.net,www-bing-com.a-0026.a-msedge.net,a-0026.a-msedge.net", "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 64470, "event_id": "evt-abade4513a3accc48bf8b268", "src_port": 53, "tcp_stream": null, "udp_stream": 333, "frame_number": 42741, "timestamp_epoch": "1533965777.047368000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "204.79.197.200,13.107.21.200", "dns.cname": "www-bing-com.a-0001.a-msedge.net,a-0001.a-msedge.net", "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 64470, "event_id": "evt-93f8906e6895b44193657a21", "src_port": 53, "tcp_stream": null, "udp_stream": 333, "frame_number": 43410, "timestamp_epoch": "1533965778.972314000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "204.79.197.200,13.107.21.200", "dns.cname": "www-bing-com.a-0001.a-msedge.net,a-0001.a-msedge.net", "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 56128, "event_id": "evt-00bd730642b04c038923e000", "src_port": 53, "tcp_stream": null, "udp_stream": 334, "frame_number": 43411, "timestamp_epoch": "1533965778.972428000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "204.79.197.200,13.107.21.200", "dns.cname": "www-bing-com.a-0001.a-msedge.net,a-0001.a-msedge.net", "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 64483, "event_id": "evt-78569e010021c4ab1e63a9c0", "src_port": 53, "tcp_stream": null, "udp_stream": 335, "frame_number": 43412, "timestamp_epoch": "1533965778.972581000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "204.79.197.200,13.107.21.200", "dns.cname": "www-bing-com.a-0001.a-msedge.net,a-0001.a-msedge.net", "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 64470, "event_id": "evt-34698f7f399cd57a6b43ebfe", "src_port": 53, "tcp_stream": null, "udp_stream": 333, "frame_number": 43413, "timestamp_epoch": "1533965778.972688000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "204.79.197.200,13.107.21.200", "dns.cname": "www-bing-com.a-0001.a-msedge.net,a-0001.a-msedge.net", "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 56128, "event_id": "evt-88a8945027d127479442d2ab", "src_port": 53, "tcp_stream": null, "udp_stream": 334, "frame_number": 43415, "timestamp_epoch": "1533965778.972803000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "204.79.197.200,13.107.21.200", "dns.cname": "www-bing-com.a-0001.a-msedge.net,a-0001.a-msedge.net", "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 64483, "event_id": "evt-abca5af823415e530de7484d", "src_port": 53, "tcp_stream": null, "udp_stream": 335, "frame_number": 43417, "timestamp_epoch": "1533965778.972805000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "204.79.197.200,13.107.21.200", "dns.cname": "www-bing-com.a-0001.a-msedge.net,a-0001.a-msedge.net", "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 56128, "event_id": "evt-ba2d3bf5d442707f36912127", "src_port": 53, "tcp_stream": null, "udp_stream": 334, "frame_number": 43418, "timestamp_epoch": "1533965778.972933000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "204.79.197.200,13.107.21.200", "dns.cname": "www-bing-com.a-0001.a-msedge.net,a-0001.a-msedge.net", "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 64470, "event_id": "evt-922883d3bf75d0a93c091485", "src_port": 53, "tcp_stream": null, "udp_stream": 333, "frame_number": 43419, "timestamp_epoch": "1533965778.972999000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "204.79.197.200,13.107.21.200", "dns.cname": "www-bing-com.a-0001.a-msedge.net,a-0001.a-msedge.net", "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 64483, "event_id": "evt-8b1889939a6c876ff344b6c3", "src_port": 53, "tcp_stream": null, "udp_stream": 335, "frame_number": 43420, "timestamp_epoch": "1533965778.973091000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "204.79.197.200,13.107.21.200", "dns.cname": "www-bing-com.a-0001.a-msedge.net,a-0001.a-msedge.net", "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 65367, "event_id": "evt-b2474e6fbddc8466de66e330", "src_port": 53, "tcp_stream": null, "udp_stream": 332, "frame_number": 43421, "timestamp_epoch": "1533965778.973203000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "www.googletagservices.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-fe4f6ff6d3cd985415e8a043", "src_port": 64289, "tcp_stream": null, "udp_stream": 336, "frame_number": 43637, "timestamp_epoch": "1533965782.964876000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "an.yandex.ru", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-630ca63d93f9fd71cd41576a", "src_port": 56976, "tcp_stream": null, "udp_stream": 337, "frame_number": 43638, "timestamp_epoch": "1533965783.001053000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "rtax.criteo.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-e0f5f225e29bd5ea611b17f1", "src_port": 49370, "tcp_stream": null, "udp_stream": 338, "frame_number": 43639, "timestamp_epoch": "1533965783.004773000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "www.googletagmanager.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-3162050c68909b45aa1e557b", "src_port": 64443, "tcp_stream": null, "udp_stream": 339, "frame_number": 43640, "timestamp_epoch": "1533965783.005376000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "counter.yadro.ru", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-9f042a57659d2b826f8c0274", "src_port": 52111, "tcp_stream": null, "udp_stream": 340, "frame_number": 43641, "timestamp_epoch": "1533965783.022652000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "www.tns-counter.ru", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-8dcb735e740dd48f445f7a55", "src_port": 63575, "tcp_stream": null, "udp_stream": 341, "frame_number": 43642, "timestamp_epoch": "1533965783.028088000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "194.226.130.228,194.226.130.226,194.226.130.227,194.226.130.229", "dns.qry.name": "www.tns-counter.ru", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 63575, "event_id": "evt-25cd7bbc51359ae98dea8c4a", "src_port": 53, "tcp_stream": null, "udp_stream": 341, "frame_number": 43643, "timestamp_epoch": "1533965783.028284000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "connect.facebook.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-94b55c87f0b036acdb366d2a", "src_port": 51278, "tcp_stream": null, "udp_stream": 342, "frame_number": 43646, "timestamp_epoch": "1533965783.030794000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "platform.twitter.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-428525469b99d9162376acf7", "src_port": 58784, "tcp_stream": null, "udp_stream": 343, "frame_number": 43647, "timestamp_epoch": "1533965783.031263000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "216.58.194.162", "dns.cname": "pagead46.l.doubleclick.net", "dns.qry.name": "www.googletagservices.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 64289, "event_id": "evt-786676e25cad4fb858c237ce", "src_port": 53, "tcp_stream": null, "udp_stream": 336, "frame_number": 43648, "timestamp_epoch": "1533965783.044158000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "93.158.134.90,87.250.250.90,213.180.204.90,213.180.193.90,77.88.21.90", "dns.qry.name": "an.yandex.ru", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 56976, "event_id": "evt-cf79e0dd6a6865cf45a82b5f", "src_port": 53, "tcp_stream": null, "udp_stream": 337, "frame_number": 43651, "timestamp_epoch": "1533965783.060399000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "88.212.196.103,88.212.196.104,88.212.196.105,88.212.196.122,88.212.196.123,88.212.196.124,88.212.201.193,88.212.201.194,88.212.201.195,88.212.201.196,88.212.201.197,88.212.201.199,88.212.201.205,88.212.201.207,88.212.201.208,88.212.196.66,88.212.196.69,88.212.196.72,88.212.196.75,88.212.196.77,88.212.196.101,88.212.196.102", "dns.qry.name": "counter.yadro.ru", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 52111, "event_id": "evt-035325906605bd608ae0bfb0", "src_port": 53, "tcp_stream": null, "udp_stream": 340, "frame_number": 43654, "timestamp_epoch": "1533965783.076721000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "74.119.117.100", "dns.qry.name": "rtax.criteo.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 49370, "event_id": "evt-b6d294822f247630003bc56e", "src_port": 53, "tcp_stream": null, "udp_stream": 338, "frame_number": 43659, "timestamp_epoch": "1533965783.084459000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "216.58.192.8", "dns.cname": "www-googletagmanager.l.google.com", "dns.qry.name": "www.googletagmanager.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 64443, "event_id": "evt-6f4993843945c8d5ca49d48a", "src_port": 53, "tcp_stream": null, "udp_stream": 339, "frame_number": 43662, "timestamp_epoch": "1533965783.090968000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "192.229.163.25", "dns.cname": "cs472.wac.edgecastcdn.net,cs1-apr-8315.wac.edgecastcdn.net,wac.apr-8315.edgecastdns.net,cs1-lb-us.8315.ecdns.net,cs491.wac.edgecastcdn.net", "dns.qry.name": "platform.twitter.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 58784, "event_id": "evt-c39ddc6c2c04df881aa7293a", "src_port": 53, "tcp_stream": null, "udp_stream": 343, "frame_number": 43671, "timestamp_epoch": "1533965783.112888000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "157.240.11.22", "dns.cname": "scontent.xx.fbcdn.net", "dns.qry.name": "connect.facebook.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 51278, "event_id": "evt-f917c309776172b2262db56f", "src_port": 53, "tcp_stream": null, "udp_stream": 342, "frame_number": 43674, "timestamp_epoch": "1533965783.128458000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "mc.yandex.ru", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-213a142ec7df4de81160523d", "src_port": 60901, "tcp_stream": null, "udp_stream": 344, "frame_number": 43677, "timestamp_epoch": "1533965783.159102000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "adservice.google.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-c24981b21d46af99c141edee", "src_port": 60183, "tcp_stream": null, "udp_stream": 345, "frame_number": 43722, "timestamp_epoch": "1533965783.242495000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "93.158.134.119,77.88.21.119,87.250.251.119,87.250.250.119", "dns.qry.name": "mc.yandex.ru", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 60901, "event_id": "evt-f62f99769b80b7d4f9c942f3", "src_port": 53, "tcp_stream": null, "udp_stream": 344, "frame_number": 43729, "timestamp_epoch": "1533965783.276443000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "216.58.194.162", "dns.cname": "pagead46.l.doubleclick.net", "dns.qry.name": "adservice.google.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 60183, "event_id": "evt-8c85b2099a434f0446c48eb4", "src_port": 53, "tcp_stream": null, "udp_stream": 345, "frame_number": 43840, "timestamp_epoch": "1533965783.630277000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "securepubads.g.doubleclick.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-d32d0e2d74d8e0845f3325e2", "src_port": 62752, "tcp_stream": null, "udp_stream": 346, "frame_number": 43899, "timestamp_epoch": "1533965783.771120000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "216.58.192.2", "dns.cname": "partnerad.l.doubleclick.net", "dns.qry.name": "securepubads.g.doubleclick.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 62752, "event_id": "evt-7273ea4d2e7a2892bf61f9b9", "src_port": 53, "tcp_stream": null, "udp_stream": 346, "frame_number": 44008, "timestamp_epoch": "1533965783.935554000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "tpc.googlesyndication.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-d21dce8337277894b455e78e", "src_port": 60201, "tcp_stream": null, "udp_stream": 347, "frame_number": 44102, "timestamp_epoch": "1533965784.176878000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "staticxx.facebook.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-e7734d10795518ef1a7591c0", "src_port": 56430, "tcp_stream": null, "udp_stream": 348, "frame_number": 44116, "timestamp_epoch": "1533965784.194344000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "cdn.onthe.io", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-94db0ce806a732de9b4df40b", "src_port": 60530, "tcp_stream": null, "udp_stream": 349, "frame_number": 44127, "timestamp_epoch": "1533965784.244464000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "www.youtube.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-0afa4e803bafad7ce3f28b49", "src_port": 56510, "tcp_stream": null, "udp_stream": 350, "frame_number": 44128, "timestamp_epoch": "1533965784.248113000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "www.google-analytics.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-51bfd9f8d7e3943dc6bd8ad7", "src_port": 55436, "tcp_stream": null, "udp_stream": 351, "frame_number": 44137, "timestamp_epoch": "1533965784.278556000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "216.58.192.1", "dns.cname": "pagead-googlehosted.l.google.com", "dns.qry.name": "tpc.googlesyndication.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 60201, "event_id": "evt-3d04d4f7b2a41da9c8f40d44", "src_port": 53, "tcp_stream": null, "udp_stream": 347, "frame_number": 44193, "timestamp_epoch": "1533965784.401633000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "157.240.11.22", "dns.cname": "scontent.xx.fbcdn.net", "dns.qry.name": "staticxx.facebook.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 56430, "event_id": "evt-fe8c06ff3c588fd82e925ea3", "src_port": 53, "tcp_stream": null, "udp_stream": 348, "frame_number": 44214, "timestamp_epoch": "1533965784.461656000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "142.93.61.37,142.93.61.36,142.93.53.73,142.93.61.39,142.93.61.40", "dns.cname": "cdn-na.onthe.io", "dns.qry.name": "cdn.onthe.io", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 60530, "event_id": "evt-ddc0c72bc82319e8a41badc5", "src_port": 53, "tcp_stream": null, "udp_stream": 349, "frame_number": 44215, "timestamp_epoch": "1533965784.462482000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "syndication.twitter.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-bc9124f71790d523a17012a6", "src_port": 63411, "tcp_stream": null, "udp_stream": 352, "frame_number": 44228, "timestamp_epoch": "1533965784.469953000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "216.58.192.14,216.58.195.78,172.217.6.78,172.217.0.46,216.58.194.206,216.58.194.174", "dns.cname": "youtube-ui.l.google.com", "dns.qry.name": "www.youtube.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 56510, "event_id": "evt-78948c9efdd8805332ac491d", "src_port": 53, "tcp_stream": null, "udp_stream": 350, "frame_number": 44229, "timestamp_epoch": "1533965784.476926000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "216.58.192.14", "dns.cname": "www-google-analytics.l.google.com", "dns.qry.name": "www.google-analytics.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 55436, "event_id": "evt-a2fc0d8a9fe385ddab7d7052", "src_port": 53, "tcp_stream": null, "udp_stream": 351, "frame_number": 44230, "timestamp_epoch": "1533965784.477104000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "199.59.149.201,199.59.149.233", "dns.qry.name": "syndication.twitter.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 63411, "event_id": "evt-b921a19e0de164200bf51a09", "src_port": 53, "tcp_stream": null, "udp_stream": 352, "frame_number": 44343, "timestamp_epoch": "1533965785.001653000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "pagead2.googlesyndication.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-2422bca305dc27a1b30918e9", "src_port": 55051, "tcp_stream": null, "udp_stream": 353, "frame_number": 44401, "timestamp_epoch": "1533965785.103477000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "comet.tass.ru", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-14680d94f5d6bc1d62db77a5", "src_port": 60504, "tcp_stream": null, "udp_stream": 193, "frame_number": 44492, "timestamp_epoch": "1533965785.481508000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "fonts.googleapis.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-36db71941c373f06b0d8e311", "src_port": 52612, "tcp_stream": null, "udp_stream": 354, "frame_number": 44597, "timestamp_epoch": "1533965785.837646000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "103.5.149.77", "dns.qry.name": "comet.tass.ru", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 60504, "event_id": "evt-df9368beda05f059785bb035", "src_port": 53, "tcp_stream": null, "udp_stream": 193, "frame_number": 44698, "timestamp_epoch": "1533965786.043507000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "216.58.194.162", "dns.cname": "pagead46.l.doubleclick.net", "dns.qry.name": "pagead2.googlesyndication.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 55051, "event_id": "evt-9150fb8cf9bad3075144ea1e", "src_port": 53, "tcp_stream": null, "udp_stream": 353, "frame_number": 44701, "timestamp_epoch": "1533965786.043701000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "216.58.192.10", "dns.cname": "googleadapis.l.google.com", "dns.qry.name": "fonts.googleapis.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 52612, "event_id": "evt-64dbf92ea4e9a120d3b70bce", "src_port": 53, "tcp_stream": null, "udp_stream": 354, "frame_number": 44732, "timestamp_epoch": "1533965786.093172000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "stats.g.doubleclick.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-22565aa486e14f284847541a", "src_port": 50052, "tcp_stream": null, "udp_stream": 355, "frame_number": 44973, "timestamp_epoch": "1533965786.582537000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "s.ytimg.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-da20b00949e0ba1501999c44", "src_port": 62437, "tcp_stream": null, "udp_stream": 356, "frame_number": 44989, "timestamp_epoch": "1533965786.599954000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "fonts.gstatic.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-86e1416dd91a934e474ef5c2", "src_port": 61202, "tcp_stream": null, "udp_stream": 357, "frame_number": 45000, "timestamp_epoch": "1533965786.627493000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "74.125.195.155,74.125.195.156,74.125.195.154,74.125.195.157", "dns.cname": "stats.l.doubleclick.net", "dns.qry.name": "stats.g.doubleclick.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 50052, "event_id": "evt-fae726c6e17f70fec04a3b9a", "src_port": 53, "tcp_stream": null, "udp_stream": 355, "frame_number": 45074, "timestamp_epoch": "1533965786.808030000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "216.58.192.14", "dns.cname": "ytstatic.l.google.com", "dns.qry.name": "s.ytimg.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 62437, "event_id": "evt-c3b3f76e944c8add18557adf", "src_port": 53, "tcp_stream": null, "udp_stream": 356, "frame_number": 45110, "timestamp_epoch": "1533965786.890742000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "tt.onthe.io", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-061797aafde2d97e41837700", "src_port": 54643, "tcp_stream": null, "udp_stream": 358, "frame_number": 45115, "timestamp_epoch": "1533965786.906355000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "216.58.192.3", "dns.cname": "gstaticadssl.l.google.com", "dns.qry.name": "fonts.gstatic.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 61202, "event_id": "evt-ef6289f05a5e8a0866a08088", "src_port": 53, "tcp_stream": null, "udp_stream": 357, "frame_number": 45116, "timestamp_epoch": "1533965786.910754000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "136.243.151.13,188.40.115.112,88.99.5.37,188.40.115.111,95.216.24.150,188.40.114.52,188.40.118.169,95.216.24.148,95.216.24.149,188.40.114.5", "dns.qry.name": "tt.onthe.io", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 54643, "event_id": "evt-68d4bdc6a11c7b2805f2c037", "src_port": 53, "tcp_stream": null, "udp_stream": 358, "frame_number": 45340, "timestamp_epoch": "1533965787.454378000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "googleads.g.doubleclick.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-3d8c04858019b01bd2d7b4e2", "src_port": 55542, "tcp_stream": null, "udp_stream": 359, "frame_number": 45612, "timestamp_epoch": "1533965788.303184000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "www.google.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-7263d6281e0ccff4c3a01a91", "src_port": 53554, "tcp_stream": null, "udp_stream": 360, "frame_number": 45622, "timestamp_epoch": "1533965788.343931000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "216.58.194.162", "dns.cname": "pagead46.l.doubleclick.net", "dns.qry.name": "googleads.g.doubleclick.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 55542, "event_id": "evt-c899fffff01e63fd5792a17d", "src_port": 53, "tcp_stream": null, "udp_stream": 359, "frame_number": 45830, "timestamp_epoch": "1533965789.081206000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "216.58.192.4", "dns.qry.name": "www.google.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 53554, "event_id": "evt-0626241a60e78aa8e1f466e0", "src_port": 53, "tcp_stream": null, "udp_stream": 360, "frame_number": 45837, "timestamp_epoch": "1533965789.095261000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "px.adhigh.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-ac66804830cd5e12c650a0cc", "src_port": 60922, "tcp_stream": null, "udp_stream": 361, "frame_number": 45975, "timestamp_epoch": "1533965789.421325000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "cm.g.doubleclick.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-040b6858156d75b085ffe56d", "src_port": 64141, "tcp_stream": null, "udp_stream": 362, "frame_number": 45976, "timestamp_epoch": "1533965789.422175000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "pr-bh.ybp.yahoo.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-bf94765c3e4a730887b4a3da", "src_port": 64494, "tcp_stream": null, "udp_stream": 363, "frame_number": 45993, "timestamp_epoch": "1533965789.443122000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "magnetic.t.domdex.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-351a15f953ef591090d35286", "src_port": 49826, "tcp_stream": null, "udp_stream": 364, "frame_number": 46027, "timestamp_epoch": "1533965789.539672000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "172.217.6.66", "dns.cname": "pagead.l.doubleclick.net", "dns.qry.name": "cm.g.doubleclick.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 64141, "event_id": "evt-dff7a1cf75dae2f896a3bd66", "src_port": 53, "tcp_stream": null, "udp_stream": 362, "frame_number": 46032, "timestamp_epoch": "1533965789.555893000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "74.6.34.27", "dns.cname": "pr-bh.ybp.gysm.yahoodns.net", "dns.qry.name": "pr-bh.ybp.yahoo.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 64494, "event_id": "evt-f16c5ce4d8d0f6f766e92db8", "src_port": 53, "tcp_stream": null, "udp_stream": 363, "frame_number": 46038, "timestamp_epoch": "1533965789.567878000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "23.108.108.218,209.58.136.30,209.58.136.29,209.58.139.154,209.58.136.32,23.108.190.222,23.108.190.223", "dns.cname": "px-us-ca.adhigh.net", "dns.qry.name": "px.adhigh.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 60922, "event_id": "evt-03b876a30c61cacb10fcc0d4", "src_port": 53, "tcp_stream": null, "udp_stream": 361, "frame_number": 46077, "timestamp_epoch": "1533965789.700898000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "52.9.78.114,52.52.14.142,52.8.138.67,50.18.110.80,52.9.113.206,52.9.96.194", "dns.cname": "tracking-prod-public-741746200.us-west-1.elb.amazonaws.com", "dns.qry.name": "magnetic.t.domdex.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 49826, "event_id": "evt-2d2093541e88d48a8c04d5fd", "src_port": 53, "tcp_stream": null, "udp_stream": 364, "frame_number": 46080, "timestamp_epoch": "1533965789.714227000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "relap.io", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-28a2a3487929725ffcd7093c", "src_port": 51980, "tcp_stream": null, "udp_stream": 365, "frame_number": 46366, "timestamp_epoch": "1533965791.000009000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "185.99.9.117,185.99.9.124,185.99.9.123,185.99.9.116", "dns.qry.name": "relap.io", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 51980, "event_id": "evt-c900735b273e5251af8088c1", "src_port": 53, "tcp_stream": null, "udp_stream": 365, "frame_number": 46422, "timestamp_epoch": "1533965791.276701000" }, { "kind": "dns", "dst_ip": "192.168.1.6", "fields": { "dns.qry.name": "iecvlist.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": 53, "event_id": "evt-15951e99890b56f439ac0032", "src_port": 52101, "tcp_stream": null, "udp_stream": 366, "frame_number": 46918, "timestamp_epoch": "1533965798.576687000" }, { "kind": "dns", "dst_ip": "192.168.1.95", "fields": { "dns.a": "72.21.81.200", "dns.cname": "ie9comview.vo.msecnd.net,cs9.wpc.v0cdn.net", "dns.qry.name": "iecvlist.microsoft.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "192.168.1.6", "dst_port": 52101, "event_id": "evt-675f48700a0a389288826712", "src_port": 53, "tcp_stream": null, "udp_stream": 366, "frame_number": 46919, "timestamp_epoch": "1533965798.750795000" } ], "dhcp": [ { "kind": "dhcp", "dst_ip": "255.255.255.255", "fields": { "eth.src": "f4:b5:20:68:b1:93", "dhcp.ip.your": "0.0.0.0", "dhcp.hw.mac_addr": "f4:b5:20:68:b1:93,f4:b5:20:68:b1:93", "dhcp.option.dhcp": "3", "dhcp.option.hostname": "Petrov2018-PC", "dhcp.option.requested_ip_address": "192.168.1.95" }, "src_ip": "0.0.0.0", "dst_port": null, "event_id": "evt-1db762ca40abae8eeb9a1fa9", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 1, "timestamp_epoch": "1533964508.767375000" }, { "kind": "dhcp", "dst_ip": "192.168.1.95", "fields": { "eth.src": "20:e5:2a:b6:93:f1", "dhcp.ip.your": "192.168.1.95", "dhcp.hw.mac_addr": "f4:b5:20:68:b1:93", "dhcp.option.dhcp": "5" }, "src_ip": "192.168.1.254", "dst_port": null, "event_id": "evt-35b65d5e943674b9c3fd8022", "src_port": null, "tcp_stream": null, "udp_stream": 1, "frame_number": 2, "timestamp_epoch": "1533964508.776328000" }, { "kind": "dhcp", "dst_ip": "255.255.255.255", "fields": { "eth.src": "f4:b5:20:68:b1:93", "dhcp.ip.your": "0.0.0.0", "dhcp.hw.mac_addr": "f4:b5:20:68:b1:93,f4:b5:20:68:b1:93", "dhcp.option.dhcp": "8", "dhcp.option.hostname": "Petrov2018-PC" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-c01f20f175e0becaab4c7e90", "src_port": null, "tcp_stream": null, "udp_stream": 16, "frame_number": 288, "timestamp_epoch": "1533964512.090074000" }, { "kind": "dhcp", "dst_ip": "192.168.1.95", "fields": { "eth.src": "20:e5:2a:b6:93:f1", "dhcp.ip.your": "0.0.0.0", "dhcp.hw.mac_addr": "f4:b5:20:68:b1:93", "dhcp.option.dhcp": "5" }, "src_ip": "192.168.1.254", "dst_port": null, "event_id": "evt-0f3879426f524a30608d834b", "src_port": null, "tcp_stream": null, "udp_stream": 1, "frame_number": 289, "timestamp_epoch": "1533964512.090294000" }, { "kind": "dhcp", "dst_ip": "255.255.255.255", "fields": { "eth.src": "f4:b5:20:68:b1:93", "dhcp.ip.your": "0.0.0.0", "dhcp.hw.mac_addr": "f4:b5:20:68:b1:93,f4:b5:20:68:b1:93", "dhcp.option.dhcp": "8", "dhcp.option.hostname": "Petrov2018-PC" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-fd87bbb2a50d975a0243a9a6", "src_port": null, "tcp_stream": null, "udp_stream": 16, "frame_number": 6562, "timestamp_epoch": "1533964576.241584000" }, { "kind": "dhcp", "dst_ip": "192.168.1.95", "fields": { "eth.src": "20:e5:2a:b6:93:f1", "dhcp.ip.your": "0.0.0.0", "dhcp.hw.mac_addr": "f4:b5:20:68:b1:93", "dhcp.option.dhcp": "5" }, "src_ip": "192.168.1.254", "dst_port": null, "event_id": "evt-3c9e5e3978c9221ff080d30a", "src_port": null, "tcp_stream": null, "udp_stream": 1, "frame_number": 6563, "timestamp_epoch": "1533964576.241701000" }, { "kind": "dhcp", "dst_ip": "255.255.255.255", "fields": { "eth.src": "f4:b5:20:68:b1:93", "dhcp.ip.your": "0.0.0.0", "dhcp.hw.mac_addr": "f4:b5:20:68:b1:93,f4:b5:20:68:b1:93", "dhcp.option.dhcp": "8", "dhcp.option.hostname": "Petrov2018-PC" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-fbf5a00c9b2a2f18abcb6b77", "src_port": null, "tcp_stream": null, "udp_stream": 16, "frame_number": 7257, "timestamp_epoch": "1533964849.660910000" }, { "kind": "dhcp", "dst_ip": "192.168.1.95", "fields": { "eth.src": "20:e5:2a:b6:93:f1", "dhcp.ip.your": "0.0.0.0", "dhcp.hw.mac_addr": "f4:b5:20:68:b1:93", "dhcp.option.dhcp": "5" }, "src_ip": "192.168.1.254", "dst_port": null, "event_id": "evt-6bc9422febc4aeb193823bda", "src_port": null, "tcp_stream": null, "udp_stream": 1, "frame_number": 7258, "timestamp_epoch": "1533964849.661304000" }, { "kind": "dhcp", "dst_ip": "192.168.1.254", "fields": { "eth.src": "f4:b5:20:68:b1:93", "dhcp.ip.your": "0.0.0.0", "dhcp.hw.mac_addr": "f4:b5:20:68:b1:93,f4:b5:20:68:b1:93", "dhcp.option.dhcp": "3", "dhcp.option.hostname": "Petrov2018-PC" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-10b30addb804c6c6fd52c348", "src_port": null, "tcp_stream": null, "udp_stream": 1, "frame_number": 39646, "timestamp_epoch": "1533965410.161108000" }, { "kind": "dhcp", "dst_ip": "192.168.1.95", "fields": { "eth.src": "20:e5:2a:b6:93:f1", "dhcp.ip.your": "192.168.1.95", "dhcp.hw.mac_addr": "f4:b5:20:68:b1:93", "dhcp.option.dhcp": "5" }, "src_ip": "192.168.1.254", "dst_port": null, "event_id": "evt-712ffc63b41dfa7d42c223ee", "src_port": null, "tcp_stream": null, "udp_stream": 1, "frame_number": 39647, "timestamp_epoch": "1533965410.170285000" }, { "kind": "dhcp", "dst_ip": "255.255.255.255", "fields": { "eth.src": "f4:b5:20:68:b1:93", "dhcp.ip.your": "0.0.0.0", "dhcp.hw.mac_addr": "f4:b5:20:68:b1:93,f4:b5:20:68:b1:93", "dhcp.option.dhcp": "8", "dhcp.option.hostname": "Petrov2018-PC" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-ca1591826b1657d9c6875263", "src_port": null, "tcp_stream": null, "udp_stream": 16, "frame_number": 40091, "timestamp_epoch": "1533965768.477452000" }, { "kind": "dhcp", "dst_ip": "192.168.1.95", "fields": { "eth.src": "20:e5:2a:b6:93:f1", "dhcp.ip.your": "0.0.0.0", "dhcp.hw.mac_addr": "f4:b5:20:68:b1:93", "dhcp.option.dhcp": "5" }, "src_ip": "192.168.1.254", "dst_port": null, "event_id": "evt-79962088053371b20de06f74", "src_port": null, "tcp_stream": null, "udp_stream": 1, "frame_number": 40092, "timestamp_epoch": "1533965768.477603000" } ], "smtp": [], "identity": [ { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "f4:b5:20:68:b1:93", "dns.qry.name": "Petrov2018-PC" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-12b67c5494b09b3de1cd2cf9", "src_port": null, "tcp_stream": null, "udp_stream": 2, "frame_number": 5, "timestamp_epoch": "1533964508.786149000" }, { "kind": "identity", "dst_ip": "192.168.1.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "PETROV2018-PC<00>,PETROV2018-PC<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-bb58f7b9296a97edc5ff95f5", "src_port": null, "tcp_stream": null, "udp_stream": 4, "frame_number": 8, "timestamp_epoch": "1533964508.857262000" }, { "kind": "identity", "dst_ip": "192.168.1.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "SPUTNIKHOUSE<00>,SPUTNIKHOUSE<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-2ccafbfec84bc8e5cc14dca9", "src_port": null, "tcp_stream": null, "udp_stream": 4, "frame_number": 9, "timestamp_epoch": "1533964508.857599000" }, { "kind": "identity", "dst_ip": "192.168.1.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "PETROV2018-PC<20>,PETROV2018-PC<20> (Server service)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-dff31b4b9169dfe712625085", "src_port": null, "tcp_stream": null, "udp_stream": 4, "frame_number": 10, "timestamp_epoch": "1533964508.857840000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "f4:b5:20:68:b1:93", "dns.qry.name": "Petrov2018-PC" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-4537041bdfac08b9a53afd5c", "src_port": null, "tcp_stream": null, "udp_stream": 2, "frame_number": 11, "timestamp_epoch": "1533964508.886553000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "f4:b5:20:68:b1:93", "dns.qry.name": "Petrov2018-PC" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-eddfc5e8584f37aef68240c6", "src_port": null, "tcp_stream": null, "udp_stream": 7, "frame_number": 17, "timestamp_epoch": "1533964509.086998000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "f4:b5:20:68:b1:93", "dns.qry.name": "Petrov2018-PC" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-d833c586d607c92bf8d76111", "src_port": null, "tcp_stream": null, "udp_stream": 7, "frame_number": 23, "timestamp_epoch": "1533964509.187156000" }, { "kind": "identity", "dst_ip": "192.168.1.95", "fields": { "eth.dst": "f4:b5:20:68:b1:93", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-ac9dd98675d2e4876b86674b", "src_port": null, "tcp_stream": 0, "udp_stream": null, "frame_number": 32, "timestamp_epoch": "1533964509.197220000" }, { "kind": "identity", "dst_ip": "192.168.1.6", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "f4:b5:20:68:b1:93" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-8689b5bbe691f242e966d7ac", "src_port": null, "tcp_stream": 0, "udp_stream": null, "frame_number": 33, "timestamp_epoch": "1533964509.197527000" }, { "kind": "identity", "dst_ip": "192.168.1.95", "fields": { "eth.dst": "f4:b5:20:68:b1:93", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-df9b6d19d83f719cd37d7fea", "src_port": null, "tcp_stream": 0, "udp_stream": null, "frame_number": 34, "timestamp_epoch": "1533964509.197728000" }, { "kind": "identity", "dst_ip": "192.168.1.6", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "f4:b5:20:68:b1:93", "kerberos.msg_type": "10", "kerberos.CNameString": "petrov2018-pc$" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-e89d98f3521a06099edbf60e", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 38, "timestamp_epoch": "1533964509.200672000" }, { "kind": "identity", "dst_ip": "192.168.1.95", "fields": { "eth.dst": "f4:b5:20:68:b1:93", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "30" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-b5deb8f8efb017c4f08e5776", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 39, "timestamp_epoch": "1533964509.201480000" }, { "kind": "identity", "dst_ip": "192.168.1.6", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "f4:b5:20:68:b1:93", "kerberos.msg_type": "10", "kerberos.CNameString": "petrov2018-pc$" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-56d8165d9f7dbb8788d04eb6", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 46, "timestamp_epoch": "1533964509.218414000" }, { "kind": "identity", "dst_ip": "192.168.1.95", "fields": { "eth.dst": "f4:b5:20:68:b1:93", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "11", "kerberos.CNameString": "PETROV2018-PC$" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-039ebeba809cfe4d208a4306", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 47, "timestamp_epoch": "1533964509.219117000" }, { "kind": "identity", "dst_ip": "192.168.1.6", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "f4:b5:20:68:b1:93", "kerberos.msg_type": "12,14" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-36bddb52c2672d5205048c9f", "src_port": null, "tcp_stream": 3, "udp_stream": null, "frame_number": 55, "timestamp_epoch": "1533964509.221252000" }, { "kind": "identity", "dst_ip": "192.168.1.95", "fields": { "eth.dst": "f4:b5:20:68:b1:93", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "PETROV2018-PC$" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-1d2bc17d32af7739532d81bb", "src_port": null, "tcp_stream": 3, "udp_stream": null, "frame_number": 57, "timestamp_epoch": "1533964509.222037000" }, { "kind": "identity", "dst_ip": "192.168.1.6", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "f4:b5:20:68:b1:93", "kerberos.msg_type": "12,14" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-cce7edc56736f9ede9aaa1c5", "src_port": null, "tcp_stream": 4, "udp_stream": null, "frame_number": 65, "timestamp_epoch": "1533964509.222961000" }, { "kind": "identity", "dst_ip": "192.168.1.95", "fields": { "eth.dst": "f4:b5:20:68:b1:93", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "PETROV2018-PC$" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-766ba3ac65f0fe31291e1600", "src_port": null, "tcp_stream": 4, "udp_stream": null, "frame_number": 67, "timestamp_epoch": "1533964509.223327000" }, { "kind": "identity", "dst_ip": "192.168.1.6", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "f4:b5:20:68:b1:93", "kerberos.msg_type": "14" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-b601670c4c03dd13dedbfca8", "src_port": null, "tcp_stream": 0, "udp_stream": null, "frame_number": 74, "timestamp_epoch": "1533964509.224281000" }, { "kind": "identity", "dst_ip": "192.168.1.95", "fields": { "eth.dst": "f4:b5:20:68:b1:93", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-50aed6ec3e9d9661007fe6d6", "src_port": null, "tcp_stream": 0, "udp_stream": null, "frame_number": 75, "timestamp_epoch": "1533964509.225043000" }, { "kind": "identity", "dst_ip": "192.168.1.6", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "f4:b5:20:68:b1:93" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-f4cf938f482b96178d2b5e6b", "src_port": null, "tcp_stream": 0, "udp_stream": null, "frame_number": 76, "timestamp_epoch": "1533964509.225525000" }, { "kind": "identity", "dst_ip": "192.168.1.95", "fields": { "eth.dst": "f4:b5:20:68:b1:93", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-669ac184b51f1b97a5954b99", "src_port": null, "tcp_stream": 0, "udp_stream": null, "frame_number": 77, "timestamp_epoch": "1533964509.225644000" }, { "kind": "identity", "dst_ip": "192.168.1.6", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "f4:b5:20:68:b1:93" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-de3183868256eef7ac949d9a", "src_port": null, "tcp_stream": 0, "udp_stream": null, "frame_number": 78, "timestamp_epoch": "1533964509.226004000" }, { "kind": "identity", "dst_ip": "192.168.1.95", "fields": { "eth.dst": "f4:b5:20:68:b1:93", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-33ec157f008961371e389bd1", "src_port": null, "tcp_stream": 0, "udp_stream": null, "frame_number": 79, "timestamp_epoch": "1533964509.226231000" }, { "kind": "identity", "dst_ip": "192.168.1.6", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "f4:b5:20:68:b1:93", "kerberos.msg_type": "12,14" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-f042b2fc296e8c8bdf9fa2e9", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 89, "timestamp_epoch": "1533964509.290961000" }, { "kind": "identity", "dst_ip": "192.168.1.95", "fields": { "eth.dst": "f4:b5:20:68:b1:93", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "PETROV2018-PC$" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-b765b33c9621fa33d06d2fa9", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 91, "timestamp_epoch": "1533964509.291837000" }, { "kind": "identity", "dst_ip": "192.168.1.6", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "f4:b5:20:68:b1:93", "kerberos.msg_type": "14" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-1cf13b0e86888f563ed3234a", "src_port": null, "tcp_stream": 5, "udp_stream": null, "frame_number": 96, "timestamp_epoch": "1533964509.292603000" }, { "kind": "identity", "dst_ip": "192.168.1.95", "fields": { "eth.dst": "f4:b5:20:68:b1:93", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-964d302e338e25c0a0b8dd13", "src_port": null, "tcp_stream": 5, "udp_stream": null, "frame_number": 98, "timestamp_epoch": "1533964509.293214000" }, { "kind": "identity", "dst_ip": "192.168.1.6", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "f4:b5:20:68:b1:93", "kerberos.msg_type": "10", "kerberos.CNameString": "petrov2018-pc$" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-44a2a6b7b64755917cb4d06f", "src_port": null, "tcp_stream": 10, "udp_stream": null, "frame_number": 135, "timestamp_epoch": "1533964509.597072000" }, { "kind": "identity", "dst_ip": "192.168.1.95", "fields": { "eth.dst": "f4:b5:20:68:b1:93", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "30" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-c05beabc7c0902a2c39e22ab", "src_port": null, "tcp_stream": 10, "udp_stream": null, "frame_number": 136, "timestamp_epoch": "1533964509.597496000" }, { "kind": "identity", "dst_ip": "192.168.1.6", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "f4:b5:20:68:b1:93", "kerberos.msg_type": "10", "kerberos.CNameString": "petrov2018-pc$" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-2feb83eeb642b4d26af4aa53", "src_port": null, "tcp_stream": 11, "udp_stream": null, "frame_number": 143, "timestamp_epoch": "1533964509.615867000" }, { "kind": "identity", "dst_ip": "192.168.1.95", "fields": { "eth.dst": "f4:b5:20:68:b1:93", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "11", "kerberos.CNameString": "PETROV2018-PC$" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-6512d47bfa5dfcab24a4e641", "src_port": null, "tcp_stream": 11, "udp_stream": null, "frame_number": 144, "timestamp_epoch": "1533964509.616682000" }, { "kind": "identity", "dst_ip": "192.168.1.6", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "f4:b5:20:68:b1:93", "kerberos.msg_type": "12,14" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-baa36fc2aa8396110bd246ae", "src_port": null, "tcp_stream": 12, "udp_stream": null, "frame_number": 153, "timestamp_epoch": "1533964509.617935000" }, { "kind": "identity", "dst_ip": "192.168.1.95", "fields": { "eth.dst": "f4:b5:20:68:b1:93", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "PETROV2018-PC$" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-714dce4bdc6dc237a6f0ac1e", "src_port": null, "tcp_stream": 12, "udp_stream": null, "frame_number": 155, "timestamp_epoch": "1533964509.618759000" }, { "kind": "identity", "dst_ip": "192.168.1.6", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "f4:b5:20:68:b1:93", "kerberos.msg_type": "14" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-f8dbbec2c64f8a948ec11760", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 160, "timestamp_epoch": "1533964509.619285000" }, { "kind": "identity", "dst_ip": "192.168.1.95", "fields": { "eth.dst": "f4:b5:20:68:b1:93", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-011bd3639f630fa9c5f6f336", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 162, "timestamp_epoch": "1533964509.619785000" }, { "kind": "identity", "dst_ip": "192.168.1.6", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "f4:b5:20:68:b1:93", "kerberos.msg_type": "15" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-e7be19a4e40370caf4dc2e85", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 163, "timestamp_epoch": "1533964509.620115000" }, { "kind": "identity", "dst_ip": "192.168.1.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "PETROV2018-PC<20>,PETROV2018-PC<20> (Server service)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-e0103192d0f15d7129d9127f", "src_port": null, "tcp_stream": null, "udp_stream": 4, "frame_number": 176, "timestamp_epoch": "1533964510.357620000" }, { "kind": "identity", "dst_ip": "192.168.1.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "SPUTNIKHOUSE<00>,SPUTNIKHOUSE<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-f385100dc4f13350219af531", "src_port": null, "tcp_stream": null, "udp_stream": 4, "frame_number": 177, "timestamp_epoch": "1533964510.357623000" }, { "kind": "identity", "dst_ip": "192.168.1.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "PETROV2018-PC<00>,PETROV2018-PC<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-cf7d569f413505927f747868", "src_port": null, "tcp_stream": null, "udp_stream": 4, "frame_number": 178, "timestamp_epoch": "1533964510.357785000" }, { "kind": "identity", "dst_ip": "192.168.1.6", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "f4:b5:20:68:b1:93", "kerberos.msg_type": "14" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-d0629cd3be831171aff0d75e", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 189, "timestamp_epoch": "1533964510.595028000" }, { "kind": "identity", "dst_ip": "192.168.1.95", "fields": { "eth.dst": "f4:b5:20:68:b1:93", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-523f66cd524cc01bedc8dd6e", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 191, "timestamp_epoch": "1533964510.595761000" }, { "kind": "identity", "dst_ip": "192.168.1.6", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "f4:b5:20:68:b1:93", "kerberos.msg_type": "12,14" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-751928b008dc3056bd15bed4", "src_port": null, "tcp_stream": 14, "udp_stream": null, "frame_number": 195, "timestamp_epoch": "1533964510.601495000" }, { "kind": "identity", "dst_ip": "192.168.1.95", "fields": { "eth.dst": "f4:b5:20:68:b1:93", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "PETROV2018-PC$" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-4c254f21c2f17354e1b229bf", "src_port": null, "tcp_stream": 14, "udp_stream": null, "frame_number": 197, "timestamp_epoch": "1533964510.602342000" }, { "kind": "identity", "dst_ip": "192.168.1.6", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "f4:b5:20:68:b1:93", "kerberos.msg_type": "12,14" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-d5d69e7475cfe3b2ef3c9a59", "src_port": null, "tcp_stream": 15, "udp_stream": null, "frame_number": 207, "timestamp_epoch": "1533964510.606464000" }, { "kind": "identity", "dst_ip": "192.168.1.95", "fields": { "eth.dst": "f4:b5:20:68:b1:93", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "PETROV2018-PC$" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-c9daff4888c1063051f319ac", "src_port": null, "tcp_stream": 15, "udp_stream": null, "frame_number": 210, "timestamp_epoch": "1533964510.607697000" }, { "kind": "identity", "dst_ip": "192.168.1.6", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "f4:b5:20:68:b1:93", "kerberos.msg_type": "12,14" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-ad78d011227d8926ed5b68f5", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 220, "timestamp_epoch": "1533964510.608556000" }, { "kind": "identity", "dst_ip": "192.168.1.95", "fields": { "eth.dst": "f4:b5:20:68:b1:93", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "30" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-71bf7012cdd53548d3794be8", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 222, "timestamp_epoch": "1533964510.609214000" }, { "kind": "identity", "dst_ip": "192.168.1.6", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "f4:b5:20:68:b1:93", "kerberos.msg_type": "14" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-a2678c2d95857be8e9c1b085", "src_port": null, "tcp_stream": 16, "udp_stream": null, "frame_number": 223, "timestamp_epoch": "1533964510.609304000" }, { "kind": "identity", "dst_ip": "192.168.1.95", "fields": { "eth.dst": "f4:b5:20:68:b1:93", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-1a9cbff63ec5bc6417e9d466", "src_port": null, "tcp_stream": 16, "udp_stream": null, "frame_number": 228, "timestamp_epoch": "1533964510.610220000" }, { "kind": "identity", "dst_ip": "192.168.1.6", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "f4:b5:20:68:b1:93" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-a82c0c9f91eed129f7a01b61", "src_port": null, "tcp_stream": 18, "udp_stream": null, "frame_number": 238, "timestamp_epoch": "1533964510.614956000" }, { "kind": "identity", "dst_ip": "192.168.1.95", "fields": { "eth.dst": "f4:b5:20:68:b1:93", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-1b07fbeba14c16ff2532ecc1", "src_port": null, "tcp_stream": 18, "udp_stream": null, "frame_number": 239, "timestamp_epoch": "1533964510.615192000" }, { "kind": "identity", "dst_ip": "192.168.1.6", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "f4:b5:20:68:b1:93", "kerberos.msg_type": "12,14" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-3ac58b8d8534ef22864c16db", "src_port": null, "tcp_stream": 19, "udp_stream": null, "frame_number": 243, "timestamp_epoch": "1533964510.616009000" }, { "kind": "identity", "dst_ip": "192.168.1.95", "fields": { "eth.dst": "f4:b5:20:68:b1:93", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "PETROV2018-PC$" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-a0156759c252d808640b1e37", "src_port": null, "tcp_stream": 19, "udp_stream": null, "frame_number": 245, "timestamp_epoch": "1533964510.616786000" }, { "kind": "identity", "dst_ip": "192.168.1.6", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "f4:b5:20:68:b1:93", "kerberos.msg_type": "12,14" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-67690ff8846fa00ea0d5b7f3", "src_port": null, "tcp_stream": 20, "udp_stream": null, "frame_number": 253, "timestamp_epoch": "1533964510.617588000" }, { "kind": "identity", "dst_ip": "192.168.1.95", "fields": { "eth.dst": "f4:b5:20:68:b1:93", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "PETROV2018-PC$" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-710ee8fb266d3e7142bd8908", "src_port": null, "tcp_stream": 20, "udp_stream": null, "frame_number": 255, "timestamp_epoch": "1533964510.617934000" }, { "kind": "identity", "dst_ip": "192.168.1.6", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "f4:b5:20:68:b1:93", "kerberos.msg_type": "14" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-ad083cc573455340494fc58c", "src_port": null, "tcp_stream": 18, "udp_stream": null, "frame_number": 262, "timestamp_epoch": "1533964510.618583000" }, { "kind": "identity", "dst_ip": "192.168.1.95", "fields": { "eth.dst": "f4:b5:20:68:b1:93", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-d581691f8fe4c92d42b9fc56", "src_port": null, "tcp_stream": 18, "udp_stream": null, "frame_number": 263, "timestamp_epoch": "1533964510.619087000" }, { "kind": "identity", "dst_ip": "192.168.1.6", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "f4:b5:20:68:b1:93" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-1697d5c2a21bc3b20305437c", "src_port": null, "tcp_stream": 18, "udp_stream": null, "frame_number": 264, "timestamp_epoch": "1533964510.619476000" }, { "kind": "identity", "dst_ip": "192.168.1.95", "fields": { "eth.dst": "f4:b5:20:68:b1:93", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-a35b086a483d3b81613ba968", "src_port": null, "tcp_stream": 18, "udp_stream": null, "frame_number": 265, "timestamp_epoch": "1533964510.619599000" }, { "kind": "identity", "dst_ip": "192.168.1.6", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "f4:b5:20:68:b1:93" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-bdeabf97480d43d52a84c9cb", "src_port": null, "tcp_stream": 18, "udp_stream": null, "frame_number": 266, "timestamp_epoch": "1533964510.619750000" }, { "kind": "identity", "dst_ip": "192.168.1.95", "fields": { "eth.dst": "f4:b5:20:68:b1:93", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-150fb54775ce6d0117deee48", "src_port": null, "tcp_stream": 18, "udp_stream": null, "frame_number": 267, "timestamp_epoch": "1533964510.619979000" }, { "kind": "identity", "dst_ip": "192.168.1.6", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "f4:b5:20:68:b1:93" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-f8192a988830f69479abe99e", "src_port": null, "tcp_stream": 18, "udp_stream": null, "frame_number": 268, "timestamp_epoch": "1533964510.620279000" }, { "kind": "identity", "dst_ip": "192.168.1.95", "fields": { "eth.dst": "f4:b5:20:68:b1:93", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-786f29b62ec0e63739a26d03", "src_port": null, "tcp_stream": 18, "udp_stream": null, "frame_number": 269, "timestamp_epoch": "1533964510.620479000" }, { "kind": "identity", "dst_ip": "192.168.1.6", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "f4:b5:20:68:b1:93" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-93c9d863b2fe114caf4bbd2c", "src_port": null, "tcp_stream": 18, "udp_stream": null, "frame_number": 270, "timestamp_epoch": "1533964510.620774000" }, { "kind": "identity", "dst_ip": "192.168.1.95", "fields": { "eth.dst": "f4:b5:20:68:b1:93", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-09247c0e26867da6d1b9d9f0", "src_port": null, "tcp_stream": 18, "udp_stream": null, "frame_number": 271, "timestamp_epoch": "1533964510.620891000" }, { "kind": "identity", "dst_ip": "192.168.1.6", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "f4:b5:20:68:b1:93" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-84559e5b19399eca37f5edf4", "src_port": null, "tcp_stream": 18, "udp_stream": null, "frame_number": 272, "timestamp_epoch": "1533964510.621276000" }, { "kind": "identity", "dst_ip": "192.168.1.95", "fields": { "eth.dst": "f4:b5:20:68:b1:93", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-445b14a66b05412eb37e8c93", "src_port": null, "tcp_stream": 18, "udp_stream": null, "frame_number": 273, "timestamp_epoch": "1533964510.621539000" }, { "kind": "identity", "dst_ip": "192.168.1.6", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "f4:b5:20:68:b1:93" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-10c93a0fb2c5ed47db60dd7b", "src_port": null, "tcp_stream": 18, "udp_stream": null, "frame_number": 274, "timestamp_epoch": "1533964510.621820000" }, { "kind": "identity", "dst_ip": "192.168.1.95", "fields": { "eth.dst": "f4:b5:20:68:b1:93", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-a9e230276138a13751cbc698", "src_port": null, "tcp_stream": 18, "udp_stream": null, "frame_number": 275, "timestamp_epoch": "1533964510.621964000" }, { "kind": "identity", "dst_ip": "192.168.1.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "PETROV2018-PC<00>,PETROV2018-PC<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-c8a4e0bb0660d2d890823cd8", "src_port": null, "tcp_stream": null, "udp_stream": 4, "frame_number": 282, "timestamp_epoch": "1533964511.878807000" }, { "kind": "identity", "dst_ip": "192.168.1.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "SPUTNIKHOUSE<00>,SPUTNIKHOUSE<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-c8736ed0b3ca396749cfd2a8", "src_port": null, "tcp_stream": null, "udp_stream": 4, "frame_number": 283, "timestamp_epoch": "1533964511.878872000" }, { "kind": "identity", "dst_ip": "192.168.1.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "PETROV2018-PC<20>,PETROV2018-PC<20> (Server service)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-f50a7f8780203573dbb57284", "src_port": null, "tcp_stream": null, "udp_stream": 4, "frame_number": 284, "timestamp_epoch": "1533964511.879054000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "f4:b5:20:68:b1:93", "dns.qry.name": "Petrov2018-PC" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-d9dfb8088707fb2eec89718c", "src_port": null, "tcp_stream": null, "udp_stream": 15, "frame_number": 287, "timestamp_epoch": "1533964512.086604000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "f4:b5:20:68:b1:93", "dns.qry.name": "wpad" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-80fa309abd532abee1d7f667", "src_port": null, "tcp_stream": null, "udp_stream": 19, "frame_number": 294, "timestamp_epoch": "1533964512.094564000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "f4:b5:20:68:b1:93", "dns.qry.name": "wpad" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-9d980bc3894f827275f9fac0", "src_port": null, "tcp_stream": null, "udp_stream": 19, "frame_number": 295, "timestamp_epoch": "1533964512.189494000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "f4:b5:20:68:b1:93", "dns.qry.name": "Petrov2018-PC" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-830f698e4908c401f7abcb4c", "src_port": null, "tcp_stream": null, "udp_stream": 15, "frame_number": 296, "timestamp_epoch": "1533964512.189501000" }, { "kind": "identity", "dst_ip": "192.168.1.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-46bfe3961e4d116ceabb3bef", "src_port": null, "tcp_stream": null, "udp_stream": 4, "frame_number": 297, "timestamp_epoch": "1533964512.392014000" }, { "kind": "identity", "dst_ip": "192.168.1.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "PETROV2018-PC<00>,PETROV2018-PC<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-f07da37178138eaaed2529af", "src_port": null, "tcp_stream": null, "udp_stream": 20, "frame_number": 299, "timestamp_epoch": "1533964513.421398000" }, { "kind": "identity", "dst_ip": "192.168.1.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "SPUTNIKHOUSE<00>,SPUTNIKHOUSE<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-90efc58cb89e6d3825f57718", "src_port": null, "tcp_stream": null, "udp_stream": 20, "frame_number": 300, "timestamp_epoch": "1533964513.421410000" }, { "kind": "identity", "dst_ip": "192.168.1.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "PETROV2018-PC<20>,PETROV2018-PC<20> (Server service)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-e50feab186374cc1df85e9b8", "src_port": null, "tcp_stream": null, "udp_stream": 20, "frame_number": 301, "timestamp_epoch": "1533964513.421498000" }, { "kind": "identity", "dst_ip": "192.168.1.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-35f52a90336240a994e31726", "src_port": null, "tcp_stream": null, "udp_stream": 4, "frame_number": 302, "timestamp_epoch": "1533964513.906714000" }, { "kind": "identity", "dst_ip": "192.168.1.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "PETROV2018-PC<20>,PETROV2018-PC<20> (Server service)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-69c36c3c4b9b4adf2978a5c9", "src_port": null, "tcp_stream": null, "udp_stream": 20, "frame_number": 303, "timestamp_epoch": "1533964514.186813000" }, { "kind": "identity", "dst_ip": "192.168.1.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "SPUTNIKHOUSE<00>,SPUTNIKHOUSE<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-607ffcebcaf5eb52870194c7", "src_port": null, "tcp_stream": null, "udp_stream": 20, "frame_number": 304, "timestamp_epoch": "1533964514.187084000" }, { "kind": "identity", "dst_ip": "192.168.1.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "PETROV2018-PC<00>,PETROV2018-PC<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-a4b8ca401b1225f7768ba712", "src_port": null, "tcp_stream": null, "udp_stream": 20, "frame_number": 305, "timestamp_epoch": "1533964514.187295000" }, { "kind": "identity", "dst_ip": "192.168.1.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "PETROV2018-PC<00>,PETROV2018-PC<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-b7aa4671e147605775d8a126", "src_port": null, "tcp_stream": null, "udp_stream": 20, "frame_number": 306, "timestamp_epoch": "1533964514.952231000" }, { "kind": "identity", "dst_ip": "192.168.1.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "SPUTNIKHOUSE<00>,SPUTNIKHOUSE<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-ed269402672a169202f6c510", "src_port": null, "tcp_stream": null, "udp_stream": 20, "frame_number": 307, "timestamp_epoch": "1533964514.952244000" }, { "kind": "identity", "dst_ip": "192.168.1.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "PETROV2018-PC<20>,PETROV2018-PC<20> (Server service)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-bf6e3d75f2e0564ad605e1e3", "src_port": null, "tcp_stream": null, "udp_stream": 20, "frame_number": 308, "timestamp_epoch": "1533964514.952423000" }, { "kind": "identity", "dst_ip": "192.168.1.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-4ca8a74031b01d7f1c77a675", "src_port": null, "tcp_stream": null, "udp_stream": 4, "frame_number": 309, "timestamp_epoch": "1533964515.418603000" }, { "kind": "identity", "dst_ip": "192.168.1.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "PETROV2018-PC<20>,PETROV2018-PC<20> (Server service)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-2c134fd92cd76d20bccfd4b5", "src_port": null, "tcp_stream": null, "udp_stream": 20, "frame_number": 310, "timestamp_epoch": "1533964515.716471000" }, { "kind": "identity", "dst_ip": "192.168.1.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "SPUTNIKHOUSE<00>,SPUTNIKHOUSE<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-357c577550d0938b1b06150f", "src_port": null, "tcp_stream": null, "udp_stream": 20, "frame_number": 311, "timestamp_epoch": "1533964515.716483000" }, { "kind": "identity", "dst_ip": "192.168.1.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "PETROV2018-PC<00>,PETROV2018-PC<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-43d69eaf3166775d02122435", "src_port": null, "tcp_stream": null, "udp_stream": 20, "frame_number": 312, "timestamp_epoch": "1533964515.716708000" }, { "kind": "identity", "dst_ip": "192.168.1.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-310915f7409da96e3f983d9d", "src_port": null, "tcp_stream": null, "udp_stream": 20, "frame_number": 313, "timestamp_epoch": "1533964516.963563000" }, { "kind": "identity", "dst_ip": "192.168.1.6", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "f4:b5:20:68:b1:93", "kerberos.msg_type": "14" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-da8473abefd46b81e6443f2e", "src_port": null, "tcp_stream": 21, "udp_stream": null, "frame_number": 320, "timestamp_epoch": "1533964517.006592000" }, { "kind": "identity", "dst_ip": "192.168.1.95", "fields": { "eth.dst": "f4:b5:20:68:b1:93", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-1cf02ffdaa30896744f0a6a8", "src_port": null, "tcp_stream": 21, "udp_stream": null, "frame_number": 322, "timestamp_epoch": "1533964517.007228000" }, { "kind": "identity", "dst_ip": "192.168.1.6", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "f4:b5:20:68:b1:93", "kerberos.msg_type": "14" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-c96a8985e686fb4cffbe3528", "src_port": null, "tcp_stream": 22, "udp_stream": null, "frame_number": 336, "timestamp_epoch": "1533964517.021374000" }, { "kind": "identity", "dst_ip": "192.168.1.95", "fields": { "eth.dst": "f4:b5:20:68:b1:93", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-517ca929773c7cb51ff501ff", "src_port": null, "tcp_stream": 22, "udp_stream": null, "frame_number": 338, "timestamp_epoch": "1533964517.021989000" }, { "kind": "identity", "dst_ip": "192.168.1.6", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "f4:b5:20:68:b1:93", "kerberos.msg_type": "10", "kerberos.CNameString": "PETROV2018-PC$" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-6249872892de0e7da53d76c2", "src_port": null, "tcp_stream": 23, "udp_stream": null, "frame_number": 344, "timestamp_epoch": "1533964517.023963000" }, { "kind": "identity", "dst_ip": "192.168.1.95", "fields": { "eth.dst": "f4:b5:20:68:b1:93", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "30" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-f19fafa436c1e288c1f6bfba", "src_port": null, "tcp_stream": 23, "udp_stream": null, "frame_number": 345, "timestamp_epoch": "1533964517.024396000" }, { "kind": "identity", "dst_ip": "192.168.1.6", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "f4:b5:20:68:b1:93", "kerberos.msg_type": "10", "kerberos.CNameString": "PETROV2018-PC$" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-2e0785707a532252c8ba3029", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 352, "timestamp_epoch": "1533964517.040030000" }, { "kind": "identity", "dst_ip": "192.168.1.95", "fields": { "eth.dst": "f4:b5:20:68:b1:93", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "11", "kerberos.CNameString": "PETROV2018-PC$" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-5a57347dd93e234ee3f53f72", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 353, "timestamp_epoch": "1533964517.040651000" }, { "kind": "identity", "dst_ip": "192.168.1.6", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "f4:b5:20:68:b1:93", "kerberos.msg_type": "12,14" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-9eccca2e138f3f86fc25a9bb", "src_port": null, "tcp_stream": 25, "udp_stream": null, "frame_number": 361, "timestamp_epoch": "1533964517.042144000" }, { "kind": "identity", "dst_ip": "192.168.1.95", "fields": { "eth.dst": "f4:b5:20:68:b1:93", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "PETROV2018-PC$" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-26cd7788f5cac95fabe71acb", "src_port": null, "tcp_stream": 25, "udp_stream": null, "frame_number": 363, "timestamp_epoch": "1533964517.042917000" }, { "kind": "identity", "dst_ip": "192.168.1.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-7c2944bceb74fc374bc92f3c", "src_port": null, "tcp_stream": null, "udp_stream": 20, "frame_number": 378, "timestamp_epoch": "1533964517.727224000" }, { "kind": "identity", "dst_ip": "192.168.1.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-ef012f036adacf3f860a015b", "src_port": null, "tcp_stream": null, "udp_stream": 20, "frame_number": 379, "timestamp_epoch": "1533964518.492951000" }, { "kind": "identity", "dst_ip": "192.168.1.6", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "f4:b5:20:68:b1:93" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-3bb6cbcaf8556ce6528d3dc8", "src_port": null, "tcp_stream": 0, "udp_stream": null, "frame_number": 392, "timestamp_epoch": "1533964523.220276000" }, { "kind": "identity", "dst_ip": "192.168.1.95", "fields": { "eth.dst": "f4:b5:20:68:b1:93", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-36a98195ef43176b04d46a91", "src_port": null, "tcp_stream": 0, "udp_stream": null, "frame_number": 393, "timestamp_epoch": "1533964523.220551000" }, { "kind": "identity", "dst_ip": "192.168.1.6", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "f4:b5:20:68:b1:93" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-7dfaba7dd00956d1e554b430", "src_port": null, "tcp_stream": 0, "udp_stream": null, "frame_number": 394, "timestamp_epoch": "1533964523.220827000" }, { "kind": "identity", "dst_ip": "192.168.1.95", "fields": { "eth.dst": "f4:b5:20:68:b1:93", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-5bcbbf38172fdcd5d961b077", "src_port": null, "tcp_stream": 0, "udp_stream": null, "frame_number": 395, "timestamp_epoch": "1533964523.221042000" }, { "kind": "identity", "dst_ip": "192.168.1.6", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "f4:b5:20:68:b1:93" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-4dea07799dc9840002d5e548", "src_port": null, "tcp_stream": 18, "udp_stream": null, "frame_number": 396, "timestamp_epoch": "1533964523.221415000" }, { "kind": "identity", "dst_ip": "192.168.1.95", "fields": { "eth.dst": "f4:b5:20:68:b1:93", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-32961f81dbe4fba2bf518f74", "src_port": null, "tcp_stream": 18, "udp_stream": null, "frame_number": 398, "timestamp_epoch": "1533964523.221654000" }, { "kind": "identity", "dst_ip": "192.168.1.6", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "f4:b5:20:68:b1:93", "kerberos.msg_type": "10", "kerberos.CNameString": "mikhail.petrov" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-cc205e7ce9f8670da591b19f", "src_port": null, "tcp_stream": 27, "udp_stream": null, "frame_number": 403, "timestamp_epoch": "1533964528.919101000" }, { "kind": "identity", "dst_ip": "192.168.1.95", "fields": { "eth.dst": "f4:b5:20:68:b1:93", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "30" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-3080ce9924eeea6e1016d284", "src_port": null, "tcp_stream": 27, "udp_stream": null, "frame_number": 404, "timestamp_epoch": "1533964528.919679000" }, { "kind": "identity", "dst_ip": "192.168.1.6", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "f4:b5:20:68:b1:93", "kerberos.msg_type": "10", "kerberos.CNameString": "mikhail.petrov" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-53a44cc658a8a83807c951da", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 411, "timestamp_epoch": "1533964528.934261000" }, { "kind": "identity", "dst_ip": "192.168.1.95", "fields": { "eth.dst": "f4:b5:20:68:b1:93", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "11", "kerberos.CNameString": "mikhail.petrov" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-e33242801a39739f36c33ddf", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 412, "timestamp_epoch": "1533964528.934957000" }, { "kind": "identity", "dst_ip": "192.168.1.6", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "f4:b5:20:68:b1:93", "kerberos.msg_type": "12,14" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-69e067b023ccdffdf39af609", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 420, "timestamp_epoch": "1533964528.935993000" }, { "kind": "identity", "dst_ip": "192.168.1.95", "fields": { "eth.dst": "f4:b5:20:68:b1:93", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "mikhail.petrov" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-aa958ea46dc7c7620c1d1f1f", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 422, "timestamp_epoch": "1533964528.936758000" }, { "kind": "identity", "dst_ip": "192.168.1.6", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "f4:b5:20:68:b1:93", "kerberos.msg_type": "12,14" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-1779ab541d0a430e0e753054", "src_port": null, "tcp_stream": 30, "udp_stream": null, "frame_number": 432, "timestamp_epoch": "1533964528.981681000" }, { "kind": "identity", "dst_ip": "192.168.1.95", "fields": { "eth.dst": "f4:b5:20:68:b1:93", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "mikhail.petrov" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-b5e52b6c74ac87c30ac12795", "src_port": null, "tcp_stream": 30, "udp_stream": null, "frame_number": 434, "timestamp_epoch": "1533964528.983073000" }, { "kind": "identity", "dst_ip": "192.168.1.6", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "f4:b5:20:68:b1:93", "kerberos.msg_type": "14" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-2dceba4c01aac5e2ce83e320", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 439, "timestamp_epoch": "1533964528.983589000" }, { "kind": "identity", "dst_ip": "192.168.1.95", "fields": { "eth.dst": "f4:b5:20:68:b1:93", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-c064c53c5786e8a7f359e1ca", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 441, "timestamp_epoch": "1533964528.984439000" }, { "kind": "identity", "dst_ip": "192.168.1.6", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "f4:b5:20:68:b1:93", "kerberos.msg_type": "15" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-cff3d42d374b1a3a18494d5b", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 442, "timestamp_epoch": "1533964528.984638000" }, { "kind": "identity", "dst_ip": "192.168.1.6", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "f4:b5:20:68:b1:93", "kerberos.msg_type": "12,14" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-3b673c8b8f408d2727e01a45", "src_port": null, "tcp_stream": 32, "udp_stream": null, "frame_number": 464, "timestamp_epoch": "1533964529.521050000" }, { "kind": "identity", "dst_ip": "192.168.1.95", "fields": { "eth.dst": "f4:b5:20:68:b1:93", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "mikhail.petrov" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-1e490947f5ef54635f75fe43", "src_port": null, "tcp_stream": 32, "udp_stream": null, "frame_number": 466, "timestamp_epoch": "1533964529.522121000" }, { "kind": "identity", "dst_ip": "192.168.1.6", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "f4:b5:20:68:b1:93", "kerberos.msg_type": "14" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-e8dcf109bf4495d81531f901", "src_port": null, "tcp_stream": 31, "udp_stream": null, "frame_number": 471, "timestamp_epoch": "1533964529.529068000" }, { "kind": "identity", "dst_ip": "192.168.1.95", "fields": { "eth.dst": "f4:b5:20:68:b1:93", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-e9f2ef29c036e2b39931d95b", "src_port": null, "tcp_stream": 31, "udp_stream": null, "frame_number": 473, "timestamp_epoch": "1533964529.529903000" }, { "kind": "identity", "dst_ip": "192.168.1.6", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "f4:b5:20:68:b1:93", "kerberos.msg_type": "14" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-e2bd37028841427e844af38f", "src_port": null, "tcp_stream": 33, "udp_stream": null, "frame_number": 479, "timestamp_epoch": "1533964529.542989000" }, { "kind": "identity", "dst_ip": "192.168.1.95", "fields": { "eth.dst": "f4:b5:20:68:b1:93", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-1d801f9e0d7b5a712d244f83", "src_port": null, "tcp_stream": 33, "udp_stream": null, "frame_number": 481, "timestamp_epoch": "1533964529.543547000" }, { "kind": "identity", "dst_ip": "192.168.1.6", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "f4:b5:20:68:b1:93" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-0db7cd731d7726c09285bc24", "src_port": null, "tcp_stream": 34, "udp_stream": null, "frame_number": 491, "timestamp_epoch": "1533964529.547719000" }, { "kind": "identity", "dst_ip": "192.168.1.95", "fields": { "eth.dst": "f4:b5:20:68:b1:93", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-e50b1338737b621d4416d0a7", "src_port": null, "tcp_stream": 34, "udp_stream": null, "frame_number": 492, "timestamp_epoch": "1533964529.547981000" }, { "kind": "identity", "dst_ip": "192.168.1.6", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "f4:b5:20:68:b1:93", "kerberos.msg_type": "12,14" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-38d96f3a146390796a9d5edc", "src_port": null, "tcp_stream": 35, "udp_stream": null, "frame_number": 496, "timestamp_epoch": "1533964529.548913000" }, { "kind": "identity", "dst_ip": "192.168.1.95", "fields": { "eth.dst": "f4:b5:20:68:b1:93", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "mikhail.petrov" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-f48b18933ef2d82e5afb755e", "src_port": null, "tcp_stream": 35, "udp_stream": null, "frame_number": 498, "timestamp_epoch": "1533964529.549664000" }, { "kind": "identity", "dst_ip": "192.168.1.6", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "f4:b5:20:68:b1:93", "kerberos.msg_type": "12,14" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-7e1077e13761273268192074", "src_port": null, "tcp_stream": 36, "udp_stream": null, "frame_number": 506, "timestamp_epoch": "1533964529.550400000" }, { "kind": "identity", "dst_ip": "192.168.1.95", "fields": { "eth.dst": "f4:b5:20:68:b1:93", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "mikhail.petrov" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-5d5de9a04dcb9d048f281b31", "src_port": null, "tcp_stream": 36, "udp_stream": null, "frame_number": 508, "timestamp_epoch": "1533964529.550742000" }, { "kind": "identity", "dst_ip": "192.168.1.6", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "f4:b5:20:68:b1:93", "kerberos.msg_type": "14" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-cf96c6ac5a98bcfb6c5bae80", "src_port": null, "tcp_stream": 34, "udp_stream": null, "frame_number": 515, "timestamp_epoch": "1533964529.551678000" }, { "kind": "identity", "dst_ip": "192.168.1.95", "fields": { "eth.dst": "f4:b5:20:68:b1:93", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-2d957e52ee6a1423482542e9", "src_port": null, "tcp_stream": 34, "udp_stream": null, "frame_number": 516, "timestamp_epoch": "1533964529.552252000" }, { "kind": "identity", "dst_ip": "192.168.1.6", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "f4:b5:20:68:b1:93" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-133a1e2b5dce70bac7cb27d7", "src_port": null, "tcp_stream": 34, "udp_stream": null, "frame_number": 517, "timestamp_epoch": "1533964529.552577000" }, { "kind": "identity", "dst_ip": "192.168.1.95", "fields": { "eth.dst": "f4:b5:20:68:b1:93", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-fffed68eb60ef015b26c4ad6", "src_port": null, "tcp_stream": 34, "udp_stream": null, "frame_number": 518, "timestamp_epoch": "1533964529.552737000" }, { "kind": "identity", "dst_ip": "192.168.1.6", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "f4:b5:20:68:b1:93" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-72abbf66fa994c97ffad451a", "src_port": null, "tcp_stream": 34, "udp_stream": null, "frame_number": 519, "timestamp_epoch": "1533964529.553254000" }, { "kind": "identity", "dst_ip": "192.168.1.95", "fields": { "eth.dst": "f4:b5:20:68:b1:93", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-051b38454f692397f56c3a98", "src_port": null, "tcp_stream": 34, "udp_stream": null, "frame_number": 520, "timestamp_epoch": "1533964529.553523000" }, { "kind": "identity", "dst_ip": "192.168.1.6", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "f4:b5:20:68:b1:93" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-7419f32adbc35dae73e31a36", "src_port": null, "tcp_stream": 34, "udp_stream": null, "frame_number": 521, "timestamp_epoch": "1533964529.553785000" }, { "kind": "identity", "dst_ip": "192.168.1.95", "fields": { "eth.dst": "f4:b5:20:68:b1:93", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-82d598c24da9f176b8fd5b25", "src_port": null, "tcp_stream": 34, "udp_stream": null, "frame_number": 522, "timestamp_epoch": "1533964529.553902000" }, { "kind": "identity", "dst_ip": "192.168.1.6", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "f4:b5:20:68:b1:93" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-77c7e0419feabab0edd1b577", "src_port": null, "tcp_stream": 18, "udp_stream": null, "frame_number": 532, "timestamp_epoch": "1533964535.216919000" }, { "kind": "identity", "dst_ip": "192.168.1.95", "fields": { "eth.dst": "f4:b5:20:68:b1:93", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-e0ef3b30d1ee0e50f3acc966", "src_port": null, "tcp_stream": 18, "udp_stream": null, "frame_number": 533, "timestamp_epoch": "1533964535.217203000" }, { "kind": "identity", "dst_ip": "192.168.1.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-b79c1a8994f76ff1e71705fe", "src_port": null, "tcp_stream": null, "udp_stream": 4, "frame_number": 540, "timestamp_epoch": "1533964544.539821000" }, { "kind": "identity", "dst_ip": "192.168.1.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-e561aeec658c16ad02354cdb", "src_port": null, "tcp_stream": null, "udp_stream": 4, "frame_number": 943, "timestamp_epoch": "1533964546.042454000" }, { "kind": "identity", "dst_ip": "192.168.1.6", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "f4:b5:20:68:b1:93" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-99efdd438043899664d0a449", "src_port": null, "tcp_stream": 18, "udp_stream": null, "frame_number": 1572, "timestamp_epoch": "1533964547.213733000" }, { "kind": "identity", "dst_ip": "192.168.1.95", "fields": { "eth.dst": "f4:b5:20:68:b1:93", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-fff0b8806c1fa99923019d9f", "src_port": null, "tcp_stream": 18, "udp_stream": null, "frame_number": 1573, "timestamp_epoch": "1533964547.213996000" }, { "kind": "identity", "dst_ip": "192.168.1.6", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "f4:b5:20:68:b1:93" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-5edc02cf9e6ac1fd900fdea9", "src_port": null, "tcp_stream": 18, "udp_stream": null, "frame_number": 1574, "timestamp_epoch": "1533964547.214269000" }, { "kind": "identity", "dst_ip": "192.168.1.95", "fields": { "eth.dst": "f4:b5:20:68:b1:93", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-c68a34d52e575b92a26fa763", "src_port": null, "tcp_stream": 18, "udp_stream": null, "frame_number": 1575, "timestamp_epoch": "1533964547.214495000" }, { "kind": "identity", "dst_ip": "192.168.1.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-49d8e9a812a827857c8078da", "src_port": null, "tcp_stream": null, "udp_stream": 4, "frame_number": 1724, "timestamp_epoch": "1533964547.554989000" }, { "kind": "identity", "dst_ip": "192.168.1.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-a271f8ecb79678f3fac4708b", "src_port": null, "tcp_stream": null, "udp_stream": 20, "frame_number": 2240, "timestamp_epoch": "1533964549.099875000" }, { "kind": "identity", "dst_ip": "192.168.1.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-9bb91be15a171aebbdfcf829", "src_port": null, "tcp_stream": null, "udp_stream": 20, "frame_number": 2446, "timestamp_epoch": "1533964549.864437000" }, { "kind": "identity", "dst_ip": "192.168.1.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-971ca4897105e99b9096378d", "src_port": null, "tcp_stream": null, "udp_stream": 20, "frame_number": 2662, "timestamp_epoch": "1533964550.628639000" }, { "kind": "identity", "dst_ip": "192.168.1.6", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "f4:b5:20:68:b1:93" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-8e60bc8cac590992c69cd7f5", "src_port": null, "tcp_stream": 34, "udp_stream": null, "frame_number": 3700, "timestamp_epoch": "1533964553.216701000" }, { "kind": "identity", "dst_ip": "192.168.1.95", "fields": { "eth.dst": "f4:b5:20:68:b1:93", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-8fb6b89fdde88942df11db48", "src_port": null, "tcp_stream": 34, "udp_stream": null, "frame_number": 3701, "timestamp_epoch": "1533964553.217023000" }, { "kind": "identity", "dst_ip": "192.168.1.6", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "f4:b5:20:68:b1:93" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-62b3946d5e1dd3ab6742e912", "src_port": null, "tcp_stream": 34, "udp_stream": null, "frame_number": 6428, "timestamp_epoch": "1533964565.216982000" }, { "kind": "identity", "dst_ip": "192.168.1.95", "fields": { "eth.dst": "f4:b5:20:68:b1:93", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-997e3f2e0fd146a3f44e1ccd", "src_port": null, "tcp_stream": 34, "udp_stream": null, "frame_number": 6429, "timestamp_epoch": "1533964565.217197000" }, { "kind": "identity", "dst_ip": "192.168.1.6", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "f4:b5:20:68:b1:93" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-3e7de2b48fb43dd5c0ab518b", "src_port": null, "tcp_stream": 34, "udp_stream": null, "frame_number": 6430, "timestamp_epoch": "1533964565.217385000" }, { "kind": "identity", "dst_ip": "192.168.1.95", "fields": { "eth.dst": "f4:b5:20:68:b1:93", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-0b91f2b70abe7e74e8470b33", "src_port": null, "tcp_stream": 34, "udp_stream": null, "frame_number": 6431, "timestamp_epoch": "1533964565.217607000" }, { "kind": "identity", "dst_ip": "192.168.1.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-280c2a8de8b32a62f04d393d", "src_port": null, "tcp_stream": null, "udp_stream": 4, "frame_number": 6561, "timestamp_epoch": "1533964576.239752000" }, { "kind": "identity", "dst_ip": "192.168.1.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-c535af874f629e85bf2e4352", "src_port": null, "tcp_stream": null, "udp_stream": 4, "frame_number": 6573, "timestamp_epoch": "1533964577.731415000" }, { "kind": "identity", "dst_ip": "192.168.1.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-0725e597213c72485d429c6d", "src_port": null, "tcp_stream": null, "udp_stream": 4, "frame_number": 6583, "timestamp_epoch": "1533964579.239161000" }, { "kind": "identity", "dst_ip": "192.168.1.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-07f7a7e4a75dff8e1aa81b89", "src_port": null, "tcp_stream": null, "udp_stream": 20, "frame_number": 6596, "timestamp_epoch": "1533964580.772335000" }, { "kind": "identity", "dst_ip": "192.168.1.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-8b207a37a6de7306ee0df3d4", "src_port": null, "tcp_stream": null, "udp_stream": 20, "frame_number": 6601, "timestamp_epoch": "1533964581.531134000" }, { "kind": "identity", "dst_ip": "192.168.1.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-147766e0b1a66956beff1baa", "src_port": null, "tcp_stream": null, "udp_stream": 20, "frame_number": 6602, "timestamp_epoch": "1533964582.289915000" }, { "kind": "identity", "dst_ip": "192.168.1.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "SPUTNIKHOUSE<00>,SPUTNIKHOUSE<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-7fe034e6191cb74c875def8c", "src_port": null, "tcp_stream": null, "udp_stream": 4, "frame_number": 6727, "timestamp_epoch": "1533964628.770999000" }, { "kind": "identity", "dst_ip": "192.168.1.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "SPUTNIKHOUSE<00>,SPUTNIKHOUSE<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-1a498aa8cddec01b941dea10", "src_port": null, "tcp_stream": null, "udp_stream": 4, "frame_number": 6728, "timestamp_epoch": "1533964630.286230000" }, { "kind": "identity", "dst_ip": "192.168.1.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "SPUTNIKHOUSE<00>,SPUTNIKHOUSE<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-75878fc66b3114f14dbb0e67", "src_port": null, "tcp_stream": null, "udp_stream": 4, "frame_number": 6729, "timestamp_epoch": "1533964633.204620000" }, { "kind": "identity", "dst_ip": "192.168.1.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "SPUTNIKHOUSE<00>,SPUTNIKHOUSE<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-2c79a991db7dab286d63657d", "src_port": null, "tcp_stream": null, "udp_stream": 4, "frame_number": 7194, "timestamp_epoch": "1533964748.783623000" }, { "kind": "identity", "dst_ip": "192.168.1.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "SPUTNIKHOUSE<00>,SPUTNIKHOUSE<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-80f4899f559d4650ccc965eb", "src_port": null, "tcp_stream": null, "udp_stream": 4, "frame_number": 7195, "timestamp_epoch": "1533964750.296963000" }, { "kind": "identity", "dst_ip": "192.168.1.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "SPUTNIKHOUSE<00>,SPUTNIKHOUSE<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-65d65fd04f531ca9dcfdee08", "src_port": null, "tcp_stream": null, "udp_stream": 4, "frame_number": 7196, "timestamp_epoch": "1533964753.210052000" }, { "kind": "identity", "dst_ip": "192.168.1.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-346c90c00128a8dcbdecb078", "src_port": null, "tcp_stream": null, "udp_stream": 4, "frame_number": 7255, "timestamp_epoch": "1533964849.656262000" }, { "kind": "identity", "dst_ip": "192.168.1.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-f945cde07e14d5b2c5855024", "src_port": null, "tcp_stream": null, "udp_stream": 4, "frame_number": 7265, "timestamp_epoch": "1533964851.166322000" }, { "kind": "identity", "dst_ip": "192.168.1.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-5b9ff981ae1fd22020feb83d", "src_port": null, "tcp_stream": null, "udp_stream": 4, "frame_number": 7268, "timestamp_epoch": "1533964852.685115000" }, { "kind": "identity", "dst_ip": "192.168.1.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-0ac671303a660e1d0231840b", "src_port": null, "tcp_stream": null, "udp_stream": 20, "frame_number": 7269, "timestamp_epoch": "1533964854.228466000" }, { "kind": "identity", "dst_ip": "192.168.1.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-42470e19725a272ac78a3131", "src_port": null, "tcp_stream": null, "udp_stream": 20, "frame_number": 7272, "timestamp_epoch": "1533964854.981215000" }, { "kind": "identity", "dst_ip": "192.168.1.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-40e5299eb8014ffabda23b91", "src_port": null, "tcp_stream": null, "udp_stream": 20, "frame_number": 7273, "timestamp_epoch": "1533964855.736568000" }, { "kind": "identity", "dst_ip": "192.168.1.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "SPUTNIKHOUSE<00>,SPUTNIKHOUSE<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-bc3312176bc122206899eb3f", "src_port": null, "tcp_stream": null, "udp_stream": 4, "frame_number": 7329, "timestamp_epoch": "1533964868.839501000" }, { "kind": "identity", "dst_ip": "192.168.1.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "SPUTNIKHOUSE<00>,SPUTNIKHOUSE<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-97c07e2b28d74b649dc0aab6", "src_port": null, "tcp_stream": null, "udp_stream": 4, "frame_number": 7330, "timestamp_epoch": "1533964870.351556000" }, { "kind": "identity", "dst_ip": "192.168.1.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "SPUTNIKHOUSE<00>,SPUTNIKHOUSE<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-9a5e1cad25cb7f825619179e", "src_port": null, "tcp_stream": null, "udp_stream": 4, "frame_number": 7331, "timestamp_epoch": "1533964871.866656000" }, { "kind": "identity", "dst_ip": "192.168.1.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "SPUTNIKHOUSE<00>,SPUTNIKHOUSE<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-838d0d45fd39a30061a4c8ba", "src_port": null, "tcp_stream": null, "udp_stream": 4, "frame_number": 22068, "timestamp_epoch": "1533964988.787993000" }, { "kind": "identity", "dst_ip": "192.168.1.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "SPUTNIKHOUSE<00>,SPUTNIKHOUSE<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-c4979c2c2719f92b84a1b2ac", "src_port": null, "tcp_stream": null, "udp_stream": 4, "frame_number": 22661, "timestamp_epoch": "1533964990.306979000" }, { "kind": "identity", "dst_ip": "192.168.1.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "SPUTNIKHOUSE<00>,SPUTNIKHOUSE<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-4c2c7764ec54da3492d5e15a", "src_port": null, "tcp_stream": null, "udp_stream": 4, "frame_number": 22857, "timestamp_epoch": "1533964991.788963000" }, { "kind": "identity", "dst_ip": "192.168.1.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "SPUTNIKHOUSE<00>,SPUTNIKHOUSE<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-3db7f6f5a2a6887e37b18a7a", "src_port": null, "tcp_stream": null, "udp_stream": 4, "frame_number": 32332, "timestamp_epoch": "1533965108.771225000" }, { "kind": "identity", "dst_ip": "192.168.1.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "SPUTNIKHOUSE<00>,SPUTNIKHOUSE<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-321acc3146878280465f87cb", "src_port": null, "tcp_stream": null, "udp_stream": 4, "frame_number": 32387, "timestamp_epoch": "1533965110.270745000" }, { "kind": "identity", "dst_ip": "192.168.1.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "SPUTNIKHOUSE<00>,SPUTNIKHOUSE<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-36dcd58fdf2d006a92086ec7", "src_port": null, "tcp_stream": null, "udp_stream": 4, "frame_number": 32448, "timestamp_epoch": "1533965111.770696000" }, { "kind": "identity", "dst_ip": "192.168.1.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "SPUTNIKHOUSE<00>,SPUTNIKHOUSE<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-6814345822bea503b85326a7", "src_port": null, "tcp_stream": null, "udp_stream": 4, "frame_number": 38176, "timestamp_epoch": "1533965228.867693000" }, { "kind": "identity", "dst_ip": "192.168.1.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "SPUTNIKHOUSE<00>,SPUTNIKHOUSE<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-3fe45e2f456a69d3371feba4", "src_port": null, "tcp_stream": null, "udp_stream": 4, "frame_number": 38550, "timestamp_epoch": "1533965230.376207000" }, { "kind": "identity", "dst_ip": "192.168.1.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "SPUTNIKHOUSE<00>,SPUTNIKHOUSE<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-c57746d85f2fc90d73c639b2", "src_port": null, "tcp_stream": null, "udp_stream": 4, "frame_number": 38551, "timestamp_epoch": "1533965231.880255000" }, { "kind": "identity", "dst_ip": "192.168.1.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "SPUTNIKHOUSE<00>,SPUTNIKHOUSE<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-83fac81d09509d510885414b", "src_port": null, "tcp_stream": null, "udp_stream": 4, "frame_number": 39478, "timestamp_epoch": "1533965348.940630000" }, { "kind": "identity", "dst_ip": "192.168.1.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "SPUTNIKHOUSE<00>,SPUTNIKHOUSE<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-a1f4b27d84581168de174361", "src_port": null, "tcp_stream": null, "udp_stream": 4, "frame_number": 39479, "timestamp_epoch": "1533965350.455050000" }, { "kind": "identity", "dst_ip": "192.168.1.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "SPUTNIKHOUSE<00>,SPUTNIKHOUSE<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-d47e758125eba3763b9fd28f", "src_port": null, "tcp_stream": null, "udp_stream": 4, "frame_number": 39480, "timestamp_epoch": "1533965351.967918000" }, { "kind": "identity", "dst_ip": "192.168.1.6", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "f4:b5:20:68:b1:93", "kerberos.msg_type": "12,14" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-d54567bf07fc0bec3ef42310", "src_port": null, "tcp_stream": 1038, "udp_stream": null, "frame_number": 39568, "timestamp_epoch": "1533965407.383800000" }, { "kind": "identity", "dst_ip": "192.168.1.95", "fields": { "eth.dst": "f4:b5:20:68:b1:93", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "PETROV2018-PC$" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-fc0ca8ed6cad6f247a40ab80", "src_port": null, "tcp_stream": 1038, "udp_stream": null, "frame_number": 39570, "timestamp_epoch": "1533965407.385519000" }, { "kind": "identity", "dst_ip": "192.168.1.6", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "f4:b5:20:68:b1:93", "kerberos.msg_type": "14" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-c140314c0dda1b5bb08d12e4", "src_port": null, "tcp_stream": 1037, "udp_stream": null, "frame_number": 39575, "timestamp_epoch": "1533965407.386100000" }, { "kind": "identity", "dst_ip": "192.168.1.95", "fields": { "eth.dst": "f4:b5:20:68:b1:93", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-fe4e32a0547538a17c1a7188", "src_port": null, "tcp_stream": 1037, "udp_stream": null, "frame_number": 39577, "timestamp_epoch": "1533965407.386782000" }, { "kind": "identity", "dst_ip": "192.168.1.95", "fields": { "eth.dst": "f4:b5:20:68:b1:93", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-9018385e502c3cd96b9d94d0", "src_port": null, "tcp_stream": 1044, "udp_stream": null, "frame_number": 39634, "timestamp_epoch": "1533965409.307505000" }, { "kind": "identity", "dst_ip": "192.168.1.6", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "f4:b5:20:68:b1:93" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-e83e2050ca97108e2be112ea", "src_port": null, "tcp_stream": 1044, "udp_stream": null, "frame_number": 39635, "timestamp_epoch": "1533965409.307677000" }, { "kind": "identity", "dst_ip": "192.168.1.95", "fields": { "eth.dst": "f4:b5:20:68:b1:93", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-29b282e18a71b49315ed5a8d", "src_port": null, "tcp_stream": 1044, "udp_stream": null, "frame_number": 39636, "timestamp_epoch": "1533965409.307923000" }, { "kind": "identity", "dst_ip": "192.168.1.95", "fields": { "eth.dst": "f4:b5:20:68:b1:93", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-ed20ba9635b189dc92302a29", "src_port": null, "tcp_stream": 1044, "udp_stream": null, "frame_number": 39640, "timestamp_epoch": "1533965409.310065000" }, { "kind": "identity", "dst_ip": "192.168.1.6", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "f4:b5:20:68:b1:93" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-c5a0ca982ab228ed70b6a429", "src_port": null, "tcp_stream": 1044, "udp_stream": null, "frame_number": 39641, "timestamp_epoch": "1533965409.310834000" }, { "kind": "identity", "dst_ip": "192.168.1.95", "fields": { "eth.dst": "f4:b5:20:68:b1:93", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-525f550bb2b21a8fce675766", "src_port": null, "tcp_stream": 1044, "udp_stream": null, "frame_number": 39642, "timestamp_epoch": "1533965409.310975000" }, { "kind": "identity", "dst_ip": "192.168.1.6", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "f4:b5:20:68:b1:93" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-954df0de529c2109f6339698", "src_port": null, "tcp_stream": 1044, "udp_stream": null, "frame_number": 39643, "timestamp_epoch": "1533965409.311257000" }, { "kind": "identity", "dst_ip": "192.168.1.95", "fields": { "eth.dst": "f4:b5:20:68:b1:93", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-ddf77338b4f4698d0c569467", "src_port": null, "tcp_stream": 1044, "udp_stream": null, "frame_number": 39644, "timestamp_epoch": "1533965409.311493000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "f4:b5:20:68:b1:93", "dns.qry.name": "Petrov2018-PC" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-74b0c63b1ea1870ca8dbf6b0", "src_port": null, "tcp_stream": null, "udp_stream": 313, "frame_number": 39652, "timestamp_epoch": "1533965410.182619000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "f4:b5:20:68:b1:93", "dns.qry.name": "Petrov2018-PC" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-6c06d69d306e364c7ac7c7f8", "src_port": null, "tcp_stream": null, "udp_stream": 313, "frame_number": 39661, "timestamp_epoch": "1533965410.279591000" }, { "kind": "identity", "dst_ip": "192.168.1.6", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "f4:b5:20:68:b1:93" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-76d04093da03c7c0582e1d95", "src_port": null, "tcp_stream": 1044, "udp_stream": null, "frame_number": 39685, "timestamp_epoch": "1533965423.184645000" }, { "kind": "identity", "dst_ip": "192.168.1.95", "fields": { "eth.dst": "f4:b5:20:68:b1:93", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-9b3c5df04137076d8e21de41", "src_port": null, "tcp_stream": 1044, "udp_stream": null, "frame_number": 39686, "timestamp_epoch": "1533965423.185013000" }, { "kind": "identity", "dst_ip": "192.168.1.6", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "f4:b5:20:68:b1:93" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-d32680ceef0eb4a228a32432", "src_port": null, "tcp_stream": 1044, "udp_stream": null, "frame_number": 39687, "timestamp_epoch": "1533965423.185284000" }, { "kind": "identity", "dst_ip": "192.168.1.95", "fields": { "eth.dst": "f4:b5:20:68:b1:93", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-77790a447c6ab33f44ea2c76", "src_port": null, "tcp_stream": 1044, "udp_stream": null, "frame_number": 39688, "timestamp_epoch": "1533965423.185513000" }, { "kind": "identity", "dst_ip": "192.168.1.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "SPUTNIKHOUSE<00>,SPUTNIKHOUSE<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-000aa9501631c8862c4ec7fb", "src_port": null, "tcp_stream": null, "udp_stream": 4, "frame_number": 39728, "timestamp_epoch": "1533965468.815628000" }, { "kind": "identity", "dst_ip": "192.168.1.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "SPUTNIKHOUSE<00>,SPUTNIKHOUSE<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-606c39fec0f07a13bb499e00", "src_port": null, "tcp_stream": null, "udp_stream": 4, "frame_number": 39730, "timestamp_epoch": "1533965470.327860000" }, { "kind": "identity", "dst_ip": "192.168.1.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "SPUTNIKHOUSE<00>,SPUTNIKHOUSE<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-b263ae20cd97c581e956a8d2", "src_port": null, "tcp_stream": null, "udp_stream": 4, "frame_number": 39731, "timestamp_epoch": "1533965471.841113000" }, { "kind": "identity", "dst_ip": "192.168.1.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "SPUTNIKHOUSE<00>,SPUTNIKHOUSE<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-4987826b57aaee86158afc43", "src_port": null, "tcp_stream": null, "udp_stream": 4, "frame_number": 39887, "timestamp_epoch": "1533965588.860266000" }, { "kind": "identity", "dst_ip": "192.168.1.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "SPUTNIKHOUSE<00>,SPUTNIKHOUSE<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-c557b6899bfda43ea86ab90c", "src_port": null, "tcp_stream": null, "udp_stream": 4, "frame_number": 39888, "timestamp_epoch": "1533965590.373881000" }, { "kind": "identity", "dst_ip": "192.168.1.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "SPUTNIKHOUSE<00>,SPUTNIKHOUSE<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-939164fc579bf1d74672c252", "src_port": null, "tcp_stream": null, "udp_stream": 4, "frame_number": 39889, "timestamp_epoch": "1533965591.885149000" }, { "kind": "identity", "dst_ip": "192.168.1.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "SPUTNIKHOUSE<00>,SPUTNIKHOUSE<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-fd95d81d5309963d70cffce5", "src_port": null, "tcp_stream": null, "udp_stream": 4, "frame_number": 40030, "timestamp_epoch": "1533965708.792258000" }, { "kind": "identity", "dst_ip": "192.168.1.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "SPUTNIKHOUSE<00>,SPUTNIKHOUSE<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-faf3950e6214e1a39d9b06a6", "src_port": null, "tcp_stream": null, "udp_stream": 4, "frame_number": 40031, "timestamp_epoch": "1533965710.305494000" }, { "kind": "identity", "dst_ip": "192.168.1.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "SPUTNIKHOUSE<00>,SPUTNIKHOUSE<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-c6e3c9a3fc86fab284833a6c", "src_port": null, "tcp_stream": null, "udp_stream": 4, "frame_number": 40033, "timestamp_epoch": "1533965711.819608000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "f4:b5:20:68:b1:93", "dns.qry.name": "wpad" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-2352f0b9ad879bdcb6d1817e", "src_port": null, "tcp_stream": null, "udp_stream": 322, "frame_number": 40096, "timestamp_epoch": "1533965768.532062000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "f4:b5:20:68:b1:93", "dns.qry.name": "wpad" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-4dea8b5378b4a29864b180bf", "src_port": null, "tcp_stream": null, "udp_stream": 322, "frame_number": 40097, "timestamp_epoch": "1533965768.638881000" }, { "kind": "identity", "dst_ip": "192.168.1.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-0b18f08d056fb0abfe363cea", "src_port": null, "tcp_stream": null, "udp_stream": 4, "frame_number": 40104, "timestamp_epoch": "1533965768.842682000" }, { "kind": "identity", "dst_ip": "192.168.1.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-055d27870b5560a52b33de6d", "src_port": null, "tcp_stream": null, "udp_stream": 4, "frame_number": 40150, "timestamp_epoch": "1533965770.355602000" }, { "kind": "identity", "dst_ip": "192.168.1.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-5c4c606eddf7405463ce88de", "src_port": null, "tcp_stream": null, "udp_stream": 4, "frame_number": 40920, "timestamp_epoch": "1533965773.683000000" }, { "kind": "identity", "dst_ip": "192.168.1.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-cf7739016801b1d6f2a7eaca", "src_port": null, "tcp_stream": null, "udp_stream": 20, "frame_number": 41450, "timestamp_epoch": "1533965773.545137000" }, { "kind": "identity", "dst_ip": "192.168.1.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-d2cdfca931bb461a297d46a1", "src_port": null, "tcp_stream": null, "udp_stream": 20, "frame_number": 41608, "timestamp_epoch": "1533965774.309423000" }, { "kind": "identity", "dst_ip": "192.168.1.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-9cfc3c14373a152a2b2c6db3", "src_port": null, "tcp_stream": null, "udp_stream": 20, "frame_number": 41912, "timestamp_epoch": "1533965775.074715000" }, { "kind": "identity", "dst_ip": "192.168.1.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-659e7683bc2cf3b43346d099", "src_port": null, "tcp_stream": null, "udp_stream": 20, "frame_number": 42220, "timestamp_epoch": "1533965775.844171000" }, { "kind": "identity", "dst_ip": "192.168.1.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-379bd9789e85f091fa5e354f", "src_port": null, "tcp_stream": null, "udp_stream": 20, "frame_number": 42576, "timestamp_epoch": "1533965776.603417000" }, { "kind": "identity", "dst_ip": "192.168.1.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-34b6a9cf378788cad9cd3a6e", "src_port": null, "tcp_stream": null, "udp_stream": 20, "frame_number": 42886, "timestamp_epoch": "1533965777.366950000" }, { "kind": "identity", "dst_ip": "192.168.1.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "SPUTNIKHOUSE<00>,SPUTNIKHOUSE<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-0a7bc28af2a7b668c24c6a3a", "src_port": null, "tcp_stream": null, "udp_stream": 4, "frame_number": 47004, "timestamp_epoch": "1533965828.767667000" }, { "kind": "identity", "dst_ip": "192.168.1.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "SPUTNIKHOUSE<00>,SPUTNIKHOUSE<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-c7100db4733d2a9e49a3aec3", "src_port": null, "tcp_stream": null, "udp_stream": 4, "frame_number": 47007, "timestamp_epoch": "1533965830.269374000" }, { "kind": "identity", "dst_ip": "192.168.1.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "f4:b5:20:68:b1:93", "nbns.name": "SPUTNIKHOUSE<00>,SPUTNIKHOUSE<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-20f95cbe7cc73d52c8fc3771", "src_port": null, "tcp_stream": null, "udp_stream": 4, "frame_number": 47010, "timestamp_epoch": "1533965831.770624000" } ], "http_request": [ { "kind": "http_request", "dst_ip": "198.70.71.161", "fields": { "http.host": "www.msftncsi.com", "http.user_agent": "Microsoft NCSI", "http.request.uri": "/ncsi.txt", "http.response_in": "387", "http.request.method": "GET", "http.request.full_uri": "http://www.msftncsi.com/ncsi.txt" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-c87efbd0e3e1e80a8359483b", "src_port": 49183, "tcp_stream": 26, "udp_stream": null, "frame_number": 385, "timestamp_epoch": "1533964519.556735000" }, { "kind": "http_request", "dst_ip": "198.70.71.144", "fields": { "http.host": "www.download.windowsupdate.com", "http.user_agent": "Microsoft-CryptoAPI/6.1", "http.request.uri": "/msdownload/update/v3/static/trustedr/en/D69B561148F01C77C54578C10926DF5B856976AD.crt", "http.response_in": "4388", "http.request.method": "GET", "http.request.full_uri": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/D69B561148F01C77C54578C10926DF5B856976AD.crt" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-b8a8c8bc3ff074d07d3a42de", "src_port": 49261, "tcp_stream": 104, "udp_stream": null, "frame_number": 4331, "timestamp_epoch": "1533964554.234128000" }, { "kind": "http_request", "dst_ip": "198.70.71.144", "fields": { "http.host": "www.download.windowsupdate.com", "http.user_agent": "Microsoft-CryptoAPI/6.1", "http.request.uri": "/msdownload/update/v3/static/trustedr/en/D69B561148F01C77C54578C10926DF5B856976AD.crt", "http.response_in": "4385", "http.request.method": "GET", "http.request.full_uri": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/D69B561148F01C77C54578C10926DF5B856976AD.crt" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-43c685f226269645a0c3ce02", "src_port": 49260, "tcp_stream": 103, "udp_stream": null, "frame_number": 4350, "timestamp_epoch": "1533964554.236277000" }, { "kind": "http_request", "dst_ip": "23.43.176.205", "fields": { "http.host": "ssl.trustwave.com", "http.user_agent": "Microsoft-CryptoAPI/6.1", "http.request.uri": "/issuers/STCA.crt", "http.response_in": "5394", "http.request.method": "GET", "http.request.full_uri": "http://ssl.trustwave.com/issuers/STCA.crt" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-21e0decb08b5bd2a5f614740", "src_port": 49284, "tcp_stream": 127, "udp_stream": null, "frame_number": 5383, "timestamp_epoch": "1533964556.494073000" }, { "kind": "http_request", "dst_ip": "23.43.176.205", "fields": { "http.host": "ssl.trustwave.com", "http.user_agent": "Microsoft-CryptoAPI/6.1", "http.request.uri": "/issuers/STCA.crt", "http.response_in": "5408", "http.request.method": "GET", "http.request.full_uri": "http://ssl.trustwave.com/issuers/STCA.crt" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-965adc527b5ba5db552367a5", "src_port": 49285, "tcp_stream": 128, "udp_stream": null, "frame_number": 5387, "timestamp_epoch": "1533964556.515882000" }, { "kind": "http_request", "dst_ip": "13.33.78.186", "fields": { "http.host": "x.ss2.us", "http.user_agent": "Microsoft-CryptoAPI/6.1", "http.request.uri": "/x.cer", "http.response_in": "6283", "http.request.method": "GET", "http.request.full_uri": "http://x.ss2.us/x.cer" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-98cc81a474c7ab78495cb90b", "src_port": 49315, "tcp_stream": 158, "udp_stream": null, "frame_number": 6267, "timestamp_epoch": "1533964560.250312000" }, { "kind": "http_request", "dst_ip": "13.33.78.186", "fields": { "http.host": "x.ss2.us", "http.user_agent": "Microsoft-CryptoAPI/6.1", "http.request.uri": "/x.cer", "http.response_in": "6292", "http.request.method": "GET", "http.request.full_uri": "http://x.ss2.us/x.cer" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-c860be9f8f81eccabc5edbce", "src_port": 49316, "tcp_stream": 159, "udp_stream": null, "frame_number": 6271, "timestamp_epoch": "1533964560.267322000" }, { "kind": "http_request", "dst_ip": "149.129.222.112", "fields": { "http.host": "r53x.com", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)", "http.request.uri": "/1.rar", "http.response_in": "7266", "http.content_length": "1", "http.request.method": "POST", "http.request.full_uri": "http://r53x.com/1.rar" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-0481c10964e67ebf762b5f52", "src_port": 49334, "tcp_stream": 178, "udp_stream": null, "body_sha256": "d4735e3a265e16eee03f59718b9b5d03019c07d8b6c51f90da3a666eec13ab35", "frame_number": 7263, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 1, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 1, "timestamp_epoch": "1533964850.464296000" }, { "kind": "http_request", "dst_ip": "149.129.222.112", "fields": { "http.host": "r53x.com", "http.request.uri": "/1.zip", "http.response_in": "7279", "http.request.method": "GET", "http.request.full_uri": "http://r53x.com/1.zip" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-8ed4ae3091ad035fe503cb6a", "src_port": 49335, "tcp_stream": 179, "udp_stream": null, "frame_number": 7277, "timestamp_epoch": "1533964857.855860000" }, { "kind": "http_request", "dst_ip": "149.129.222.112", "fields": { "http.host": "r53x.com", "http.request.uri": "/a3.dat", "http.response_in": "7325", "http.request.method": "GET", "http.request.full_uri": "http://r53x.com/a3.dat" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-ce2ff303a6bb71263e83c936", "src_port": 49335, "tcp_stream": 179, "udp_stream": null, "frame_number": 7280, "timestamp_epoch": "1533964858.738093000" }, { "kind": "http_request", "dst_ip": "192.35.177.64", "fields": { "http.host": "apps.identrust.com", "http.user_agent": "Microsoft-CryptoAPI/6.1", "http.request.uri": "/roots/dstrootcax3.p7c", "http.response_in": "8679", "http.request.method": "GET", "http.request.full_uri": "http://apps.identrust.com/roots/dstrootcax3.p7c" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-056d3c1acf341c588bcf4d0e", "src_port": 49374, "tcp_stream": 218, "udp_stream": null, "frame_number": 8633, "timestamp_epoch": "1533964898.552621000" }, { "kind": "http_request", "dst_ip": "192.35.177.64", "fields": { "http.host": "apps.identrust.com", "http.user_agent": "Microsoft-CryptoAPI/6.1", "http.request.uri": "/roots/dstrootcax3.p7c", "http.response_in": "8684", "http.request.method": "GET", "http.request.full_uri": "http://apps.identrust.com/roots/dstrootcax3.p7c" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-036f1b824a77486709d0f100", "src_port": 49373, "tcp_stream": 217, "udp_stream": null, "frame_number": 8637, "timestamp_epoch": "1533964898.553823000" }, { "kind": "http_request", "dst_ip": "104.16.90.188", "fields": { "http.host": "crt.comodoca.com", "http.user_agent": "Microsoft-CryptoAPI/6.1", "http.request.uri": "/COMODORSAAddTrustCA.crt", "http.response_in": "11594", "http.request.method": "GET", "http.request.full_uri": "http://crt.comodoca.com/COMODORSAAddTrustCA.crt" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-c1671e30835267ca21a0667c", "src_port": 49452, "tcp_stream": 296, "udp_stream": null, "frame_number": 11487, "timestamp_epoch": "1533964901.324527000" }, { "kind": "http_request", "dst_ip": "104.16.90.188", "fields": { "http.host": "crt.comodoca.com", "http.user_agent": "Microsoft-CryptoAPI/6.1", "http.request.uri": "/COMODORSAAddTrustCA.crt", "http.response_in": "11602", "http.request.method": "GET", "http.request.full_uri": "http://crt.comodoca.com/COMODORSAAddTrustCA.crt" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-a171b19859beb27d1380e4d8", "src_port": 49453, "tcp_stream": 297, "udp_stream": null, "frame_number": 11488, "timestamp_epoch": "1533964901.324607000" }, { "kind": "http_request", "dst_ip": "104.16.240.184", "fields": { "http.host": "cacerts.digicert.com", "http.user_agent": "Microsoft-CryptoAPI/6.1", "http.request.uri": "/DigiCertSHA2SecureServerCA.crt", "http.response_in": "24000", "http.request.method": "GET", "http.request.full_uri": "http://cacerts.digicert.com/DigiCertSHA2SecureServerCA.crt" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-01333c3f2cf0c359f4e66335", "src_port": 49821, "tcp_stream": 665, "udp_stream": null, "frame_number": 23982, "timestamp_epoch": "1533964998.555480000" }, { "kind": "http_request", "dst_ip": "104.16.240.184", "fields": { "http.host": "cacerts.digicert.com", "http.user_agent": "Microsoft-CryptoAPI/6.1", "http.request.uri": "/DigiCertSHA2SecureServerCA.crt", "http.response_in": "24005", "http.request.method": "GET", "http.request.full_uri": "http://cacerts.digicert.com/DigiCertSHA2SecureServerCA.crt" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-298ec916d3770da0b664b1ed", "src_port": 49820, "tcp_stream": 664, "udp_stream": null, "frame_number": 23985, "timestamp_epoch": "1533964998.555964000" }, { "kind": "http_request", "dst_ip": "13.107.4.50", "fields": { "http.host": "www.download.windowsupdate.com", "http.user_agent": "Microsoft-CryptoAPI/6.1", "http.request.uri": "/msdownload/update/v3/static/trustedr/en/DF3C24F9BFD666761B268073FE06D1CC8D4F82A4.crt", "http.response_in": "28032", "http.request.method": "GET", "http.request.full_uri": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/DF3C24F9BFD666761B268073FE06D1CC8D4F82A4.crt" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-71b0afcf3be49c6c9ef63fbd", "src_port": 49929, "tcp_stream": 773, "udp_stream": null, "frame_number": 28015, "timestamp_epoch": "1533965036.696949000" }, { "kind": "http_request", "dst_ip": "13.107.4.50", "fields": { "http.host": "www.download.windowsupdate.com", "http.user_agent": "Microsoft-CryptoAPI/6.1", "http.request.uri": "/msdownload/update/v3/static/trustedr/en/DF3C24F9BFD666761B268073FE06D1CC8D4F82A4.crt", "http.response_in": "28033", "http.request.method": "GET", "http.request.full_uri": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/DF3C24F9BFD666761B268073FE06D1CC8D4F82A4.crt" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-944b4c4ae99c813ee71f037d", "src_port": 49930, "tcp_stream": 774, "udp_stream": null, "frame_number": 28018, "timestamp_epoch": "1533965036.700513000" }, { "kind": "http_request", "dst_ip": "13.107.4.50", "fields": { "http.host": "www.download.windowsupdate.com", "http.user_agent": "Microsoft-CryptoAPI/6.1", "http.request.uri": "/msdownload/update/v3/static/trustedr/en/DF3C24F9BFD666761B268073FE06D1CC8D4F82A4.crt", "http.response_in": "28036", "http.request.method": "GET", "http.request.full_uri": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/DF3C24F9BFD666761B268073FE06D1CC8D4F82A4.crt" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-379f9311c48203aeedf5ee14", "src_port": 49931, "tcp_stream": 775, "udp_stream": null, "frame_number": 28026, "timestamp_epoch": "1533965036.752397000" }, { "kind": "http_request", "dst_ip": "13.107.4.50", "fields": { "http.host": "www.download.windowsupdate.com", "http.user_agent": "Microsoft-CryptoAPI/6.1", "http.request.uri": "/msdownload/update/v3/static/trustedr/en/DF3C24F9BFD666761B268073FE06D1CC8D4F82A4.crt", "http.response_in": "28042", "http.request.method": "GET", "http.request.full_uri": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/DF3C24F9BFD666761B268073FE06D1CC8D4F82A4.crt" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-4a1e8a7da4d482620152fee4", "src_port": 49932, "tcp_stream": 776, "udp_stream": null, "frame_number": 28030, "timestamp_epoch": "1533965036.807677000" }, { "kind": "http_request", "dst_ip": "205.185.216.42", "fields": { "http.host": "www.download.windowsupdate.com", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)", "http.request.uri": "/msdownload/update/v3/static/trustedr/en/authrootseq.txt", "http.response_in": "39491", "http.request.method": "GET", "http.request.full_uri": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-559ef94c1321f6b0b0033452", "src_port": 50183, "tcp_stream": 1034, "udp_stream": null, "frame_number": 39486, "timestamp_epoch": "1533965401.164021000" }, { "kind": "http_request", "dst_ip": "205.185.216.42", "fields": { "http.host": "www.download.windowsupdate.com", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)", "http.request.uri": "/msdownload/update/v3/static/trustedr/en/authrootstl.cab", "http.response_in": "39550", "http.request.method": "GET", "http.request.full_uri": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-0b13b770dfc4f8a9bacb3606", "src_port": 50184, "tcp_stream": 1035, "udp_stream": null, "frame_number": 39496, "timestamp_epoch": "1533965406.568628000" }, { "kind": "http_request", "dst_ip": "185.68.93.18", "fields": { "http.host": "185.68.93.18", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)", "http.request.uri": "/dot.php", "http.response_in": "39598", "http.content_length": "72", "http.request.method": "POST", "http.request.full_uri": "http://185.68.93.18/dot.php" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-da056e254db42d80721b0ffe", "src_port": 50185, "tcp_stream": 1036, "udp_stream": null, "body_sha256": "aa81dc4dfa58c4040d0e5c08813a963dd3e8a8a16fd1c76ed758e703b62761f2", "frame_number": 39557, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 72, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 72, "timestamp_epoch": "1533965406.977212000" }, { "kind": "http_request", "dst_ip": "185.68.93.18", "fields": { "http.host": "185.68.93.18", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)", "http.request.uri": "/dot.php", "http.response_in": "39678", "http.content_length": "418", "http.request.method": "POST", "http.request.full_uri": "http://185.68.93.18/dot.php" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-4e9d5e9dc302eae1bbb21607", "src_port": 50194, "tcp_stream": 1046, "udp_stream": null, "body_sha256": "d84fb0e64ee9f712fb6a808e9caa959903068ae7d7805bd0ce5f4782a37422f4", "frame_number": 39676, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 418, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 418, "timestamp_epoch": "1533965418.580357000" }, { "kind": "http_request", "dst_ip": "185.68.93.18", "fields": { "http.host": "185.68.93.18", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)", "http.request.uri": "/dot.php", "http.response_in": "39683", "http.content_length": "72", "http.request.method": "POST", "http.request.full_uri": "http://185.68.93.18/dot.php" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-3568255e99c875943570ecdb", "src_port": 50194, "tcp_stream": 1046, "udp_stream": null, "body_sha256": "aa81dc4dfa58c4040d0e5c08813a963dd3e8a8a16fd1c76ed758e703b62761f2", "frame_number": 39681, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 72, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 72, "timestamp_epoch": "1533965419.412338000" }, { "kind": "http_request", "dst_ip": "185.68.93.18", "fields": { "http.host": "185.68.93.18", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)", "http.request.uri": "/dot.php", "http.response_in": "39701", "http.content_length": "72", "http.request.method": "POST", "http.request.full_uri": "http://185.68.93.18/dot.php" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-60748206b17f7f2f879af499", "src_port": 50195, "tcp_stream": 1047, "udp_stream": null, "body_sha256": "aa81dc4dfa58c4040d0e5c08813a963dd3e8a8a16fd1c76ed758e703b62761f2", "frame_number": 39699, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 72, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 72, "timestamp_epoch": "1533965435.576793000" }, { "kind": "http_request", "dst_ip": "185.68.93.18", "fields": { "http.host": "185.68.93.18", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)", "http.request.uri": "/dot.php", "http.response_in": "39714", "http.content_length": "72", "http.request.method": "POST", "http.request.full_uri": "http://185.68.93.18/dot.php" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-aa2c09b7a88e2de68e0b3c99", "src_port": 50196, "tcp_stream": 1048, "udp_stream": null, "body_sha256": "aa81dc4dfa58c4040d0e5c08813a963dd3e8a8a16fd1c76ed758e703b62761f2", "frame_number": 39712, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 72, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 72, "timestamp_epoch": "1533965451.757604000" }, { "kind": "http_request", "dst_ip": "185.68.93.18", "fields": { "http.host": "185.68.93.18", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)", "http.request.uri": "/dot.php", "http.response_in": "39727", "http.content_length": "72", "http.request.method": "POST", "http.request.full_uri": "http://185.68.93.18/dot.php" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-93422ac5228c996c5ef4770d", "src_port": 50197, "tcp_stream": 1049, "udp_stream": null, "body_sha256": "aa81dc4dfa58c4040d0e5c08813a963dd3e8a8a16fd1c76ed758e703b62761f2", "frame_number": 39725, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 72, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 72, "timestamp_epoch": "1533965467.936416000" }, { "kind": "http_request", "dst_ip": "185.68.93.18", "fields": { "http.host": "185.68.93.18", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)", "http.request.uri": "/dot.php", "http.response_in": "39743", "http.content_length": "72", "http.request.method": "POST", "http.request.full_uri": "http://185.68.93.18/dot.php" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-08c10f9f2303068988a34104", "src_port": 50198, "tcp_stream": 1050, "udp_stream": null, "body_sha256": "aa81dc4dfa58c4040d0e5c08813a963dd3e8a8a16fd1c76ed758e703b62761f2", "frame_number": 39741, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 72, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 72, "timestamp_epoch": "1533965484.293094000" }, { "kind": "http_request", "dst_ip": "185.68.93.18", "fields": { "http.host": "185.68.93.18", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)", "http.request.uri": "/dot.php", "http.response_in": "39756", "http.content_length": "72", "http.request.method": "POST", "http.request.full_uri": "http://185.68.93.18/dot.php" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-ec8a5d815673ad31feb944a0", "src_port": 50199, "tcp_stream": 1051, "udp_stream": null, "body_sha256": "aa81dc4dfa58c4040d0e5c08813a963dd3e8a8a16fd1c76ed758e703b62761f2", "frame_number": 39754, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 72, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 72, "timestamp_epoch": "1533965500.471438000" }, { "kind": "http_request", "dst_ip": "185.68.93.18", "fields": { "http.host": "185.68.93.18", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)", "http.request.uri": "/dot.php", "http.response_in": "39769", "http.content_length": "72", "http.request.method": "POST", "http.request.full_uri": "http://185.68.93.18/dot.php" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-ccf997357d7b19a4eac03403", "src_port": 50200, "tcp_stream": 1052, "udp_stream": null, "body_sha256": "aa81dc4dfa58c4040d0e5c08813a963dd3e8a8a16fd1c76ed758e703b62761f2", "frame_number": 39767, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 72, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 72, "timestamp_epoch": "1533965516.649335000" }, { "kind": "http_request", "dst_ip": "185.68.93.18", "fields": { "http.host": "185.68.93.18", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)", "http.request.uri": "/dot.php", "http.response_in": "39783", "http.content_length": "72", "http.request.method": "POST", "http.request.full_uri": "http://185.68.93.18/dot.php" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-7ddc40d89500cdbfb9f47c33", "src_port": 50201, "tcp_stream": 1053, "udp_stream": null, "body_sha256": "aa81dc4dfa58c4040d0e5c08813a963dd3e8a8a16fd1c76ed758e703b62761f2", "frame_number": 39781, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 72, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 72, "timestamp_epoch": "1533965532.902740000" }, { "kind": "http_request", "dst_ip": "185.68.93.18", "fields": { "http.host": "185.68.93.18", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)", "http.request.uri": "/dot.php", "http.response_in": "39798", "http.content_length": "72", "http.request.method": "POST", "http.request.full_uri": "http://185.68.93.18/dot.php" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-9d33f59a308ade5db4ee7cdf", "src_port": 50202, "tcp_stream": 1054, "udp_stream": null, "body_sha256": "aa81dc4dfa58c4040d0e5c08813a963dd3e8a8a16fd1c76ed758e703b62761f2", "frame_number": 39796, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 72, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 72, "timestamp_epoch": "1533965549.287287000" }, { "kind": "http_request", "dst_ip": "185.68.93.18", "fields": { "http.host": "185.68.93.18", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)", "http.request.uri": "/dot.php", "http.response_in": "39811", "http.content_length": "72", "http.request.method": "POST", "http.request.full_uri": "http://185.68.93.18/dot.php" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-ca2f873d6165fedbf344610a", "src_port": 50203, "tcp_stream": 1055, "udp_stream": null, "body_sha256": "aa81dc4dfa58c4040d0e5c08813a963dd3e8a8a16fd1c76ed758e703b62761f2", "frame_number": 39809, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 72, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 72, "timestamp_epoch": "1533965565.437819000" }, { "kind": "http_request", "dst_ip": "185.68.93.18", "fields": { "http.host": "185.68.93.18", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)", "http.request.uri": "/dot.php", "http.response_in": "39881", "http.content_length": "72", "http.request.method": "POST", "http.request.full_uri": "http://185.68.93.18/dot.php" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-521fb42d13ec65f4422f2b91", "src_port": 50205, "tcp_stream": 1057, "udp_stream": null, "body_sha256": "aa81dc4dfa58c4040d0e5c08813a963dd3e8a8a16fd1c76ed758e703b62761f2", "frame_number": 39879, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 72, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 72, "timestamp_epoch": "1533965581.646796000" }, { "kind": "http_request", "dst_ip": "185.68.93.18", "fields": { "http.host": "185.68.93.18", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)", "http.request.uri": "/dot.php", "http.response_in": "39897", "http.content_length": "72", "http.request.method": "POST", "http.request.full_uri": "http://185.68.93.18/dot.php" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-004d20100657cafabd7054a8", "src_port": 50206, "tcp_stream": 1058, "udp_stream": null, "body_sha256": "aa81dc4dfa58c4040d0e5c08813a963dd3e8a8a16fd1c76ed758e703b62761f2", "frame_number": 39895, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 72, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 72, "timestamp_epoch": "1533965597.772796000" }, { "kind": "http_request", "dst_ip": "185.68.93.18", "fields": { "http.host": "185.68.93.18", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)", "http.request.uri": "/dot.php", "http.response_in": "39959", "http.content_length": "72", "http.request.method": "POST", "http.request.full_uri": "http://185.68.93.18/dot.php" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-5b9e9c792f29686db5760010", "src_port": 50208, "tcp_stream": 1060, "udp_stream": null, "body_sha256": "aa81dc4dfa58c4040d0e5c08813a963dd3e8a8a16fd1c76ed758e703b62761f2", "frame_number": 39951, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 72, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 72, "timestamp_epoch": "1533965613.953658000" }, { "kind": "http_request", "dst_ip": "185.68.93.18", "fields": { "http.host": "185.68.93.18", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)", "http.request.uri": "/dot.php", "http.response_in": "39972", "http.content_length": "72", "http.request.method": "POST", "http.request.full_uri": "http://185.68.93.18/dot.php" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-119aec9ea03722a17a0719ec", "src_port": 50209, "tcp_stream": 1061, "udp_stream": null, "body_sha256": "aa81dc4dfa58c4040d0e5c08813a963dd3e8a8a16fd1c76ed758e703b62761f2", "frame_number": 39970, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 72, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 72, "timestamp_epoch": "1533965630.124714000" }, { "kind": "http_request", "dst_ip": "185.68.93.18", "fields": { "http.host": "185.68.93.18", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)", "http.request.uri": "/dot.php", "http.response_in": "39985", "http.content_length": "72", "http.request.method": "POST", "http.request.full_uri": "http://185.68.93.18/dot.php" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-870fd67c843d961debe94e10", "src_port": 50210, "tcp_stream": 1062, "udp_stream": null, "body_sha256": "aa81dc4dfa58c4040d0e5c08813a963dd3e8a8a16fd1c76ed758e703b62761f2", "frame_number": 39983, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 72, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 72, "timestamp_epoch": "1533965646.289888000" }, { "kind": "http_request", "dst_ip": "185.68.93.18", "fields": { "http.host": "185.68.93.18", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)", "http.request.uri": "/dot.php", "http.response_in": "39998", "http.content_length": "72", "http.request.method": "POST", "http.request.full_uri": "http://185.68.93.18/dot.php" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-67bb53c4b152d829fe9d522f", "src_port": 50211, "tcp_stream": 1063, "udp_stream": null, "body_sha256": "aa81dc4dfa58c4040d0e5c08813a963dd3e8a8a16fd1c76ed758e703b62761f2", "frame_number": 39996, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 72, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 72, "timestamp_epoch": "1533965662.463461000" }, { "kind": "http_request", "dst_ip": "185.68.93.18", "fields": { "http.host": "185.68.93.18", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)", "http.request.uri": "/dot.php", "http.response_in": "40011", "http.content_length": "72", "http.request.method": "POST", "http.request.full_uri": "http://185.68.93.18/dot.php" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-97449926f159fe7712907367", "src_port": 50212, "tcp_stream": 1064, "udp_stream": null, "body_sha256": "aa81dc4dfa58c4040d0e5c08813a963dd3e8a8a16fd1c76ed758e703b62761f2", "frame_number": 40009, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 72, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 72, "timestamp_epoch": "1533965678.767587000" }, { "kind": "http_request", "dst_ip": "185.68.93.18", "fields": { "http.host": "185.68.93.18", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)", "http.request.uri": "/dot.php", "http.response_in": "40024", "http.content_length": "72", "http.request.method": "POST", "http.request.full_uri": "http://185.68.93.18/dot.php" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-cecd5733efc725978d8fc6e5", "src_port": 50213, "tcp_stream": 1065, "udp_stream": null, "body_sha256": "aa81dc4dfa58c4040d0e5c08813a963dd3e8a8a16fd1c76ed758e703b62761f2", "frame_number": 40022, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 72, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 72, "timestamp_epoch": "1533965694.815438000" }, { "kind": "http_request", "dst_ip": "185.68.93.18", "fields": { "http.host": "185.68.93.18", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)", "http.request.uri": "/dot.php", "http.response_in": "40040", "http.content_length": "72", "http.request.method": "POST", "http.request.full_uri": "http://185.68.93.18/dot.php" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-1e6746e297267a17440e30cc", "src_port": 50214, "tcp_stream": 1066, "udp_stream": null, "body_sha256": "aa81dc4dfa58c4040d0e5c08813a963dd3e8a8a16fd1c76ed758e703b62761f2", "frame_number": 40038, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 72, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 72, "timestamp_epoch": "1533965712.030869000" }, { "kind": "http_request", "dst_ip": "185.68.93.18", "fields": { "http.host": "185.68.93.18", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)", "http.request.uri": "/dot.php", "http.response_in": "40053", "http.content_length": "72", "http.request.method": "POST", "http.request.full_uri": "http://185.68.93.18/dot.php" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-abe9f9b8f52f9bc109cf71e6", "src_port": 50215, "tcp_stream": 1067, "udp_stream": null, "body_sha256": "aa81dc4dfa58c4040d0e5c08813a963dd3e8a8a16fd1c76ed758e703b62761f2", "frame_number": 40051, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 72, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 72, "timestamp_epoch": "1533965728.827660000" }, { "kind": "http_request", "dst_ip": "185.68.93.18", "fields": { "http.host": "185.68.93.18", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)", "http.request.uri": "/dot.php", "http.response_in": "40066", "http.content_length": "72", "http.request.method": "POST", "http.request.full_uri": "http://185.68.93.18/dot.php" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-c405d729552ccb5dc2223c62", "src_port": 50216, "tcp_stream": 1068, "udp_stream": null, "body_sha256": "aa81dc4dfa58c4040d0e5c08813a963dd3e8a8a16fd1c76ed758e703b62761f2", "frame_number": 40064, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 72, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 72, "timestamp_epoch": "1533965744.894700000" }, { "kind": "http_request", "dst_ip": "185.68.93.18", "fields": { "http.host": "185.68.93.18", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)", "http.request.uri": "/dot.php", "http.response_in": "40080", "http.content_length": "72", "http.request.method": "POST", "http.request.full_uri": "http://185.68.93.18/dot.php" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-57b6536fff826c82fff6644b", "src_port": 50217, "tcp_stream": 1069, "udp_stream": null, "body_sha256": "aa81dc4dfa58c4040d0e5c08813a963dd3e8a8a16fd1c76ed758e703b62761f2", "frame_number": 40078, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 72, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 72, "timestamp_epoch": "1533965761.462868000" }, { "kind": "http_request", "dst_ip": "103.5.149.72", "fields": { "http.host": "tass.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/", "http.request.method": "GET", "http.request.full_uri": "http://tass.com/" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-034e4b6c23c26e4e2d7d4b33", "src_port": 50219, "tcp_stream": 1071, "udp_stream": null, "frame_number": 40100, "timestamp_epoch": "1533965768.745327000" }, { "kind": "http_request", "dst_ip": "103.5.149.72", "fields": { "http.host": "tass.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/js/jquery-1.8.3.min.js?v=1533913284", "http.response_in": "41024", "http.request.method": "GET", "http.request.full_uri": "http://tass.com/js/jquery-1.8.3.min.js?v=1533913284" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-ce6176b696590c0b21227780", "src_port": 50218, "tcp_stream": 1070, "udp_stream": null, "frame_number": 40113, "timestamp_epoch": "1533965770.052650000" }, { "kind": "http_request", "dst_ip": "103.5.149.72", "fields": { "http.host": "tass.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/assets/d45d2990/photoModeCss.css?v=1533913284", "http.response_in": "40508", "http.request.method": "GET", "http.request.full_uri": "http://tass.com/assets/d45d2990/photoModeCss.css?v=1533913284" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-eb7fafb907d4c4ccedb06051", "src_port": 50223, "tcp_stream": 1074, "udp_stream": null, "frame_number": 40165, "timestamp_epoch": "1533965770.465535000" }, { "kind": "http_request", "dst_ip": "103.5.149.72", "fields": { "http.host": "tass.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/assets/e2a326a5/main-slider-widget.min.css?v=1533913284", "http.response_in": "40516", "http.request.method": "GET", "http.request.full_uri": "http://tass.com/assets/e2a326a5/main-slider-widget.min.css?v=1533913284" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-86af93639d5ca8c74f256f27", "src_port": 50220, "tcp_stream": 1072, "udp_stream": null, "frame_number": 40171, "timestamp_epoch": "1533965770.466207000" }, { "kind": "http_request", "dst_ip": "103.5.149.72", "fields": { "http.host": "tass.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/assets/14df3cc8/layout.min.css?v=1533913284", "http.response_in": "41020", "http.request.method": "GET", "http.request.full_uri": "http://tass.com/assets/14df3cc8/layout.min.css?v=1533913284" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-cb28b1b09b9553dd7a8716a6", "src_port": 50221, "tcp_stream": 1073, "udp_stream": null, "frame_number": 40173, "timestamp_epoch": "1533965770.466368000" }, { "kind": "http_request", "dst_ip": "103.5.149.72", "fields": { "http.host": "tass.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/assets/6f5f919/flags.min.css?v=1533913284", "http.response_in": "40560", "http.request.method": "GET", "http.request.full_uri": "http://tass.com/assets/6f5f919/flags.min.css?v=1533913284" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-c3ee2958e558c8c3b93e58a0", "src_port": 50222, "tcp_stream": 1075, "udp_stream": null, "frame_number": 40177, "timestamp_epoch": "1533965770.467225000" }, { "kind": "http_request", "dst_ip": "87.240.129.133", "fields": { "http.host": "vk.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/js/api/openapi.js?v=1533913284", "http.response_in": "40506", "http.request.method": "GET", "http.request.full_uri": "http://vk.com/js/api/openapi.js?v=1533913284" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-3b3a53f5265d62259e1455d4", "src_port": 50224, "tcp_stream": 1076, "udp_stream": null, "frame_number": 40209, "timestamp_epoch": "1533965770.487843000" }, { "kind": "http_request", "dst_ip": "103.5.149.72", "fields": { "http.host": "tass.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/assets/842758d5/mainTopSlider.css?v=1533913284", "http.response_in": "40357", "http.request.method": "GET", "http.request.full_uri": "http://tass.com/assets/842758d5/mainTopSlider.css?v=1533913284" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-391d863e5f13817d9c976a16", "src_port": 50219, "tcp_stream": 1071, "udp_stream": null, "frame_number": 40213, "timestamp_epoch": "1533965770.489095000" }, { "kind": "http_request", "dst_ip": "103.5.149.72", "fields": { "http.host": "tass.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/assets/43ffdc60/angular.rangeSlider.min.css?v=1533913284", "http.response_in": "40735", "http.request.method": "GET", "http.request.full_uri": "http://tass.com/assets/43ffdc60/angular.rangeSlider.min.css?v=1533913284" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-a87aa78c81bc79fed3c188e4", "src_port": 50219, "tcp_stream": 1071, "udp_stream": null, "frame_number": 40361, "timestamp_epoch": "1533965770.816258000" }, { "kind": "http_request", "dst_ip": "103.5.149.72", "fields": { "http.host": "tass.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/assets/f64f6e6a/zoom.min.css?v=1533913284", "http.response_in": "41029", "http.request.method": "GET", "http.request.full_uri": "http://tass.com/assets/f64f6e6a/zoom.min.css?v=1533913284" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-64905e3da61aab59115d6abb", "src_port": 50223, "tcp_stream": 1074, "udp_stream": null, "frame_number": 40510, "timestamp_epoch": "1533965771.062766000" }, { "kind": "http_request", "dst_ip": "103.5.149.72", "fields": { "http.host": "tass.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/assets/a6d7cd43/cards.min.css?v=1533913284", "http.response_in": "41028", "http.request.method": "GET", "http.request.full_uri": "http://tass.com/assets/a6d7cd43/cards.min.css?v=1533913284" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-5b6be1810a97b00de4f82e63", "src_port": 50220, "tcp_stream": 1072, "udp_stream": null, "frame_number": 40518, "timestamp_epoch": "1533965771.072573000" }, { "kind": "http_request", "dst_ip": "103.5.149.72", "fields": { "http.host": "tass.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/assets/8665a252/css.css?v=1533913284", "http.response_in": "41048", "http.request.method": "GET", "http.request.full_uri": "http://tass.com/assets/8665a252/css.css?v=1533913284" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-51d843c8308fa93ad28d3d48", "src_port": 50222, "tcp_stream": 1075, "udp_stream": null, "frame_number": 40562, "timestamp_epoch": "1533965771.132264000" }, { "kind": "http_request", "dst_ip": "103.5.149.72", "fields": { "http.host": "tass.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/assets/735f4b6e/media-widget.min.css?v=1533913284", "http.response_in": "41120", "http.request.method": "GET", "http.request.full_uri": "http://tass.com/assets/735f4b6e/media-widget.min.css?v=1533913284" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-d2a5a236906f463be12488e1", "src_port": 50219, "tcp_stream": 1071, "udp_stream": null, "frame_number": 40737, "timestamp_epoch": "1533965771.477596000" }, { "kind": "http_request", "dst_ip": "103.5.149.72", "fields": { "http.host": "tass.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/css/mobile.css?_=1", "http.response_in": "41345", "http.request.method": "GET", "http.request.full_uri": "http://tass.com/css/mobile.css?_=1" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-50a2caf6e7bcc9be471b6084", "src_port": 50221, "tcp_stream": 1073, "udp_stream": null, "frame_number": 41022, "timestamp_epoch": "1533965773.993678000" }, { "kind": "http_request", "dst_ip": "103.5.149.72", "fields": { "http.host": "tass.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/css/media-queries.css?_=3", "http.response_in": "41363", "http.request.method": "GET", "http.request.full_uri": "http://tass.com/css/media-queries.css?_=3" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-167f18c686859e2d3ed9c77e", "src_port": 50218, "tcp_stream": 1070, "udp_stream": null, "frame_number": 41026, "timestamp_epoch": "1533965774.002334000" }, { "kind": "http_request", "dst_ip": "103.5.149.72", "fields": { "http.host": "tass.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/css/before-widescreen.css", "http.response_in": "41351", "http.request.method": "GET", "http.request.full_uri": "http://tass.com/css/before-widescreen.css" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-46b47de68bdafc79649fd72c", "src_port": 50220, "tcp_stream": 1072, "udp_stream": null, "frame_number": 41034, "timestamp_epoch": "1533965774.016397000" }, { "kind": "http_request", "dst_ip": "103.5.149.72", "fields": { "http.host": "tass.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/css/widescreen.css", "http.response_in": "41389", "http.request.method": "GET", "http.request.full_uri": "http://tass.com/css/widescreen.css" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-76b2234b6a6aa79e591db145", "src_port": 50223, "tcp_stream": 1074, "udp_stream": null, "frame_number": 41036, "timestamp_epoch": "1533965774.016484000" }, { "kind": "http_request", "dst_ip": "103.5.149.72", "fields": { "http.host": "tass.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/css/print.css?v=1", "http.response_in": "41435", "http.request.method": "GET", "http.request.full_uri": "http://tass.com/css/print.css?v=1" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-58cac5a6699eafc613154a80", "src_port": 50222, "tcp_stream": 1075, "udp_stream": null, "frame_number": 41060, "timestamp_epoch": "1533965774.048915000" }, { "kind": "http_request", "dst_ip": "103.5.149.72", "fields": { "http.host": "tass.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/js/jquery-ui.min.js?v=1533913284", "http.response_in": "43633", "http.request.method": "GET", "http.request.full_uri": "http://tass.com/js/jquery-ui.min.js?v=1533913284" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-60fd8d2655976f383ac9eee7", "src_port": 50219, "tcp_stream": 1071, "udp_stream": null, "frame_number": 41126, "timestamp_epoch": "1533965772.393285000" }, { "kind": "http_request", "dst_ip": "103.5.149.72", "fields": { "http.host": "tass.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/assets/666a6de7/lenta.min.css?v=1533913284", "http.response_in": "42045", "http.request.method": "GET", "http.request.full_uri": "http://tass.com/assets/666a6de7/lenta.min.css?v=1533913284" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-6f8cf1d275c7e3d3a124645a", "src_port": 50278, "tcp_stream": 1130, "udp_stream": null, "frame_number": 41322, "timestamp_epoch": "1533965772.824858000" }, { "kind": "http_request", "dst_ip": "103.5.149.72", "fields": { "http.host": "tass.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/assets/916e0df6/footer.min.css?v=1533913284", "http.response_in": "42053", "http.request.method": "GET", "http.request.full_uri": "http://tass.com/assets/916e0df6/footer.min.css?v=1533913284" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-96b5afd62a8cad25bb3dc538", "src_port": 50279, "tcp_stream": 1131, "udp_stream": null, "frame_number": 41324, "timestamp_epoch": "1533965772.824982000" }, { "kind": "http_request", "dst_ip": "103.5.149.72", "fields": { "http.host": "tass.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/js/common/infinite-scroll.js?v=1533913284", "http.response_in": "41786", "http.request.method": "GET", "http.request.full_uri": "http://tass.com/js/common/infinite-scroll.js?v=1533913284" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-4c4a09975c5e375b0be7b167", "src_port": 50221, "tcp_stream": 1073, "udp_stream": null, "frame_number": 41347, "timestamp_epoch": "1533965773.014142000" }, { "kind": "http_request", "dst_ip": "103.5.149.72", "fields": { "http.host": "tass.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/js/common/angular-touch.js?v=1533913284", "http.response_in": "42689", "http.request.method": "GET", "http.request.full_uri": "http://tass.com/js/common/angular-touch.js?v=1533913284" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-4e1c416cad302a8a57337cf1", "src_port": 50220, "tcp_stream": 1072, "udp_stream": null, "frame_number": 41353, "timestamp_epoch": "1533965773.026022000" }, { "kind": "http_request", "dst_ip": "103.5.149.72", "fields": { "http.host": "tass.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/js/zoom/angular.rangeSlider.js?v=1533913284", "http.response_in": "41848", "http.request.method": "GET", "http.request.full_uri": "http://tass.com/js/zoom/angular.rangeSlider.js?v=1533913284" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-76352506b542be717ee1ae29", "src_port": 50218, "tcp_stream": 1070, "udp_stream": null, "frame_number": 41365, "timestamp_epoch": "1533965773.105996000" }, { "kind": "http_request", "dst_ip": "103.5.149.72", "fields": { "http.host": "tass.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/js/zoom/ng-pinch-zoom.js?v=1533913284", "http.response_in": "42201", "http.request.method": "GET", "http.request.full_uri": "http://tass.com/js/zoom/ng-pinch-zoom.js?v=1533913284" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-79eb76181b8b1ba485dbd739", "src_port": 50223, "tcp_stream": 1074, "udp_stream": null, "frame_number": 41391, "timestamp_epoch": "1533965773.250617000" }, { "kind": "http_request", "dst_ip": "103.5.149.72", "fields": { "http.host": "tass.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/js/common/tass.js?v=1533913284", "http.response_in": "41872", "http.request.method": "GET", "http.request.full_uri": "http://tass.com/js/common/tass.js?v=1533913284" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-b4e03cb0b7a3434bee5730a2", "src_port": 50222, "tcp_stream": 1075, "udp_stream": null, "frame_number": 41437, "timestamp_epoch": "1533965773.488179000" }, { "kind": "http_request", "dst_ip": "103.5.149.72", "fields": { "http.host": "tass.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/js/common/angular-sanitize.min.js?v=1533913284", "http.response_in": "42224", "http.request.method": "GET", "http.request.full_uri": "http://tass.com/js/common/angular-sanitize.min.js?v=1533913284" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-09995c7086993d5ea025fbc8", "src_port": 50281, "tcp_stream": 1132, "udp_stream": null, "frame_number": 41781, "timestamp_epoch": "1533965774.639806000" }, { "kind": "http_request", "dst_ip": "103.5.149.72", "fields": { "http.host": "tass.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/js/angular-1.2.4.min.js?v=1533913284", "http.response_in": "43154", "http.request.method": "GET", "http.request.full_uri": "http://tass.com/js/angular-1.2.4.min.js?v=1533913284" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-99d817a57f3bde8a8f76c320", "src_port": 50280, "tcp_stream": 1133, "udp_stream": null, "frame_number": 41784, "timestamp_epoch": "1533965774.640184000" }, { "kind": "http_request", "dst_ip": "103.5.149.72", "fields": { "http.host": "tass.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/js/common/photoModeController.js?v=1533913284", "http.response_in": "42246", "http.request.method": "GET", "http.request.full_uri": "http://tass.com/js/common/photoModeController.js?v=1533913284" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-9a4dc5c840a792143013312c", "src_port": 50221, "tcp_stream": 1073, "udp_stream": null, "frame_number": 41791, "timestamp_epoch": "1533965774.642796000" }, { "kind": "http_request", "dst_ip": "103.5.149.72", "fields": { "http.host": "tass.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/js/common/mainTopSlider.js?v=1533913284", "http.response_in": "42263", "http.request.method": "GET", "http.request.full_uri": "http://tass.com/js/common/mainTopSlider.js?v=1533913284" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-0093b21b402005655cc7d5b2", "src_port": 50218, "tcp_stream": 1070, "udp_stream": null, "frame_number": 41850, "timestamp_epoch": "1533965774.796502000" }, { "kind": "http_request", "dst_ip": "103.5.149.72", "fields": { "http.host": "tass.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/js/common/pressCenterCalendar.js?v=1533913284", "http.response_in": "42283", "http.request.method": "GET", "http.request.full_uri": "http://tass.com/js/common/pressCenterCalendar.js?v=1533913284" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-72046d8521a8f0e26afefcbd", "src_port": 50222, "tcp_stream": 1075, "udp_stream": null, "frame_number": 41876, "timestamp_epoch": "1533965774.845808000" }, { "kind": "http_request", "dst_ip": "103.5.149.72", "fields": { "http.host": "tass.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/js/common/mainDirect.js?v=1533913284", "http.response_in": "42702", "http.request.method": "GET", "http.request.full_uri": "http://tass.com/js/common/mainDirect.js?v=1533913284" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-476806292a61e2ed2611fc64", "src_port": 50283, "tcp_stream": 1134, "udp_stream": null, "frame_number": 42021, "timestamp_epoch": "1533965775.393890000" }, { "kind": "http_request", "dst_ip": "103.5.149.72", "fields": { "http.host": "tass.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/js/activeViewService.js?v=1533913284", "http.response_in": "42485", "http.request.method": "GET", "http.request.full_uri": "http://tass.com/js/activeViewService.js?v=1533913284" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-d529b5369ebb8fe7dc169efa", "src_port": 50282, "tcp_stream": 1135, "udp_stream": null, "frame_number": 42022, "timestamp_epoch": "1533965775.393893000" }, { "kind": "http_request", "dst_ip": "103.5.149.72", "fields": { "http.host": "tass.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/js/doublephoto/doublephoto.js?v=1533913284", "http.response_in": "42522", "http.request.method": "GET", "http.request.full_uri": "http://tass.com/js/doublephoto/doublephoto.js?v=1533913284" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-40271272d44431a061db9757", "src_port": 50278, "tcp_stream": 1130, "udp_stream": null, "frame_number": 42049, "timestamp_epoch": "1533965775.438635000" }, { "kind": "http_request", "dst_ip": "103.5.149.72", "fields": { "http.host": "tass.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/js/hammer.min.js?v=1533913284", "http.response_in": "42755", "http.request.method": "GET", "http.request.full_uri": "http://tass.com/js/hammer.min.js?v=1533913284" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-26705969335e9e0bf3c97bed", "src_port": 50279, "tcp_stream": 1131, "udp_stream": null, "frame_number": 42057, "timestamp_epoch": "1533965775.442355000" }, { "kind": "http_request", "dst_ip": "103.5.149.72", "fields": { "http.host": "tass.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/js/zoom/zoomController.js?v=1533913284", "http.response_in": "42975", "http.request.method": "GET", "http.request.full_uri": "http://tass.com/js/zoom/zoomController.js?v=1533913284" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-f0d8dcfd0f20c337ad9a300d", "src_port": 50223, "tcp_stream": 1074, "udp_stream": null, "frame_number": 42204, "timestamp_epoch": "1533965775.813738000" }, { "kind": "http_request", "dst_ip": "103.5.149.72", "fields": { "http.host": "tass.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/js/common/mediaBlocksController.js?v=1533913284", "http.response_in": "42749", "http.request.method": "GET", "http.request.full_uri": "http://tass.com/js/common/mediaBlocksController.js?v=1533913284" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-24a8c8589d730c6b69c0b901", "src_port": 50281, "tcp_stream": 1132, "udp_stream": null, "frame_number": 42230, "timestamp_epoch": "1533965775.861597000" }, { "kind": "http_request", "dst_ip": "103.5.149.72", "fields": { "http.host": "tass.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/js/jquery.cookie.js?v=1533913284", "http.response_in": "42762", "http.request.method": "GET", "http.request.full_uri": "http://tass.com/js/jquery.cookie.js?v=1533913284" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-972ca17f6436cee96259fe05", "src_port": 50221, "tcp_stream": 1073, "udp_stream": null, "frame_number": 42248, "timestamp_epoch": "1533965775.873952000" }, { "kind": "http_request", "dst_ip": "103.5.149.72", "fields": { "http.host": "tass.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/js/highcharts/highcharts.js?v=1533913284", "http.response_in": "43271", "http.request.method": "GET", "http.request.full_uri": "http://tass.com/js/highcharts/highcharts.js?v=1533913284" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-c28fb0383fc6747a3dc9b028", "src_port": 50218, "tcp_stream": 1070, "udp_stream": null, "frame_number": 42266, "timestamp_epoch": "1533965775.928489000" }, { "kind": "http_request", "dst_ip": "103.5.149.72", "fields": { "http.host": "tass.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/js/adfox.asyn.code.scroll.js", "http.response_in": "42849", "http.request.method": "GET", "http.request.full_uri": "http://tass.com/js/adfox.asyn.code.scroll.js" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-e5cd9c62e7563d756dee627e", "src_port": 50222, "tcp_stream": 1075, "udp_stream": null, "frame_number": 42289, "timestamp_epoch": "1533965775.986796000" }, { "kind": "http_request", "dst_ip": "103.5.149.72", "fields": { "http.host": "tass.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/js/mainSliderWidget.js", "http.response_in": "42903", "http.request.method": "GET", "http.request.full_uri": "http://tass.com/js/mainSliderWidget.js" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-434270308bcd0a905ecc63ee", "src_port": 50282, "tcp_stream": 1135, "udp_stream": null, "frame_number": 42488, "timestamp_epoch": "1533965776.394706000" }, { "kind": "http_request", "dst_ip": "103.5.149.72", "fields": { "http.host": "tass.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/assets/bfcd510f/libs.min.js?v=1533913284", "http.response_in": "43539", "http.request.method": "GET", "http.request.full_uri": "http://tass.com/assets/bfcd510f/libs.min.js?v=1533913284" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-1bccf830a3a659f9979e37dc", "src_port": 50278, "tcp_stream": 1130, "udp_stream": null, "frame_number": 42524, "timestamp_epoch": "1533965776.483672000" }, { "kind": "http_request", "dst_ip": "103.5.149.72", "fields": { "http.host": "tass.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/assets/287c4a4b/itar.min.js?v=1533913284", "http.response_in": "43580", "http.request.method": "GET", "http.request.full_uri": "http://tass.com/assets/287c4a4b/itar.min.js?v=1533913284" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-eca2128b7cee93c4f8b894e5", "src_port": 50220, "tcp_stream": 1072, "udp_stream": null, "frame_number": 42696, "timestamp_epoch": "1533965776.932397000" }, { "kind": "http_request", "dst_ip": "103.5.149.72", "fields": { "http.host": "tass.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/images/newStyle/normal/logo/logo_web_eng.png", "http.response_in": "43001", "http.request.method": "GET", "http.request.full_uri": "http://tass.com/images/newStyle/normal/logo/logo_web_eng.png" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-600c3e3ae997fe0a47fa36f5", "src_port": 50283, "tcp_stream": 1134, "udp_stream": null, "frame_number": 42704, "timestamp_epoch": "1533965776.948661000" }, { "kind": "http_request", "dst_ip": "103.5.149.72", "fields": { "http.host": "tass.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/i/loader_animation.gif", "http.response_in": "43007", "http.request.method": "GET", "http.request.full_uri": "http://tass.com/i/loader_animation.gif" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-2d7346e6b75b14ef4289983b", "src_port": 50281, "tcp_stream": 1132, "udp_stream": null, "frame_number": 42753, "timestamp_epoch": "1533965777.082941000" }, { "kind": "http_request", "dst_ip": "103.5.149.72", "fields": { "http.host": "tass.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/i/loader_animation_lenta_new.gif", "http.response_in": "43041", "http.request.method": "GET", "http.request.full_uri": "http://tass.com/i/loader_animation_lenta_new.gif" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-08b536c3072d7618432b13c4", "src_port": 50279, "tcp_stream": 1131, "udp_stream": null, "frame_number": 42759, "timestamp_epoch": "1533965777.083931000" }, { "kind": "http_request", "dst_ip": "103.5.149.72", "fields": { "http.host": "tass.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/images/newStyle/normal/logo/logo_footer_print_eng.png", "http.response_in": "43048", "http.request.method": "GET", "http.request.full_uri": "http://tass.com/images/newStyle/normal/logo/logo_footer_print_eng.png" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-f7f8f62c735d13c8e6e4da69", "src_port": 50221, "tcp_stream": 1073, "udp_stream": null, "frame_number": 42766, "timestamp_epoch": "1533965777.098461000" }, { "kind": "http_request", "dst_ip": "185.68.93.18", "fields": { "http.host": "185.68.93.18", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)", "http.request.uri": "/dot.php", "http.response_in": "43398", "http.content_length": "72", "http.request.method": "POST", "http.request.full_uri": "http://185.68.93.18/dot.php" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-8d21e528bad43d950f224a49", "src_port": 50284, "tcp_stream": 1136, "udp_stream": null, "body_sha256": "aa81dc4dfa58c4040d0e5c08813a963dd3e8a8a16fd1c76ed758e703b62761f2", "frame_number": 43076, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 72, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 72, "timestamp_epoch": "1533965777.816386000" }, { "kind": "http_request", "dst_ip": "103.5.149.72", "fields": { "http.host": "tass.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/fonts/icontass/icontass.eot?", "http.response_in": "44328", "http.request.method": "GET", "http.request.full_uri": "http://tass.com/fonts/icontass/icontass.eot?" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-b21ef640c8738d3c668102ae", "src_port": 50219, "tcp_stream": 1071, "udp_stream": null, "frame_number": 43657, "timestamp_epoch": "1533965783.078816000" }, { "kind": "http_request", "dst_ip": "216.58.194.162", "fields": { "http.host": "www.googletagservices.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/tag/js/gpt.js", "http.response_in": "43720", "http.request.method": "GET", "http.request.full_uri": "http://www.googletagservices.com/tag/js/gpt.js" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-6325db766c0c4f4f51151e36", "src_port": 50287, "tcp_stream": 1139, "udp_stream": null, "frame_number": 43669, "timestamp_epoch": "1533965783.098093000" }, { "kind": "http_request", "dst_ip": "74.119.117.100", "fields": { "http.host": "rtax.criteo.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/delivery/rta/rta.js?netId=5895&cookieName=crtg_rta&rnd=74932308510&varName=crtg_content", "http.response_in": "43740", "http.request.method": "GET", "http.request.full_uri": "http://rtax.criteo.com/delivery/rta/rta.js?netId=5895&cookieName=crtg_rta&rnd=74932308510&varName=crtg_content" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-a6e2e99cb53f23310e81f6aa", "src_port": 50294, "tcp_stream": 1146, "udp_stream": null, "frame_number": 43682, "timestamp_epoch": "1533965783.173153000" }, { "kind": "http_request", "dst_ip": "216.58.192.8", "fields": { "http.host": "www.googletagmanager.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/gtm.js?id=GTM-KX9ZXT", "http.response_in": "44010", "http.request.method": "GET", "http.request.full_uri": "http://www.googletagmanager.com/gtm.js?id=GTM-KX9ZXT" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-23c9c7c7de6963c6cf6e0570", "src_port": 50295, "tcp_stream": 1147, "udp_stream": null, "frame_number": 43686, "timestamp_epoch": "1533965783.173455000" }, { "kind": "http_request", "dst_ip": "157.240.11.22", "fields": { "http.host": "connect.facebook.net", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/en_US/sdk.js", "http.response_in": "43966", "http.request.method": "GET", "http.request.full_uri": "http://connect.facebook.net/en_US/sdk.js" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-477e6374a8b0d149057b4c34", "src_port": 50299, "tcp_stream": 1151, "udp_stream": null, "frame_number": 43690, "timestamp_epoch": "1533965783.175343000" }, { "kind": "http_request", "dst_ip": "192.229.163.25", "fields": { "http.host": "platform.twitter.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/widgets.js", "http.response_in": "43810", "http.request.method": "GET", "http.request.full_uri": "http://platform.twitter.com/widgets.js" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-809d15e92363d0325e605136", "src_port": 50298, "tcp_stream": 1150, "udp_stream": null, "frame_number": 43698, "timestamp_epoch": "1533965783.176462000" }, { "kind": "http_request", "dst_ip": "103.5.149.72", "fields": { "http.host": "tass.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/images/newStyle/normal/social/fb_top_norma_1.png", "http.response_in": "43849", "http.request.method": "GET", "http.request.full_uri": "http://tass.com/images/newStyle/normal/social/fb_top_norma_1.png" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-135333fb06a9e8f6cf44ecce", "src_port": 50220, "tcp_stream": 1072, "udp_stream": null, "frame_number": 43702, "timestamp_epoch": "1533965783.194825000" }, { "kind": "http_request", "dst_ip": "103.5.149.72", "fields": { "http.host": "tass.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/images/newStyle/normal/social/tw_top_norma_1.png", "http.response_in": "43847", "http.request.method": "GET", "http.request.full_uri": "http://tass.com/images/newStyle/normal/social/tw_top_norma_1.png" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-663dd66b14715cc3ecd8a568", "src_port": 50278, "tcp_stream": 1130, "udp_stream": null, "frame_number": 43704, "timestamp_epoch": "1533965783.195053000" }, { "kind": "http_request", "dst_ip": "103.5.149.72", "fields": { "http.host": "tass.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/images/newStyle/normal/social/g+_top_norma.png", "http.response_in": "43875", "http.request.method": "GET", "http.request.full_uri": "http://tass.com/images/newStyle/normal/social/g+_top_norma.png" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-4ce20a9f9eedccffede43d27", "src_port": 50218, "tcp_stream": 1070, "udp_stream": null, "frame_number": 43706, "timestamp_epoch": "1533965783.195291000" }, { "kind": "http_request", "dst_ip": "103.5.149.72", "fields": { "http.host": "tass.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/images/newStyle/normal/RSS.png", "http.response_in": "43990", "http.request.method": "GET", "http.request.full_uri": "http://tass.com/images/newStyle/normal/RSS.png" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-6702db2ccd71511f33a2845c", "src_port": 50280, "tcp_stream": 1133, "udp_stream": null, "frame_number": 43708, "timestamp_epoch": "1533965783.195452000" }, { "kind": "http_request", "dst_ip": "103.5.149.72", "fields": { "http.host": "tass.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/images/newStyle/normal/ru_en.png", "http.response_in": "43970", "http.request.method": "GET", "http.request.full_uri": "http://tass.com/images/newStyle/normal/ru_en.png" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-d4772954936f932d602193ea", "src_port": 50221, "tcp_stream": 1073, "udp_stream": null, "frame_number": 43710, "timestamp_epoch": "1533965783.196117000" }, { "kind": "http_request", "dst_ip": "194.226.130.228", "fields": { "http.host": "www.tns-counter.ru", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/V13a***R%3E*itartass_com/ru/UTF-8/tmsec=itartass_total/851285090", "http.response_in": "43927", "http.request.method": "GET", "http.request.full_uri": "http://www.tns-counter.ru/V13a***R%3E*itartass_com/ru/UTF-8/tmsec=itartass_total/851285090" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-a27f4ec2608e0dc380d16f1f", "src_port": 50285, "tcp_stream": 1137, "udp_stream": null, "frame_number": 43727, "timestamp_epoch": "1533965783.254353000" }, { "kind": "http_request", "dst_ip": "88.212.196.103", "fields": { "http.host": "counter.yadro.ru", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/hit;TASS_total?r;s1280*768*24;uhttp%3A//tass.com/;0.30934944172652073", "http.response_in": "43956", "http.request.method": "GET", "http.request.full_uri": "http://counter.yadro.ru/hit;TASS_total?r;s1280*768*24;uhttp%3A//tass.com/;0.30934944172652073" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-129c1344fd85a5f1fc9e7d7e", "src_port": 50291, "tcp_stream": 1143, "udp_stream": null, "frame_number": 43744, "timestamp_epoch": "1533965783.328334000" }, { "kind": "http_request", "dst_ip": "88.212.196.103", "fields": { "http.host": "counter.yadro.ru", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/logo;tass.com?44.6", "http.response_in": "43951", "http.request.method": "GET", "http.request.full_uri": "http://counter.yadro.ru/logo;tass.com?44.6" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-afbb9cd968e796772cc8dd99", "src_port": 50292, "tcp_stream": 1144, "udp_stream": null, "frame_number": 43748, "timestamp_epoch": "1533965783.334711000" }, { "kind": "http_request", "dst_ip": "103.5.149.72", "fields": { "http.host": "tass.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/i/mobile-search-header.png", "http.response_in": "44021", "http.request.method": "GET", "http.request.full_uri": "http://tass.com/i/mobile-search-header.png" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-a32d128dc6d2f01f81027159", "src_port": 50278, "tcp_stream": 1130, "udp_stream": null, "frame_number": 43851, "timestamp_epoch": "1533965783.656953000" }, { "kind": "http_request", "dst_ip": "103.5.149.72", "fields": { "http.host": "tass.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/images/newStyle/normal/strelka.png", "http.response_in": "44032", "http.request.method": "GET", "http.request.full_uri": "http://tass.com/images/newStyle/normal/strelka.png" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-d63a26c8f90338d001ee39b0", "src_port": 50220, "tcp_stream": 1072, "udp_stream": null, "frame_number": 43853, "timestamp_epoch": "1533965783.657067000" }, { "kind": "http_request", "dst_ip": "103.5.149.72", "fields": { "http.host": "tass.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/i/up-button.png", "http.response_in": "44070", "http.request.method": "GET", "http.request.full_uri": "http://tass.com/i/up-button.png" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-469260d6e963cdca11243b45", "src_port": 50218, "tcp_stream": 1070, "udp_stream": null, "frame_number": 43877, "timestamp_epoch": "1533965783.726362000" }, { "kind": "http_request", "dst_ip": "194.226.130.228", "fields": { "http.host": "www.tns-counter.ru", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/V13b***R%3E*itartass_com/ru/UTF-8/tmsec=itartass_total/851285090", "http.response_in": "44151", "http.request.method": "GET", "http.request.full_uri": "http://www.tns-counter.ru/V13b***R%3E*itartass_com/ru/UTF-8/tmsec=itartass_total/851285090" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-07848a53d227dee9ce06e1cf", "src_port": 50285, "tcp_stream": 1137, "udp_stream": null, "frame_number": 43933, "timestamp_epoch": "1533965783.795213000" }, { "kind": "http_request", "dst_ip": "103.5.149.72", "fields": { "http.host": "tass.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/i/b-search-icon.png", "http.response_in": "44170", "http.request.method": "GET", "http.request.full_uri": "http://tass.com/i/b-search-icon.png" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-9bb17cabc15323e695e90981", "src_port": 50221, "tcp_stream": 1073, "udp_stream": null, "frame_number": 43972, "timestamp_epoch": "1533965783.863922000" }, { "kind": "http_request", "dst_ip": "103.5.149.72", "fields": { "http.host": "tass.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/images/newStyle/normal/lenta.png", "http.response_in": "44181", "http.request.method": "GET", "http.request.full_uri": "http://tass.com/images/newStyle/normal/lenta.png" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-9d5987d39d6b9d12ff8967f1", "src_port": 50280, "tcp_stream": 1133, "udp_stream": null, "frame_number": 43996, "timestamp_epoch": "1533965783.906069000" }, { "kind": "http_request", "dst_ip": "103.5.149.72", "fields": { "http.host": "tass.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/images/newStyle/normal/icon_rybriki_normal.png", "http.response_in": "44210", "http.request.method": "GET", "http.request.full_uri": "http://tass.com/images/newStyle/normal/icon_rybriki_normal.png" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-001ede4016d7af198c182196", "src_port": 50278, "tcp_stream": 1130, "udp_stream": null, "frame_number": 44024, "timestamp_epoch": "1533965783.984760000" }, { "kind": "http_request", "dst_ip": "103.5.149.72", "fields": { "http.host": "tass.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/images/newStyle/normal/foto.png", "http.response_in": "44212", "http.request.method": "GET", "http.request.full_uri": "http://tass.com/images/newStyle/normal/foto.png" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-5ca66c6fe6a5196ca6c6d493", "src_port": 50220, "tcp_stream": 1072, "udp_stream": null, "frame_number": 44034, "timestamp_epoch": "1533965784.001309000" }, { "kind": "http_request", "dst_ip": "103.5.149.72", "fields": { "http.host": "tass.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/images/newStyle/normal/logo/logo_futter_web_eng.png", "http.response_in": "44237", "http.request.method": "GET", "http.request.full_uri": "http://tass.com/images/newStyle/normal/logo/logo_futter_web_eng.png" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-c26e60709f426f9512edf490", "src_port": 50218, "tcp_stream": 1070, "udp_stream": null, "frame_number": 44072, "timestamp_epoch": "1533965784.033493000" }, { "kind": "http_request", "dst_ip": "103.5.149.72", "fields": { "http.host": "tass.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/images/newStyle/normal/social/rss_futter_norma_1.png", "http.response_in": "44283", "http.request.method": "GET", "http.request.full_uri": "http://tass.com/images/newStyle/normal/social/rss_futter_norma_1.png" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-c851bdd2538b6cd953ce2a53", "src_port": 50221, "tcp_stream": 1073, "udp_stream": null, "frame_number": 44172, "timestamp_epoch": "1533965784.386643000" }, { "kind": "http_request", "dst_ip": "103.5.149.72", "fields": { "http.host": "tass.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/images/appstore.svg", "http.response_in": "44312", "http.request.method": "GET", "http.request.full_uri": "http://tass.com/images/appstore.svg" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-e8d0d7ad6fa43b3682617dab", "src_port": 50280, "tcp_stream": 1133, "udp_stream": null, "frame_number": 44183, "timestamp_epoch": "1533965784.398106000" }, { "kind": "http_request", "dst_ip": "103.5.149.72", "fields": { "http.host": "tass.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/images/newStyle/normal/social/fb_futter_norma_1.png", "http.response_in": "44409", "http.request.method": "GET", "http.request.full_uri": "http://tass.com/images/newStyle/normal/social/fb_futter_norma_1.png" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-dc2d5349f317270d1a448fd1", "src_port": 50278, "tcp_stream": 1130, "udp_stream": null, "frame_number": 44220, "timestamp_epoch": "1533965784.463050000" }, { "kind": "http_request", "dst_ip": "103.5.149.72", "fields": { "http.host": "tass.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/images/newStyle/normal/social/tw_futter_norma_1.png", "http.response_in": "44410", "http.request.method": "GET", "http.request.full_uri": "http://tass.com/images/newStyle/normal/social/tw_futter_norma_1.png" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-7646b7b87096346eb80f2220", "src_port": 50220, "tcp_stream": 1072, "udp_stream": null, "frame_number": 44226, "timestamp_epoch": "1533965784.464167000" }, { "kind": "http_request", "dst_ip": "103.5.149.72", "fields": { "http.host": "tass.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/site/getCurrencyDynamics?currency=USD", "http.response_in": "44424", "http.request.method": "GET", "http.request.full_uri": "http://tass.com/site/getCurrencyDynamics?currency=USD" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-757267fe640387801ed95cc5", "src_port": 50218, "tcp_stream": 1070, "udp_stream": null, "frame_number": 44239, "timestamp_epoch": "1533965784.480473000" }, { "kind": "http_request", "dst_ip": "216.58.192.1", "fields": { "http.host": "tpc.googlesyndication.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/safeframe/1-0-29/html/container.html", "http.response_in": "44415", "http.request.method": "GET", "http.request.full_uri": "http://tpc.googlesyndication.com/safeframe/1-0-29/html/container.html" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-795187ab0d7c6a2cbcc59018", "src_port": 50313, "tcp_stream": 1165, "udp_stream": null, "frame_number": 44277, "timestamp_epoch": "1533965784.655535000" }, { "kind": "http_request", "dst_ip": "103.5.149.72", "fields": { "http.host": "tass.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/api/news/lenta?limit=50", "http.response_in": "44488", "http.request.method": "GET", "http.request.full_uri": "http://tass.com/api/news/lenta?limit=50" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-3c400ce55135e38333685422", "src_port": 50221, "tcp_stream": 1073, "udp_stream": null, "frame_number": 44285, "timestamp_epoch": "1533965784.710245000" }, { "kind": "http_request", "dst_ip": "216.58.192.1", "fields": { "http.host": "tpc.googlesyndication.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/safeframe/1-0-29/html/container.html", "http.response_in": "44696", "http.request.method": "GET", "http.request.full_uri": "http://tpc.googlesyndication.com/safeframe/1-0-29/html/container.html" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-d1c30ac1fe743987096bc65d", "src_port": 50314, "tcp_stream": 1166, "udp_stream": null, "frame_number": 44398, "timestamp_epoch": "1533965785.099585000" }, { "kind": "http_request", "dst_ip": "216.58.194.162", "fields": { "http.host": "pagead2.googlesyndication.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/pagead/osd.js", "http.response_in": "45009", "http.request.method": "GET", "http.request.full_uri": "http://pagead2.googlesyndication.com/pagead/osd.js" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-28fa9472926f1e5dd8e61c48", "src_port": 50335, "tcp_stream": 1187, "udp_stream": null, "frame_number": 44800, "timestamp_epoch": "1533965786.356599000" }, { "kind": "http_request", "dst_ip": "216.58.192.10", "fields": { "http.host": "fonts.googleapis.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/css?family=Roboto:300", "http.response_in": "44998", "http.request.method": "GET", "http.request.full_uri": "http://fonts.googleapis.com/css?family=Roboto:300" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-1368a4e44b4f160315f30d14", "src_port": 50338, "tcp_stream": 1190, "udp_stream": null, "frame_number": 44836, "timestamp_epoch": "1533965786.409477000" }, { "kind": "http_request", "dst_ip": "216.58.192.10", "fields": { "http.host": "fonts.googleapis.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/css?family=Roboto:700", "http.response_in": "45011", "http.request.method": "GET", "http.request.full_uri": "http://fonts.googleapis.com/css?family=Roboto:700" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-e1905ba1f82ca4826138d574", "src_port": 50339, "tcp_stream": 1191, "udp_stream": null, "frame_number": 44840, "timestamp_epoch": "1533965786.410078000" }, { "kind": "http_request", "dst_ip": "103.5.149.77", "fields": { "http.host": "comet.tass.ru:8080", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/poll?channels=en_section_politics,en_section_world,en_section_economy,en_section_defense,en_section_science,en_section_society,en_section_sport,en_section_pressreview,en_section_emergencies&cometsid=--b28c704f1435e1a5ac1a753810d40a57", "http.response_in": "45176", "http.request.method": "GET", "http.request.full_uri": "http://comet.tass.ru:8080/poll?channels=en_section_politics,en_section_world,en_section_economy,en_section_defense,en_section_science,en_section_society,en_section_sport,en_section_pressreview,en_section_emergencies&cometsid=--b28c704f1435e1a5ac1a753810d40a57" }, "src_ip": "192.168.1.95", "dst_port": 8080, "event_id": "evt-843991bad4a62baaa42fb8b8", "src_port": 50334, "tcp_stream": 1186, "udp_stream": null, "frame_number": 44900, "timestamp_epoch": "1533965786.473054000" }, { "kind": "http_request", "dst_ip": "216.58.192.3", "fields": { "http.host": "fonts.gstatic.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/s/roboto/v18/KFOlCnqEu92Fr1MmWUlfBBc-.woff", "http.response_in": "45737", "http.request.method": "GET", "http.request.full_uri": "http://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmWUlfBBc-.woff" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-11d13ce23e22a18de88caaa3", "src_port": 50346, "tcp_stream": 1198, "udp_stream": null, "frame_number": 45320, "timestamp_epoch": "1533965787.350306000" }, { "kind": "http_request", "dst_ip": "216.58.192.3", "fields": { "http.host": "fonts.gstatic.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/s/roboto/v18/KFOlCnqEu92Fr1MmSU5fBBc-.woff", "http.response_in": "45736", "http.request.method": "GET", "http.request.full_uri": "http://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmSU5fBBc-.woff" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-9f4a1226c41f33a9d2f47e08", "src_port": 50345, "tcp_stream": 1197, "udp_stream": null, "frame_number": 45321, "timestamp_epoch": "1533965787.350307000" }, { "kind": "http_request", "dst_ip": "216.58.192.4", "fields": { "http.host": "www.google.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/ads/measurement/l?ebcid=ALh7CaQwkG-IqLuL2aDRnK970v9nGK385P_BkWxEG1yaUS4rlUVqUrlgZf-3JS25GWjS571y2n1JUt5kBztsnVFTQN5y-yC8Tw", "http.response_in": "45959", "http.request.method": "GET", "http.request.full_uri": "http://www.google.com/ads/measurement/l?ebcid=ALh7CaQwkG-IqLuL2aDRnK970v9nGK385P_BkWxEG1yaUS4rlUVqUrlgZf-3JS25GWjS571y2n1JUt5kBztsnVFTQN5y-yC8Tw" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-ed09f7b2cbb0de46c1f71e39", "src_port": 50356, "tcp_stream": 1208, "udp_stream": null, "frame_number": 45898, "timestamp_epoch": "1533965789.194892000" }, { "kind": "http_request", "dst_ip": "103.5.149.72", "fields": { "http.host": "tass.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/favicon.ico?225", "http.response_in": "46312", "http.request.method": "GET", "http.request.full_uri": "http://tass.com/favicon.ico?225" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-aa65d567bbd935f49fc19448", "src_port": 50221, "tcp_stream": 1073, "udp_stream": null, "frame_number": 46258, "timestamp_epoch": "1533965790.166964000" }, { "kind": "http_request", "dst_ip": "103.5.149.72", "fields": { "http.host": "tass.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/economy/1016847", "http.response_in": "46359", "http.request.method": "GET", "http.request.full_uri": "http://tass.com/economy/1016847" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-025002c35af7d701920aed85", "src_port": 50218, "tcp_stream": 1070, "udp_stream": null, "frame_number": 46268, "timestamp_epoch": "1533965790.405757000" }, { "kind": "http_request", "dst_ip": "103.5.149.72", "fields": { "http.host": "tass.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/css/doublephoto/css.css?v=1533913284", "http.response_in": "46418", "http.request.method": "GET", "http.request.full_uri": "http://tass.com/css/doublephoto/css.css?v=1533913284" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-7746d0e937855680b450ef52", "src_port": 50221, "tcp_stream": 1073, "udp_stream": null, "frame_number": 46341, "timestamp_epoch": "1533965790.968196000" }, { "kind": "http_request", "dst_ip": "103.5.149.72", "fields": { "http.host": "tass.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/assets/cb2c53b3/audioWidget.min.css?v=1533913284", "http.response_in": "46425", "http.request.method": "GET", "http.request.full_uri": "http://tass.com/assets/cb2c53b3/audioWidget.min.css?v=1533913284" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-d8b8bec8c64359e720010583", "src_port": 50278, "tcp_stream": 1130, "udp_stream": null, "frame_number": 46343, "timestamp_epoch": "1533965790.968379000" }, { "kind": "http_request", "dst_ip": "103.5.149.72", "fields": { "http.host": "tass.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/assets/7ce9e0a9/videoWidget.min.css?v=1533913284", "http.response_in": "46433", "http.request.method": "GET", "http.request.full_uri": "http://tass.com/assets/7ce9e0a9/videoWidget.min.css?v=1533913284" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-5499e6eb1c4735f4e71e1d32", "src_port": 50220, "tcp_stream": 1072, "udp_stream": null, "frame_number": 46345, "timestamp_epoch": "1533965790.968776000" }, { "kind": "http_request", "dst_ip": "103.5.149.72", "fields": { "http.host": "tass.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/assets/1d1a4a07/socials.min.css?v=1533913284", "http.response_in": "46439", "http.request.method": "GET", "http.request.full_uri": "http://tass.com/assets/1d1a4a07/socials.min.css?v=1533913284" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-81a8f2dae70679ef632eb5d6", "src_port": 50219, "tcp_stream": 1071, "udp_stream": null, "frame_number": 46347, "timestamp_epoch": "1533965790.969108000" }, { "kind": "http_request", "dst_ip": "103.5.149.72", "fields": { "http.host": "tass.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/assets/88a00814/material.min.css?v=1533913284", "http.response_in": "46463", "http.request.method": "GET", "http.request.full_uri": "http://tass.com/assets/88a00814/material.min.css?v=1533913284" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-7edb07dd49e7dab0268c73a3", "src_port": 50280, "tcp_stream": 1133, "udp_stream": null, "frame_number": 46355, "timestamp_epoch": "1533965790.976473000" }, { "kind": "http_request", "dst_ip": "103.5.149.72", "fields": { "http.host": "tass.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/assets/735f4b6e/media-widget.min.css?v=1533913284", "http.response_in": "46475", "http.request.method": "GET", "http.request.full_uri": "http://tass.com/assets/735f4b6e/media-widget.min.css?v=1533913284" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-cfacf400d636fab66adc382e", "src_port": 50218, "tcp_stream": 1070, "udp_stream": null, "frame_number": 46361, "timestamp_epoch": "1533965790.990826000" }, { "kind": "http_request", "dst_ip": "103.5.149.72", "fields": { "http.host": "tass.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/assets/8b982e6a/infographics-widget.min.css?v=1533913284", "http.response_in": "46572", "http.request.method": "GET", "http.request.full_uri": "http://tass.com/assets/8b982e6a/infographics-widget.min.css?v=1533913284" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-ce383e340f72cc30d2adb791", "src_port": 50221, "tcp_stream": 1073, "udp_stream": null, "frame_number": 46420, "timestamp_epoch": "1533965791.270108000" }, { "kind": "http_request", "dst_ip": "103.5.149.72", "fields": { "http.host": "tass.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/js/common/textBroadcastController.js?v=1533913284", "http.response_in": "46593", "http.request.method": "GET", "http.request.full_uri": "http://tass.com/js/common/textBroadcastController.js?v=1533913284" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-ee2bbba8f6fe6a98cb191f7d", "src_port": 50278, "tcp_stream": 1130, "udp_stream": null, "frame_number": 46427, "timestamp_epoch": "1533965791.295458000" }, { "kind": "http_request", "dst_ip": "103.5.149.72", "fields": { "http.host": "tass.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/js/jwplayer7/jwplayer.js", "http.request.method": "GET", "http.request.full_uri": "http://tass.com/js/jwplayer7/jwplayer.js" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-90cff9a32bf495b4574ae141", "src_port": 50220, "tcp_stream": 1072, "udp_stream": null, "frame_number": 46437, "timestamp_epoch": "1533965791.350526000" }, { "kind": "http_request", "dst_ip": "103.5.149.72", "fields": { "http.host": "tass.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/js/audioWidget.js", "http.response_in": "46630", "http.request.method": "GET", "http.request.full_uri": "http://tass.com/js/audioWidget.js" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-7449bdb852e7e1242ac4615f", "src_port": 50219, "tcp_stream": 1071, "udp_stream": null, "frame_number": 46441, "timestamp_epoch": "1533965791.370352000" }, { "kind": "http_request", "dst_ip": "103.5.149.72", "fields": { "http.host": "tass.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/js/videoWidget.js", "http.response_in": "46683", "http.request.method": "GET", "http.request.full_uri": "http://tass.com/js/videoWidget.js" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-12e0b3deab1a090a3ca74050", "src_port": 50280, "tcp_stream": 1133, "udp_stream": null, "frame_number": 46465, "timestamp_epoch": "1533965791.437407000" }, { "kind": "http_request", "dst_ip": "103.5.149.72", "fields": { "http.host": "tass.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/js/social/socialDirective.js", "http.response_in": "46735", "http.request.method": "GET", "http.request.full_uri": "http://tass.com/js/social/socialDirective.js" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-f090ad43bd88126fb04c9ae4", "src_port": 50218, "tcp_stream": 1070, "udp_stream": null, "frame_number": 46484, "timestamp_epoch": "1533965791.472841000" }, { "kind": "http_request", "dst_ip": "185.68.93.18", "fields": { "http.host": "185.68.93.18", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)", "http.request.uri": "/dot.php", "http.response_in": "46902", "http.content_length": "72", "http.request.method": "POST", "http.request.full_uri": "http://185.68.93.18/dot.php" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-1a848b9c4d487724e4928839", "src_port": 50376, "tcp_stream": 1228, "udp_stream": null, "body_sha256": "aa81dc4dfa58c4040d0e5c08813a963dd3e8a8a16fd1c76ed758e703b62761f2", "frame_number": 46895, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 72, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 72, "timestamp_epoch": "1533965794.146966000" }, { "kind": "http_request", "dst_ip": "185.68.93.18", "fields": { "http.host": "185.68.93.18", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)", "http.request.uri": "/dot.php", "http.response_in": "46981", "http.content_length": "72", "http.request.method": "POST", "http.request.full_uri": "http://185.68.93.18/dot.php" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-248374ae29053cda93b3e141", "src_port": 50379, "tcp_stream": 1231, "udp_stream": null, "body_sha256": "aa81dc4dfa58c4040d0e5c08813a963dd3e8a8a16fd1c76ed758e703b62761f2", "frame_number": 46979, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 72, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 72, "timestamp_epoch": "1533965810.211920000" }, { "kind": "http_request", "dst_ip": "185.68.93.18", "fields": { "http.host": "185.68.93.18", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)", "http.request.uri": "/dot.php", "http.response_in": "47002", "http.content_length": "72", "http.request.method": "POST", "http.request.full_uri": "http://185.68.93.18/dot.php" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-0c06e2b78296eebf35539539", "src_port": 50380, "tcp_stream": 1232, "udp_stream": null, "body_sha256": "aa81dc4dfa58c4040d0e5c08813a963dd3e8a8a16fd1c76ed758e703b62761f2", "frame_number": 47000, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 72, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 72, "timestamp_epoch": "1533965826.339697000" }, { "kind": "http_request", "dst_ip": "185.68.93.18", "fields": { "http.host": "185.68.93.18", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)", "http.request.uri": "/dot.php", "http.response_in": "47022", "http.content_length": "72", "http.request.method": "POST", "http.request.full_uri": "http://185.68.93.18/dot.php" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-a7c59d8984cb386448662423", "src_port": 50381, "tcp_stream": 1233, "udp_stream": null, "body_sha256": "aa81dc4dfa58c4040d0e5c08813a963dd3e8a8a16fd1c76ed758e703b62761f2", "frame_number": 47020, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 72, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 72, "timestamp_epoch": "1533965842.507089000" }, { "kind": "http_request", "dst_ip": "185.68.93.18", "fields": { "http.host": "185.68.93.18", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)", "http.request.uri": "/dot.php", "http.response_in": "47115", "http.content_length": "72", "http.request.method": "POST", "http.request.full_uri": "http://185.68.93.18/dot.php" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-52d1e1a4bfb996df89e83f1f", "src_port": 50382, "tcp_stream": 1234, "udp_stream": null, "body_sha256": "aa81dc4dfa58c4040d0e5c08813a963dd3e8a8a16fd1c76ed758e703b62761f2", "frame_number": 47112, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 72, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 72, "timestamp_epoch": "1533965858.482440000" }, { "kind": "http_request", "dst_ip": "185.68.93.18", "fields": { "http.host": "185.68.93.18", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)", "http.request.uri": "/dot.php", "http.response_in": "47142", "http.content_length": "72", "http.request.method": "POST", "http.request.full_uri": "http://185.68.93.18/dot.php" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-c9656b2251e21dd88fb00c7b", "src_port": 50383, "tcp_stream": 1235, "udp_stream": null, "body_sha256": "aa81dc4dfa58c4040d0e5c08813a963dd3e8a8a16fd1c76ed758e703b62761f2", "frame_number": 47140, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 72, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 72, "timestamp_epoch": "1533965874.474111000" }, { "kind": "http_request", "dst_ip": "185.68.93.18", "fields": { "http.host": "185.68.93.18", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)", "http.request.uri": "/dot.php", "http.response_in": "47155", "http.content_length": "72", "http.request.method": "POST", "http.request.full_uri": "http://185.68.93.18/dot.php" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-a2f43b66ce916db93e5022bf", "src_port": 50384, "tcp_stream": 1236, "udp_stream": null, "body_sha256": "aa81dc4dfa58c4040d0e5c08813a963dd3e8a8a16fd1c76ed758e703b62761f2", "frame_number": 47152, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 72, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 72, "timestamp_epoch": "1533965890.554906000" }, { "kind": "http_request", "dst_ip": "185.68.93.18", "fields": { "http.host": "185.68.93.18", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)", "http.request.uri": "/dot.php", "http.response_in": "47176", "http.content_length": "72", "http.request.method": "POST", "http.request.full_uri": "http://185.68.93.18/dot.php" }, "src_ip": "192.168.1.95", "dst_port": 80, "event_id": "evt-663c8615cca2676afbb85c71", "src_port": 50385, "tcp_stream": 1237, "udp_stream": null, "body_sha256": "aa81dc4dfa58c4040d0e5c08813a963dd3e8a8a16fd1c76ed758e703b62761f2", "frame_number": 47174, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 72, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 72, "timestamp_epoch": "1533965906.527374000" } ], "http_response": [ { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "385", "http.content_type": "text/plain", "http.response.code": "200", "http.content_length": "14" }, "src_ip": "198.70.71.161", "dst_port": 49183, "event_id": "evt-c678b3ee5c6af9b23d48b55a", "src_port": 80, "tcp_stream": 26, "udp_stream": null, "body_sha256": "6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012", "frame_number": 387, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 14, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 14, "timestamp_epoch": "1533964519.601102000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "4350", "http.content_type": "application/x-x509-ca-cert", "http.response.code": "200", "http.content_length": "867" }, "src_ip": "198.70.71.144", "dst_port": 49260, "event_id": "evt-a1a9e83e0e4731c77d042c39", "src_port": 80, "tcp_stream": 103, "udp_stream": null, "body_sha256": "cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b", "frame_number": 4385, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 867, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 867, "timestamp_epoch": "1533964554.388744000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "4331", "http.content_type": "application/x-x509-ca-cert", "http.response.code": "200", "http.content_length": "867" }, "src_ip": "198.70.71.144", "dst_port": 49261, "event_id": "evt-b2390b15ac0e1d420875915c", "src_port": 80, "tcp_stream": 104, "udp_stream": null, "body_sha256": "cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b", "frame_number": 4388, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 867, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 867, "timestamp_epoch": "1533964554.389450000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "5383", "http.content_type": "application/pkix-cert", "http.response.code": "200", "http.content_length": "956" }, "src_ip": "23.43.176.205", "dst_port": 49284, "event_id": "evt-450b244d30ad66651a446aac", "src_port": 80, "tcp_stream": 127, "udp_stream": null, "body_sha256": "f1c1b50ae5a20dd8030ec9f6bc24823dd367b5255759b4e71b61fce9f7375d73", "frame_number": 5394, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 956, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 956, "timestamp_epoch": "1533964556.542428000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "5387", "http.content_type": "application/pkix-cert", "http.response.code": "200", "http.content_length": "956" }, "src_ip": "23.43.176.205", "dst_port": 49285, "event_id": "evt-5eee72919b54ceb15519c0a4", "src_port": 80, "tcp_stream": 128, "udp_stream": null, "body_sha256": "f1c1b50ae5a20dd8030ec9f6bc24823dd367b5255759b4e71b61fce9f7375d73", "frame_number": 5408, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 956, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 956, "timestamp_epoch": "1533964556.565537000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "6267", "http.content_type": "application/pkix-cert", "http.response.code": "200", "http.content_length": "1302" }, "src_ip": "13.33.78.186", "dst_port": 49315, "event_id": "evt-d1f1f6cc99468e091303ae77", "src_port": 80, "tcp_stream": 158, "udp_stream": null, "body_sha256": "d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb", "frame_number": 6283, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 1302, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 1302, "timestamp_epoch": "1533964560.336183000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "6271", "http.content_type": "application/pkix-cert", "http.response.code": "200", "http.content_length": "1302" }, "src_ip": "13.33.78.186", "dst_port": 49316, "event_id": "evt-e488bd6c38856944de7a2616", "src_port": 80, "tcp_stream": 159, "udp_stream": null, "body_sha256": "d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb", "frame_number": 6292, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 1302, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 1302, "timestamp_epoch": "1533964560.378443000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "7263", "http.content_type": "application/x-rar-compressed", "http.response.code": "200", "http.content_length": "154" }, "src_ip": "149.129.222.112", "dst_port": 49334, "event_id": "evt-e4b7d02778bfc2f78db034d2", "src_port": 80, "tcp_stream": 178, "udp_stream": null, "body_sha256": "b908d9b1001d0a39ba92501c086b1c25b05b171eeda035ae9f3e129d2776a314", "frame_number": 7266, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 154, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 154, "timestamp_epoch": "1533964851.215554000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "7277", "http.content_type": "application/zip", "http.response.code": "200", "http.content_length": "299" }, "src_ip": "149.129.222.112", "dst_port": 49335, "event_id": "evt-61dc3ee283ccb8b008537257", "src_port": 80, "tcp_stream": 179, "udp_stream": null, "body_sha256": "c0d599b80025a70004d813d62b587af4f8ae8abd64f514f280b6e4899436623f", "frame_number": 7279, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 299, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 299, "timestamp_epoch": "1533964858.677650000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "7280", "http.content_type": "application/octet-stream", "http.response.code": "200", "http.content_length": "104048" }, "src_ip": "149.129.222.112", "dst_port": 49335, "event_id": "evt-070a6f94c631ed27e54d3432", "src_port": 80, "tcp_stream": 179, "udp_stream": null, "body_sha256": "bc1fc69f9747dc034ece7d9bb795c5e596d9be6ca71efe75c6c0fd18f3cbfbf5", "frame_number": 7325, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 104048, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 104048, "timestamp_epoch": "1533964860.776598000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "8633", "http.content_type": "application/x-pkcs7-mime", "http.response.code": "200", "http.content_length": "893" }, "src_ip": "192.35.177.64", "dst_port": 49374, "event_id": "evt-6e0049edc1f276976b885836", "src_port": 80, "tcp_stream": 218, "udp_stream": null, "body_sha256": "a2ce3a0fa7d2a833d1801e01ec48e35b70d84f3467cc9f8fab370386e13879c7", "frame_number": 8679, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 893, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 893, "timestamp_epoch": "1533964898.647739000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "8637", "http.content_type": "application/x-pkcs7-mime", "http.response.code": "200", "http.content_length": "893" }, "src_ip": "192.35.177.64", "dst_port": 49373, "event_id": "evt-9ccad8ccb709fdb2221c5930", "src_port": 80, "tcp_stream": 217, "udp_stream": null, "body_sha256": "a2ce3a0fa7d2a833d1801e01ec48e35b70d84f3467cc9f8fab370386e13879c7", "frame_number": 8684, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 893, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 893, "timestamp_epoch": "1533964898.648021000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "11487", "http.content_type": "application/x-x509-ca-cert", "http.response.code": "200", "http.content_length": "1400" }, "src_ip": "104.16.90.188", "dst_port": 49452, "event_id": "evt-5f92ec774138faadcebc87ab", "src_port": 80, "tcp_stream": 296, "udp_stream": null, "body_sha256": "4f32d5dc00f715250abcc486511e37f501a899deb3bf7ea8adbbd3aef1c412da", "frame_number": 11594, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 1400, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 1400, "timestamp_epoch": "1533964901.403370000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "11488", "http.content_type": "application/x-x509-ca-cert", "http.response.code": "200", "http.content_length": "1400" }, "src_ip": "104.16.90.188", "dst_port": 49453, "event_id": "evt-c1142a09733d3479e34e85e8", "src_port": 80, "tcp_stream": 297, "udp_stream": null, "body_sha256": "4f32d5dc00f715250abcc486511e37f501a899deb3bf7ea8adbbd3aef1c412da", "frame_number": 11602, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 1400, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 1400, "timestamp_epoch": "1533964901.411585000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "23982", "http.content_type": "application/x-x509-ca-cert", "http.response.code": "200", "http.content_length": "1176" }, "src_ip": "104.16.240.184", "dst_port": 49821, "event_id": "evt-27424558f5f8ed76fc73e2cd", "src_port": 80, "tcp_stream": 665, "udp_stream": null, "body_sha256": "154c433c491929c5ef686e838e323664a00e6a0d822ccc958fb4dab03e49a08f", "frame_number": 24000, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 1176, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 1176, "timestamp_epoch": "1533964998.630407000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "23985", "http.content_type": "application/x-x509-ca-cert", "http.response.code": "200", "http.content_length": "1176" }, "src_ip": "104.16.240.184", "dst_port": 49820, "event_id": "evt-911e7d626fbe0a4fcd25c2f3", "src_port": 80, "tcp_stream": 664, "udp_stream": null, "body_sha256": "154c433c491929c5ef686e838e323664a00e6a0d822ccc958fb4dab03e49a08f", "frame_number": 24005, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 1176, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 1176, "timestamp_epoch": "1533964998.639411000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "28015", "http.content_type": "application/x-x509-ca-cert", "http.response.code": "200", "http.content_length": "914" }, "src_ip": "13.107.4.50", "dst_port": 49929, "event_id": "evt-9c07a9eef1609d8df9572712", "src_port": 80, "tcp_stream": 773, "udp_stream": null, "body_sha256": "cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f", "frame_number": 28032, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 914, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 914, "timestamp_epoch": "1533965036.828176000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "28018", "http.content_type": "application/x-x509-ca-cert", "http.response.code": "200", "http.content_length": "914" }, "src_ip": "13.107.4.50", "dst_port": 49930, "event_id": "evt-345e5c199b5215e08024d932", "src_port": 80, "tcp_stream": 774, "udp_stream": null, "body_sha256": "cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f", "frame_number": 28033, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 914, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 914, "timestamp_epoch": "1533965036.858021000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "28026", "http.content_type": "application/x-x509-ca-cert", "http.response.code": "200", "http.content_length": "914" }, "src_ip": "13.107.4.50", "dst_port": 49931, "event_id": "evt-359afe19097e9dad20ab4ade", "src_port": 80, "tcp_stream": 775, "udp_stream": null, "body_sha256": "cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f", "frame_number": 28036, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 914, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 914, "timestamp_epoch": "1533965036.883276000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "28030", "http.content_type": "application/x-x509-ca-cert", "http.response.code": "200", "http.content_length": "914" }, "src_ip": "13.107.4.50", "dst_port": 49932, "event_id": "evt-f5175e3731a5fd4accab012c", "src_port": 80, "tcp_stream": 776, "udp_stream": null, "body_sha256": "cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f", "frame_number": 28042, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 914, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 914, "timestamp_epoch": "1533965036.950542000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "39486", "http.content_type": "text/plain", "http.response.code": "200", "http.content_length": "18" }, "src_ip": "205.185.216.42", "dst_port": 50183, "event_id": "evt-ea502107364a2806e5f9d85f", "src_port": 80, "tcp_stream": 1034, "udp_stream": null, "body_sha256": "b3719e3eda456a7457adfe13e6eed36fcef0901b0c31c22cc8ff48629ce8dcee", "frame_number": 39491, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 18, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 18, "timestamp_epoch": "1533965401.249068000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "39496", "http.content_type": "application/vnd.ms-cab-compressed", "http.response.code": "200", "http.content_length": "54153" }, "src_ip": "205.185.216.42", "dst_port": 50184, "event_id": "evt-c13fbcfc53951b52263c25ed", "src_port": 80, "tcp_stream": 1035, "udp_stream": null, "body_sha256": "c0f37380971fb93ecb0cfa3c2bd6d91cc77f254f0a6ca41edeff47fda0e409cc", "frame_number": 39550, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 54153, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 54153, "timestamp_epoch": "1533965406.682444000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "39557", "http.content_type": "text/html", "http.response.code": "200", "http.content_length": "96" }, "src_ip": "185.68.93.18", "dst_port": 50185, "event_id": "evt-6737fc0f3efbc66af5c7b331", "src_port": 80, "tcp_stream": 1036, "udp_stream": null, "body_sha256": "e9d0f873040fb0ee7b073debbc6dfbfdbc80c0c17518d38b04b277a54e5fb275", "frame_number": 39598, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 96, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 96, "timestamp_epoch": "1533965407.582409000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "39676", "http.content_type": "text/html", "http.response.code": "200", "http.content_length": "24" }, "src_ip": "185.68.93.18", "dst_port": 50194, "event_id": "evt-5dd60fc7feedf4c15e819be7", "src_port": 80, "tcp_stream": 1046, "udp_stream": null, "body_sha256": "e49188fece61523b27d736f94bccb9b04d8a3f018fe0a770fc5cf9b6c734fd0a", "frame_number": 39678, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 24, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 24, "timestamp_epoch": "1533965419.411481000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "39681", "http.content_type": "text/html", "http.response.code": "200", "http.content_length": "12" }, "src_ip": "185.68.93.18", "dst_port": 50194, "event_id": "evt-e077709223ec2732f694365b", "src_port": 80, "tcp_stream": 1046, "udp_stream": null, "body_sha256": "1fc3656d141db778f4636a6beb9eb0623e7b2a072ddce6013ed96f44988b78b5", "frame_number": 39683, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 12, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 12, "timestamp_epoch": "1533965420.076875000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "39699", "http.content_type": "text/html", "http.response.code": "200", "http.content_length": "12" }, "src_ip": "185.68.93.18", "dst_port": 50195, "event_id": "evt-e4d55e7e058ac309a6c2eadf", "src_port": 80, "tcp_stream": 1047, "udp_stream": null, "body_sha256": "1fc3656d141db778f4636a6beb9eb0623e7b2a072ddce6013ed96f44988b78b5", "frame_number": 39701, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 12, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 12, "timestamp_epoch": "1533965436.380239000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "39712", "http.content_type": "text/html", "http.response.code": "200", "http.content_length": "12" }, "src_ip": "185.68.93.18", "dst_port": 50196, "event_id": "evt-157388bf475c86948b7c4f16", "src_port": 80, "tcp_stream": 1048, "udp_stream": null, "body_sha256": "1fc3656d141db778f4636a6beb9eb0623e7b2a072ddce6013ed96f44988b78b5", "frame_number": 39714, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 12, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 12, "timestamp_epoch": "1533965452.392999000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "39725", "http.content_type": "text/html", "http.response.code": "200", "http.content_length": "12" }, "src_ip": "185.68.93.18", "dst_port": 50197, "event_id": "evt-20ff812683f843302edf5be4", "src_port": 80, "tcp_stream": 1049, "udp_stream": null, "body_sha256": "1fc3656d141db778f4636a6beb9eb0623e7b2a072ddce6013ed96f44988b78b5", "frame_number": 39727, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 12, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 12, "timestamp_epoch": "1533965468.742976000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "39741", "http.content_type": "text/html", "http.response.code": "200", "http.content_length": "12" }, "src_ip": "185.68.93.18", "dst_port": 50198, "event_id": "evt-b967fce4a03e54d74164377f", "src_port": 80, "tcp_stream": 1050, "udp_stream": null, "body_sha256": "1fc3656d141db778f4636a6beb9eb0623e7b2a072ddce6013ed96f44988b78b5", "frame_number": 39743, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 12, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 12, "timestamp_epoch": "1533965485.114304000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "39754", "http.content_type": "text/html", "http.response.code": "200", "http.content_length": "12" }, "src_ip": "185.68.93.18", "dst_port": 50199, "event_id": "evt-42727328d62d9cf13fec0aec", "src_port": 80, "tcp_stream": 1051, "udp_stream": null, "body_sha256": "1fc3656d141db778f4636a6beb9eb0623e7b2a072ddce6013ed96f44988b78b5", "frame_number": 39756, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 12, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 12, "timestamp_epoch": "1533965501.157864000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "39767", "http.content_type": "text/html", "http.response.code": "200", "http.content_length": "12" }, "src_ip": "185.68.93.18", "dst_port": 50200, "event_id": "evt-3d9b6c1b727ae39d19242dd3", "src_port": 80, "tcp_stream": 1052, "udp_stream": null, "body_sha256": "1fc3656d141db778f4636a6beb9eb0623e7b2a072ddce6013ed96f44988b78b5", "frame_number": 39769, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 12, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 12, "timestamp_epoch": "1533965517.365174000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "39781", "http.content_type": "text/html", "http.response.code": "200", "http.content_length": "12" }, "src_ip": "185.68.93.18", "dst_port": 50201, "event_id": "evt-641444085349f50f1c21579a", "src_port": 80, "tcp_stream": 1053, "udp_stream": null, "body_sha256": "1fc3656d141db778f4636a6beb9eb0623e7b2a072ddce6013ed96f44988b78b5", "frame_number": 39783, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 12, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 12, "timestamp_epoch": "1533965533.927657000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "39796", "http.content_type": "text/html", "http.response.code": "200", "http.content_length": "12" }, "src_ip": "185.68.93.18", "dst_port": 50202, "event_id": "evt-72e4b82194c41b391ce50cc1", "src_port": 80, "tcp_stream": 1054, "udp_stream": null, "body_sha256": "1fc3656d141db778f4636a6beb9eb0623e7b2a072ddce6013ed96f44988b78b5", "frame_number": 39798, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 12, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 12, "timestamp_epoch": "1533965550.085388000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "39809", "http.content_type": "text/html", "http.response.code": "200", "http.content_length": "12" }, "src_ip": "185.68.93.18", "dst_port": 50203, "event_id": "evt-12d84b98296a484c9b236c4b", "src_port": 80, "tcp_stream": 1055, "udp_stream": null, "body_sha256": "1fc3656d141db778f4636a6beb9eb0623e7b2a072ddce6013ed96f44988b78b5", "frame_number": 39811, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 12, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 12, "timestamp_epoch": "1533965566.285632000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "39879", "http.content_type": "text/html", "http.response.code": "200", "http.content_length": "12" }, "src_ip": "185.68.93.18", "dst_port": 50205, "event_id": "evt-a76939fc48b837b3e996ea82", "src_port": 80, "tcp_stream": 1057, "udp_stream": null, "body_sha256": "1fc3656d141db778f4636a6beb9eb0623e7b2a072ddce6013ed96f44988b78b5", "frame_number": 39881, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 12, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 12, "timestamp_epoch": "1533965582.439568000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "39895", "http.content_type": "text/html", "http.response.code": "200", "http.content_length": "12" }, "src_ip": "185.68.93.18", "dst_port": 50206, "event_id": "evt-b0a7990adf0a3e39cdb5a890", "src_port": 80, "tcp_stream": 1058, "udp_stream": null, "body_sha256": "1fc3656d141db778f4636a6beb9eb0623e7b2a072ddce6013ed96f44988b78b5", "frame_number": 39897, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 12, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 12, "timestamp_epoch": "1533965598.592239000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "39951", "http.content_type": "text/html", "http.response.code": "200", "http.content_length": "12" }, "src_ip": "185.68.93.18", "dst_port": 50208, "event_id": "evt-a29a6b4a3c08729d09c181fc", "src_port": 80, "tcp_stream": 1060, "udp_stream": null, "body_sha256": "1fc3656d141db778f4636a6beb9eb0623e7b2a072ddce6013ed96f44988b78b5", "frame_number": 39959, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 12, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 12, "timestamp_epoch": "1533965614.757970000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "39970", "http.content_type": "text/html", "http.response.code": "200", "http.content_length": "12" }, "src_ip": "185.68.93.18", "dst_port": 50209, "event_id": "evt-95dcef2670c48f752ade440a", "src_port": 80, "tcp_stream": 1061, "udp_stream": null, "body_sha256": "1fc3656d141db778f4636a6beb9eb0623e7b2a072ddce6013ed96f44988b78b5", "frame_number": 39972, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 12, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 12, "timestamp_epoch": "1533965630.764268000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "39983", "http.content_type": "text/html", "http.response.code": "200", "http.content_length": "12" }, "src_ip": "185.68.93.18", "dst_port": 50210, "event_id": "evt-b7795aea7e77b8ffe3ec16f0", "src_port": 80, "tcp_stream": 1062, "udp_stream": null, "body_sha256": "1fc3656d141db778f4636a6beb9eb0623e7b2a072ddce6013ed96f44988b78b5", "frame_number": 39985, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 12, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 12, "timestamp_epoch": "1533965647.108796000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "39996", "http.content_type": "text/html", "http.response.code": "200", "http.content_length": "12" }, "src_ip": "185.68.93.18", "dst_port": 50211, "event_id": "evt-15b80e235c4f209c698f8bee", "src_port": 80, "tcp_stream": 1063, "udp_stream": null, "body_sha256": "1fc3656d141db778f4636a6beb9eb0623e7b2a072ddce6013ed96f44988b78b5", "frame_number": 39998, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 12, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 12, "timestamp_epoch": "1533965663.151493000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "40009", "http.content_type": "text/html", "http.response.code": "200", "http.content_length": "12" }, "src_ip": "185.68.93.18", "dst_port": 50212, "event_id": "evt-04d84664befd78c29c0e0692", "src_port": 80, "tcp_stream": 1064, "udp_stream": null, "body_sha256": "1fc3656d141db778f4636a6beb9eb0623e7b2a072ddce6013ed96f44988b78b5", "frame_number": 40011, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 12, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 12, "timestamp_epoch": "1533965679.535130000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "40022", "http.content_type": "text/html", "http.response.code": "200", "http.content_length": "12" }, "src_ip": "185.68.93.18", "dst_port": 50213, "event_id": "evt-f93d1b034a5d6833e09f55d9", "src_port": 80, "tcp_stream": 1065, "udp_stream": null, "body_sha256": "1fc3656d141db778f4636a6beb9eb0623e7b2a072ddce6013ed96f44988b78b5", "frame_number": 40024, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 12, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 12, "timestamp_epoch": "1533965696.067200000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "40038", "http.content_type": "text/html", "http.response.code": "200", "http.content_length": "12" }, "src_ip": "185.68.93.18", "dst_port": 50214, "event_id": "evt-24cf348b8943eb701106d1d3", "src_port": 80, "tcp_stream": 1066, "udp_stream": null, "body_sha256": "1fc3656d141db778f4636a6beb9eb0623e7b2a072ddce6013ed96f44988b78b5", "frame_number": 40040, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 12, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 12, "timestamp_epoch": "1533965713.563675000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "40051", "http.content_type": "text/html", "http.response.code": "200", "http.content_length": "12" }, "src_ip": "185.68.93.18", "dst_port": 50215, "event_id": "evt-0d190b5766388bd5fcfa33f9", "src_port": 80, "tcp_stream": 1067, "udp_stream": null, "body_sha256": "1fc3656d141db778f4636a6beb9eb0623e7b2a072ddce6013ed96f44988b78b5", "frame_number": 40053, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 12, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 12, "timestamp_epoch": "1533965729.425320000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "40064", "http.content_type": "text/html", "http.response.code": "200", "http.content_length": "12" }, "src_ip": "185.68.93.18", "dst_port": 50216, "event_id": "evt-68b9254d2bf49a3fd7e54e17", "src_port": 80, "tcp_stream": 1068, "udp_stream": null, "body_sha256": "1fc3656d141db778f4636a6beb9eb0623e7b2a072ddce6013ed96f44988b78b5", "frame_number": 40066, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 12, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 12, "timestamp_epoch": "1533965746.021717000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "40078", "http.content_type": "text/html", "http.response.code": "200", "http.content_length": "12" }, "src_ip": "185.68.93.18", "dst_port": 50217, "event_id": "evt-1ab82d001f11a9425149f067", "src_port": 80, "tcp_stream": 1069, "udp_stream": null, "body_sha256": "1fc3656d141db778f4636a6beb9eb0623e7b2a072ddce6013ed96f44988b78b5", "frame_number": 40080, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 12, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 12, "timestamp_epoch": "1533965762.113294000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "40213", "http.content_type": "text/css", "http.response.code": "200", "http.content_encoding": "gzip", "http.transfer_encoding": "chunked" }, "src_ip": "103.5.149.72", "dst_port": 50219, "event_id": "evt-77512cb1fe5c64923cba7cc1", "src_port": 80, "tcp_stream": 1071, "udp_stream": null, "body_sha256": "a002c9d3c0bfd9a9ff3c9ff2b1dbd79beb6bf0af5b45933ccad66337bc6864eb", "frame_number": 40357, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 48109, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 48109, "timestamp_epoch": "1533965770.815798000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "40209", "http.content_type": "application/x-javascript", "http.response.code": "200", "http.content_encoding": "gzip", "http.transfer_encoding": "chunked" }, "src_ip": "87.240.129.133", "dst_port": 50224, "event_id": "evt-8cf4b167c2ac74737f8d3311", "src_port": 80, "tcp_stream": 1076, "udp_stream": null, "body_sha256": "1d762c3dcf8ec1d7cf68b813aed274886103a60b67c11ff9f166398e96fdedaf", "frame_number": 40506, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 95382, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 95382, "timestamp_epoch": "1533965771.061475000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "40165", "http.content_type": "text/css", "http.response.code": "200", "http.content_encoding": "gzip", "http.transfer_encoding": "chunked" }, "src_ip": "103.5.149.72", "dst_port": 50223, "event_id": "evt-ce0665fb2dc5f63462496749", "src_port": 80, "tcp_stream": 1074, "udp_stream": null, "body_sha256": "ad984172bbde72d905cb477edf2775b567580976ef1327612313d7490a3d30ae", "frame_number": 40508, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 7317, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 7317, "timestamp_epoch": "1533965771.062370000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "40171", "http.content_type": "text/css", "http.response.code": "200", "http.content_encoding": "gzip", "http.transfer_encoding": "chunked" }, "src_ip": "103.5.149.72", "dst_port": 50220, "event_id": "evt-8b90e380179aa506bedf9da7", "src_port": 80, "tcp_stream": 1072, "udp_stream": null, "body_sha256": "38b9ae4c8fe738059ad5faf084677b448bd9333fc6286e3440cfc09be2bb18d5", "frame_number": 40516, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 3544, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 3544, "timestamp_epoch": "1533965771.071918000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "40177", "http.content_type": "text/css", "http.response.code": "200", "http.content_encoding": "gzip", "http.transfer_encoding": "chunked" }, "src_ip": "103.5.149.72", "dst_port": 50222, "event_id": "evt-d9daae07287161029a4167be", "src_port": 80, "tcp_stream": 1075, "udp_stream": null, "body_sha256": "044e4bccabac4f77e55d287724125fd5e1df18597c7e1d38cf690aefdae255b4", "frame_number": 40560, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 15473, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 15473, "timestamp_epoch": "1533965771.131947000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "40361", "http.content_type": "text/css", "http.response.code": "200", "http.content_encoding": "gzip", "http.transfer_encoding": "chunked" }, "src_ip": "103.5.149.72", "dst_port": 50219, "event_id": "evt-c93e9ff4ee534f0725227bcc", "src_port": 80, "tcp_stream": 1071, "udp_stream": null, "body_sha256": "1ed6dac934e53a42db49242075dee716837fe4115d998e45f5c52d4ae96923a2", "frame_number": 40735, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 6314, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 6314, "timestamp_epoch": "1533965771.476895000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "40173", "http.content_type": "text/css", "http.response.code": "200", "http.content_encoding": "gzip", "http.transfer_encoding": "chunked" }, "src_ip": "103.5.149.72", "dst_port": 50221, "event_id": "evt-fb92a8c02a22a5a57fdf8d05", "src_port": 80, "tcp_stream": 1073, "udp_stream": null, "body_sha256": "c87f78fc36289e69a164914c940e5cecd31024d0a06089c2fab4dcd23e507ae6", "frame_number": 41020, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 216785, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 216785, "timestamp_epoch": "1533965773.992817000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "40113", "http.content_type": "application/javascript", "http.response.code": "200", "http.content_length": "93636" }, "src_ip": "103.5.149.72", "dst_port": 50218, "event_id": "evt-eb33f7cf6a9b658ea3c8c6b5", "src_port": 80, "tcp_stream": 1070, "udp_stream": null, "body_sha256": "61c6caebd23921741fb5ffe6603f16634fca9840c2bf56ac8201e9264d6daccf", "frame_number": 41024, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 93636, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 93636, "timestamp_epoch": "1533965774.001669000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "40518", "http.content_type": "text/css", "http.response.code": "200", "http.content_encoding": "gzip", "http.transfer_encoding": "chunked" }, "src_ip": "103.5.149.72", "dst_port": 50220, "event_id": "evt-47d2a56d7dabde5441adbcb9", "src_port": 80, "tcp_stream": 1072, "udp_stream": null, "body_sha256": "d9e7bfb8aeed3257872096e5f7f09eb683adb4541c0fca3446823bea4a7c2168", "frame_number": 41028, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 952, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 952, "timestamp_epoch": "1533965774.014445000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "40510", "http.content_type": "text/css", "http.response.code": "200", "http.content_encoding": "gzip", "http.transfer_encoding": "chunked" }, "src_ip": "103.5.149.72", "dst_port": 50223, "event_id": "evt-3f75f59904a6fce932dcf4cb", "src_port": 80, "tcp_stream": 1074, "udp_stream": null, "body_sha256": "9346b79af539d6aa4f72a0499ca1459c42e1a6e2becf0d015ba2f4237f0a9eab", "frame_number": 41029, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 1705, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 1705, "timestamp_epoch": "1533965774.014452000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "40562", "http.content_type": "text/css", "http.response.code": "200", "http.content_encoding": "gzip", "http.transfer_encoding": "chunked" }, "src_ip": "103.5.149.72", "dst_port": 50222, "event_id": "evt-b7c8a1c41fd68aab9627fbd5", "src_port": 80, "tcp_stream": 1075, "udp_stream": null, "body_sha256": "cd649c61b13497605100760e8bf986b569254a716cc2b21612b8b4f09051a732", "frame_number": 41048, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 2670, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 2670, "timestamp_epoch": "1533965774.045150000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "40737", "http.content_type": "text/html", "http.response.code": "404", "http.content_encoding": "gzip", "http.transfer_encoding": "chunked" }, "src_ip": "103.5.149.72", "dst_port": 50219, "event_id": "evt-36a2eeeb1dc3b839bfa3fbfa", "src_port": 80, "tcp_stream": 1071, "udp_stream": null, "body_sha256": "f33c27745f2bd87344be790465ef984a972fd539dc83bd4f61d4242c607ef1ee", "frame_number": 41120, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 162, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 162, "timestamp_epoch": "1533965774.073979000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "41022", "http.content_type": "text/css", "http.response.code": "200", "http.content_encoding": "gzip", "http.transfer_encoding": "chunked" }, "src_ip": "103.5.149.72", "dst_port": 50221, "event_id": "evt-fd0dcf8abd14a0897cfc4ad8", "src_port": 80, "tcp_stream": 1073, "udp_stream": null, "body_sha256": "2a44910e028b6d330cacd3462a0252019ce6c016805a1b16c1c9c52b5c1caa46", "frame_number": 41345, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 44094, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 44094, "timestamp_epoch": "1533965773.012991000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "41034", "http.content_type": "text/css", "http.response.code": "200", "http.content_encoding": "gzip", "http.transfer_encoding": "chunked" }, "src_ip": "103.5.149.72", "dst_port": 50220, "event_id": "evt-8d83b062d8b94256ba5e3ad4", "src_port": 80, "tcp_stream": 1072, "udp_stream": null, "body_sha256": "4e4d1d22150544836181502bf5004097fe8d90b3cb647455a4d601153b39eeb7", "frame_number": 41351, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 4183, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 4183, "timestamp_epoch": "1533965773.025098000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "41026", "http.content_type": "text/css", "http.response.code": "200", "http.content_encoding": "gzip", "http.transfer_encoding": "chunked" }, "src_ip": "103.5.149.72", "dst_port": 50218, "event_id": "evt-6df7ae59f13714e80fa6602f", "src_port": 80, "tcp_stream": 1070, "udp_stream": null, "body_sha256": "7a44293f37ed3ab18757c89dc76b673aa3ff923e31933ba1bdae740fb0e7ddd4", "frame_number": 41363, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 28223, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 28223, "timestamp_epoch": "1533965773.105299000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "41036", "http.content_type": "text/css", "http.response.code": "200", "http.content_encoding": "gzip", "http.transfer_encoding": "chunked" }, "src_ip": "103.5.149.72", "dst_port": 50223, "event_id": "evt-2dabcb5d38afd4a68405859a", "src_port": 80, "tcp_stream": 1074, "udp_stream": null, "body_sha256": "6865cb6b98a7a93856092e5a4f0d44d6564e74513f685a1eef824a2f7ea77438", "frame_number": 41389, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 3853, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 3853, "timestamp_epoch": "1533965773.249652000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "41060", "http.content_type": "text/css", "http.response.code": "200", "http.content_encoding": "gzip", "http.transfer_encoding": "chunked" }, "src_ip": "103.5.149.72", "dst_port": 50222, "event_id": "evt-0dd817e95424cbea35702b55", "src_port": 80, "tcp_stream": 1075, "udp_stream": null, "body_sha256": "6db9e00a697b239f66e81bff6d475a80c885dd2e533c93ddeed3e5883a79b8e1", "frame_number": 41435, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 5004, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 5004, "timestamp_epoch": "1533965773.487448000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "41347", "http.content_type": "application/javascript", "http.response.code": "200", "http.content_length": "572" }, "src_ip": "103.5.149.72", "dst_port": 50221, "event_id": "evt-badc34687fcbc9f762cbfdb5", "src_port": 80, "tcp_stream": 1073, "udp_stream": null, "body_sha256": "beff9a913c0887163fd4a17d037f2188ed9e93f6c57f770448c2f7046ca7d141", "frame_number": 41786, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 572, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 572, "timestamp_epoch": "1533965774.640490000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "41365", "http.content_type": "application/javascript", "http.response.code": "200", "http.content_length": "31135" }, "src_ip": "103.5.149.72", "dst_port": 50218, "event_id": "evt-74a4c0795638a6eb8b7a39bc", "src_port": 80, "tcp_stream": 1070, "udp_stream": null, "body_sha256": "f8e7288c0e055bff074b4d2f64cf687fa49de2e08955cd2cdb00d55eaacb3a61", "frame_number": 41848, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 31135, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 31135, "timestamp_epoch": "1533965774.795760000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "41437", "http.content_type": "application/javascript", "http.response.code": "200", "http.content_length": "6084" }, "src_ip": "103.5.149.72", "dst_port": 50222, "event_id": "evt-54b5500e0e243a420dc69f45", "src_port": 80, "tcp_stream": 1075, "udp_stream": null, "body_sha256": "1baf84b9f47c61803a5ea556eb3541f6ba74fc6e3c5261aac798aa19773e5cf1", "frame_number": 41872, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 6084, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 6084, "timestamp_epoch": "1533965774.844975000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "41322", "http.content_type": "text/css", "http.response.code": "200", "http.content_encoding": "gzip", "http.transfer_encoding": "chunked" }, "src_ip": "103.5.149.72", "dst_port": 50278, "event_id": "evt-54dd5ebebef0c43de9783bd0", "src_port": 80, "tcp_stream": 1130, "udp_stream": null, "body_sha256": "ad927cfd47a633c08193fec7881a927102c04802a42fa9d880c34dcba5d473ed", "frame_number": 42045, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 22170, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 22170, "timestamp_epoch": "1533965775.437637000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "41324", "http.content_type": "text/css", "http.response.code": "200", "http.content_encoding": "gzip", "http.transfer_encoding": "chunked" }, "src_ip": "103.5.149.72", "dst_port": 50279, "event_id": "evt-1c2ab57940cc7b0f71eb8d2e", "src_port": 80, "tcp_stream": 1131, "udp_stream": null, "body_sha256": "3715612c143dd7fbcd9db512e0cbd31334fe349c77f5ac4921d0646ca8bb6fdf", "frame_number": 42053, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 11634, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 11634, "timestamp_epoch": "1533965775.441011000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "41391", "http.content_type": "application/javascript", "http.response.code": "200", "http.content_length": "5404" }, "src_ip": "103.5.149.72", "dst_port": 50223, "event_id": "evt-e7eab82823d71d7da4dc06b4", "src_port": 80, "tcp_stream": 1074, "udp_stream": null, "body_sha256": "9d0bbca6eb531759098a56914524f615a1d5a75a1b2c429d7b238973c2610c7a", "frame_number": 42201, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 5404, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 5404, "timestamp_epoch": "1533965775.812971000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "41781", "http.content_type": "application/javascript", "http.response.code": "200", "http.content_length": "4247" }, "src_ip": "103.5.149.72", "dst_port": 50281, "event_id": "evt-bf203d71a49a878553d2af42", "src_port": 80, "tcp_stream": 1132, "udp_stream": null, "body_sha256": "1b78a08c32d00ced18d679a004b133df54370f1f1d359f29b64c44256aaf8302", "frame_number": 42224, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 4247, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 4247, "timestamp_epoch": "1533965775.860779000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "41791", "http.content_type": "application/javascript", "http.response.code": "200", "http.content_length": "1519" }, "src_ip": "103.5.149.72", "dst_port": 50221, "event_id": "evt-deec5b8383c849710e708a56", "src_port": 80, "tcp_stream": 1073, "udp_stream": null, "body_sha256": "25af58ca16a2bfb18ae772716df14b4c656b39ccdcb4b9fae9bca1634e505007", "frame_number": 42246, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 1519, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 1519, "timestamp_epoch": "1533965775.872998000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "41850", "http.content_type": "application/javascript", "http.response.code": "200", "http.content_length": "15430" }, "src_ip": "103.5.149.72", "dst_port": 50218, "event_id": "evt-1092787404281a9622d6c133", "src_port": 80, "tcp_stream": 1070, "udp_stream": null, "body_sha256": "6281b1e2ea6a5d13e0fd8766295444b52867bc3298d5c2b6b55b1b22420f230c", "frame_number": 42263, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 15430, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 15430, "timestamp_epoch": "1533965775.927745000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "41876", "http.content_type": "application/javascript", "http.response.code": "200", "http.content_length": "9636" }, "src_ip": "103.5.149.72", "dst_port": 50222, "event_id": "evt-5ebeeafe49a5345118b4e34e", "src_port": 80, "tcp_stream": 1075, "udp_stream": null, "body_sha256": "1434636c458ad8cda52b2e1cb38178b63d9af59579d7259a36a436c9c6a11a72", "frame_number": 42283, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 9636, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 9636, "timestamp_epoch": "1533965775.985989000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "42022", "http.content_type": "application/javascript", "http.response.code": "200", "http.content_length": "3543" }, "src_ip": "103.5.149.72", "dst_port": 50282, "event_id": "evt-1c2b5f61f11d7bed70d70d80", "src_port": 80, "tcp_stream": 1135, "udp_stream": null, "body_sha256": "ae4f99d83e633923748305e0dd6434264babf605d56deb7d05345710796038fa", "frame_number": 42485, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 3543, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 3543, "timestamp_epoch": "1533965776.392419000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "42049", "http.content_type": "application/javascript", "http.response.code": "200", "http.content_length": "3448" }, "src_ip": "103.5.149.72", "dst_port": 50278, "event_id": "evt-52a2ec3ca0962110f75b5ef8", "src_port": 80, "tcp_stream": 1130, "udp_stream": null, "body_sha256": "3f7411e6cfd233d77fd01564a545084b986ae36e1c385c5999df93f5f430d65b", "frame_number": 42522, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 3448, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 3448, "timestamp_epoch": "1533965776.482909000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "41353", "http.content_type": "application/javascript", "http.response.code": "200", "http.content_length": "21191" }, "src_ip": "103.5.149.72", "dst_port": 50220, "event_id": "evt-a8a8dccd7b48b5461717979a", "src_port": 80, "tcp_stream": 1072, "udp_stream": null, "body_sha256": "39f55c0059bfa765dbc67836a3c694c4257e3880c5323e14a2874d78f4de5582", "frame_number": 42689, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 21191, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 21191, "timestamp_epoch": "1533965776.931692000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "42021", "http.content_type": "application/javascript", "http.response.code": "200", "http.content_length": "19588" }, "src_ip": "103.5.149.72", "dst_port": 50283, "event_id": "evt-59286d012d72549425ed4cd2", "src_port": 80, "tcp_stream": 1134, "udp_stream": null, "body_sha256": "fb03a6b96e7aa8dc5c4e079289c84f446a7374d65f7bb79a734c34c9fb8e7703", "frame_number": 42702, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 19588, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 19588, "timestamp_epoch": "1533965776.948117000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "42230", "http.content_type": "application/javascript", "http.response.code": "200", "http.content_length": "9712" }, "src_ip": "103.5.149.72", "dst_port": 50281, "event_id": "evt-edaaf2fb9c00f1a494c6dd86", "src_port": 80, "tcp_stream": 1132, "udp_stream": null, "body_sha256": "4efb8677134ae61413bf441d88c2e912ca065a68bb4566b30f935cae34f5a98e", "frame_number": 42749, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 9712, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 9712, "timestamp_epoch": "1533965777.082154000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "42057", "http.content_type": "application/javascript", "http.response.code": "200", "http.content_length": "18358" }, "src_ip": "103.5.149.72", "dst_port": 50279, "event_id": "evt-70b04e70e34bbe103fcd3617", "src_port": 80, "tcp_stream": 1131, "udp_stream": null, "body_sha256": "8500d605a74853787e140b8e1fcc945de816b28bda06093a3a9d3a9fe00b9b6e", "frame_number": 42755, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 18358, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 18358, "timestamp_epoch": "1533965777.083387000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "42248", "http.content_type": "application/javascript", "http.response.code": "200", "http.content_length": "3121" }, "src_ip": "103.5.149.72", "dst_port": 50221, "event_id": "evt-5ff5cbff42e89cc85c13b134", "src_port": 80, "tcp_stream": 1073, "udp_stream": null, "body_sha256": "b84161c9fbf7520cd14e7019f92120bd87a928a074156e91a992eba9fc9436e8", "frame_number": 42762, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 3121, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 3121, "timestamp_epoch": "1533965777.097664000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "42289", "http.content_type": "application/javascript", "http.response.code": "200", "http.content_length": "2985" }, "src_ip": "103.5.149.72", "dst_port": 50222, "event_id": "evt-5e7406292bfbedb6014208fd", "src_port": 80, "tcp_stream": 1075, "udp_stream": null, "body_sha256": "f9496faf384dba29602fe3072688892f2dcf7738eecb77208c51de0eaa12562a", "frame_number": 42849, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 2985, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 2985, "timestamp_epoch": "1533965777.296514000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "42488", "http.content_type": "application/javascript", "http.response.code": "200", "http.content_length": "350" }, "src_ip": "103.5.149.72", "dst_port": 50282, "event_id": "evt-945a09bc3431dd8813e68e41", "src_port": 80, "tcp_stream": 1135, "udp_stream": null, "body_sha256": "8bf7a76576baee734a750ad21b0a8a583de9ef4312e41f7043594910e6649eed", "frame_number": 42903, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 350, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 350, "timestamp_epoch": "1533965777.414677000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "42204", "http.content_type": "application/javascript", "http.response.code": "200", "http.content_length": "14904" }, "src_ip": "103.5.149.72", "dst_port": 50223, "event_id": "evt-43a797ab7fd31b382d692f4f", "src_port": 80, "tcp_stream": 1074, "udp_stream": null, "body_sha256": "826da83425629535790ab944e227e02a597999af91f0a662bcfb4351c950d274", "frame_number": 42975, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 14904, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 14904, "timestamp_epoch": "1533965777.599893000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "42704", "http.content_type": "image/png", "http.response.code": "200", "http.content_length": "5079" }, "src_ip": "103.5.149.72", "dst_port": 50283, "event_id": "evt-a498111d3a1f8c300326ace8", "src_port": 80, "tcp_stream": 1134, "udp_stream": null, "body_sha256": "c735ac343470ff44195d0167c35e9cb3e0bc43a7c749b67f50fb662300f73d9f", "frame_number": 43001, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 5079, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 5079, "timestamp_epoch": "1533965777.669415000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "42753", "http.content_type": "image/gif", "http.response.code": "200", "http.content_length": "2921" }, "src_ip": "103.5.149.72", "dst_port": 50281, "event_id": "evt-ab9e3fc85cdc6744e841457b", "src_port": 80, "tcp_stream": 1132, "udp_stream": null, "body_sha256": "2ffb9c700e123b950ec5913c37c94fdd8fbb16d072458bfd5a99b57a43233417", "frame_number": 43007, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 2921, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 2921, "timestamp_epoch": "1533965777.679401000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "42759", "http.content_type": "image/gif", "http.response.code": "200", "http.content_length": "5563" }, "src_ip": "103.5.149.72", "dst_port": 50279, "event_id": "evt-97eb292c6c41f3e06ec4edea", "src_port": 80, "tcp_stream": 1131, "udp_stream": null, "body_sha256": "e2b232bd93d4faa6bd4156d3e31b542a24ac3afe877c6f7faf23c1f474eaf52a", "frame_number": 43041, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 5563, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 5563, "timestamp_epoch": "1533965777.766148000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "42766", "http.content_type": "image/png", "http.response.code": "200", "http.content_length": "3726" }, "src_ip": "103.5.149.72", "dst_port": 50221, "event_id": "evt-b2ff523f5b24fa76f320b740", "src_port": 80, "tcp_stream": 1073, "udp_stream": null, "body_sha256": "8f34acb688aeae2e39704c35a59767aa10f9b6b99d81f681b8398b23c2d56f22", "frame_number": 43048, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 3726, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 3726, "timestamp_epoch": "1533965777.767294000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "41784", "http.content_type": "application/javascript", "http.response.code": "200", "http.content_length": "99790" }, "src_ip": "103.5.149.72", "dst_port": 50280, "event_id": "evt-0fbec03d5325a4a8a2c919a7", "src_port": 80, "tcp_stream": 1133, "udp_stream": null, "body_sha256": "8ed22d97053651c1bf38b50de0630657e03c9dc1b82f2c80241d72dd68c34fc8", "frame_number": 43154, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 99790, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 99790, "timestamp_epoch": "1533965778.041937000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "42266", "http.content_type": "application/javascript", "http.response.code": "200", "http.content_length": "153909" }, "src_ip": "103.5.149.72", "dst_port": 50218, "event_id": "evt-299d86bf5e6dde1303a63c34", "src_port": 80, "tcp_stream": 1070, "udp_stream": null, "body_sha256": "af5e4f327b79424352a42bf43df71e6a2f52d6f8948b82d6a42b4c2e97f7bfea", "frame_number": 43271, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 153909, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 153909, "timestamp_epoch": "1533965778.485448000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "43076", "http.content_type": "text/html", "http.response.code": "200", "http.content_length": "12" }, "src_ip": "185.68.93.18", "dst_port": 50284, "event_id": "evt-8db604d29afc49529a32eda1", "src_port": 80, "tcp_stream": 1136, "udp_stream": null, "body_sha256": "1fc3656d141db778f4636a6beb9eb0623e7b2a072ddce6013ed96f44988b78b5", "frame_number": 43398, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 12, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 12, "timestamp_epoch": "1533965778.917904000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "42524", "http.content_type": "application/javascript", "http.response.code": "200", "http.content_length": "192101" }, "src_ip": "103.5.149.72", "dst_port": 50278, "event_id": "evt-4de16578e633111cafbbb7c5", "src_port": 80, "tcp_stream": 1130, "udp_stream": null, "body_sha256": "cc59dfc0669d00ad2b72411ff19cf555e4d0f1b940f0c674904004c73a3edb07", "frame_number": 43539, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 192101, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 192101, "timestamp_epoch": "1533965779.484237000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "42696", "http.content_type": "application/javascript", "http.response.code": "200", "http.content_length": "69253" }, "src_ip": "103.5.149.72", "dst_port": 50220, "event_id": "evt-af3111920ceb74baecb7a8fe", "src_port": 80, "tcp_stream": 1072, "udp_stream": null, "body_sha256": "ea843998fbbcd38dd92e228250a9bf15521391a26c88cb25a16b162d7f35d0e1", "frame_number": 43580, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 69253, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 69253, "timestamp_epoch": "1533965779.848676000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "41126", "http.content_type": "application/javascript", "http.response.code": "200", "http.content_length": "88650" }, "src_ip": "103.5.149.72", "dst_port": 50219, "event_id": "evt-ae3694030824201aad8a8ebe", "src_port": 80, "tcp_stream": 1071, "udp_stream": null, "body_sha256": "17f91f2405171b6857a93cb8c9b306144951f1e272a039a61a7753ba04eb0b52", "frame_number": 43633, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 88650, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 88650, "timestamp_epoch": "1533965782.904170000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "43669", "http.content_type": "text/javascript", "http.response.code": "200", "http.content_length": "7819", "http.content_encoding": "gzip" }, "src_ip": "216.58.194.162", "dst_port": 50287, "event_id": "evt-d3883bc807385a78533add51", "src_port": 80, "tcp_stream": 1139, "udp_stream": null, "body_sha256": "2361c69cc160246a46ecca25b6b50d825c2d950c39328c29aa1a168018640b11", "frame_number": 43720, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 20578, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 20578, "timestamp_epoch": "1533965783.225531000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "43682", "http.content_type": "text/html", "http.response.code": "200", "http.content_length": "144" }, "src_ip": "74.119.117.100", "dst_port": 50294, "event_id": "evt-1e592a6325c27062ec0de921", "src_port": 80, "tcp_stream": 1146, "udp_stream": null, "body_sha256": "d1b728e19d551b8bc4f3f2d0c12541e7d8950358f95ae31e610b6ab46cb6ec96", "frame_number": 43740, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 144, "timestamp_epoch": "1533965783.308767000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "43698", "http.content_type": "application/javascript; charset=utf-8", "http.response.code": "200", "http.content_length": "35362", "http.content_encoding": "gzip" }, "src_ip": "192.229.163.25", "dst_port": 50298, "event_id": "evt-1ad81e254f90c6202ba79e2f", "src_port": 80, "tcp_stream": 1150, "udp_stream": null, "body_sha256": "7d856e9985a83e2e6fa80ea41c6e67c8db9e19d9f30ce8d0a8d87ad942a00a31", "frame_number": 43810, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 121199, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 121199, "timestamp_epoch": "1533965783.596265000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "43704", "http.content_type": "image/png", "http.response.code": "200", "http.content_length": "325" }, "src_ip": "103.5.149.72", "dst_port": 50278, "event_id": "evt-cd701f4530dd18109f9107e7", "src_port": 80, "tcp_stream": 1130, "udp_stream": null, "body_sha256": "03a8abd21deffa815518744425ed7da2e391745f22d80ecd2a98ece7e42644e3", "frame_number": 43847, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 325, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 325, "timestamp_epoch": "1533965783.655618000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "43702", "http.content_type": "image/png", "http.response.code": "200", "http.content_length": "252" }, "src_ip": "103.5.149.72", "dst_port": 50220, "event_id": "evt-ca94b656f703f99646f3a820", "src_port": 80, "tcp_stream": 1072, "udp_stream": null, "body_sha256": "e56be3ba3f85b78893bce2432a38aad1afda3d3032ee8667589dd44ee9ed0cc1", "frame_number": 43849, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 252, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 252, "timestamp_epoch": "1533965783.655787000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "43706", "http.content_type": "image/png", "http.response.code": "200", "http.content_length": "380" }, "src_ip": "103.5.149.72", "dst_port": 50218, "event_id": "evt-2739cab10e88818cd3d5d7cd", "src_port": 80, "tcp_stream": 1070, "udp_stream": null, "body_sha256": "f59b3fd3d4f882d5c2154e3b8aa5e535416a696f482996ec2a134e7a6978c333", "frame_number": 43875, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 380, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 380, "timestamp_epoch": "1533965783.720526000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "43727", "http.content_type": "image/gif", "http.response.code": "302", "http.content_length": "0" }, "src_ip": "194.226.130.228", "dst_port": 50285, "event_id": "evt-0edc640908eccab3ecd6b8a1", "src_port": 80, "tcp_stream": 1137, "udp_stream": null, "frame_number": 43927, "timestamp_epoch": "1533965783.794303000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "43748", "http.content_type": "image/gif", "http.response.code": "200", "http.content_length": "132" }, "src_ip": "88.212.196.103", "dst_port": 50292, "event_id": "evt-b285692150dd549e531e6d3d", "src_port": 80, "tcp_stream": 1144, "udp_stream": null, "body_sha256": "fa523f248a332cb89ae3ad8cf51d840153e0f96bcc2a4c8db736e02a340dab48", "frame_number": 43951, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 132, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 132, "timestamp_epoch": "1533965783.844038000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "43744", "http.content_type": "image/gif", "http.response.code": "200", "http.content_length": "43" }, "src_ip": "88.212.196.103", "dst_port": 50291, "event_id": "evt-a82f8b9ed0e7a98866b281cd", "src_port": 80, "tcp_stream": 1143, "udp_stream": null, "body_sha256": "2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363", "frame_number": 43956, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 43, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 43, "timestamp_epoch": "1533965783.848656000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "43690", "http.content_type": "application/x-javascript; charset=utf-8", "http.response.code": "200", "http.content_length": "67344", "http.content_encoding": "gzip" }, "src_ip": "157.240.11.22", "dst_port": 50299, "event_id": "evt-dca79729ec64e8d26f0e9d9f", "src_port": 80, "tcp_stream": 1151, "udp_stream": null, "body_sha256": "87da7fce38fb944279568a460f952df3009b4398083bbe5dedb489fde5f46814", "frame_number": 43966, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 222891, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 222891, "timestamp_epoch": "1533965783.858453000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "43710", "http.content_type": "image/png", "http.response.code": "200", "http.content_length": "1440" }, "src_ip": "103.5.149.72", "dst_port": 50221, "event_id": "evt-aec76831ec961f67e2647b9c", "src_port": 80, "tcp_stream": 1073, "udp_stream": null, "body_sha256": "a1dbd5350e586eab4363644e8a82826a3032bc4f83694543d50fb6498ea6e82e", "frame_number": 43970, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 1440, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 1440, "timestamp_epoch": "1533965783.862394000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "43708", "http.content_type": "image/png", "http.response.code": "200", "http.content_length": "369" }, "src_ip": "103.5.149.72", "dst_port": 50280, "event_id": "evt-a15c49750c0b088c14e502f3", "src_port": 80, "tcp_stream": 1133, "udp_stream": null, "body_sha256": "f2addf74a79c54d648ed7d227042c992f8d500dd95f072528f9e55c168cf97ad", "frame_number": 43990, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 369, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 369, "timestamp_epoch": "1533965783.903839000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "43686", "http.content_type": "application/javascript; charset=UTF-8", "http.response.code": "200", "http.content_length": "51691", "http.content_encoding": "gzip" }, "src_ip": "216.58.192.8", "dst_port": 50295, "event_id": "evt-0bf8c0b6d62e87e99f34bce3", "src_port": 80, "tcp_stream": 1147, "udp_stream": null, "body_sha256": "225bd232b88e6072f4601058ebf7a0db0fa5cb3bf7537350c7de0bf5f2f5c54a", "frame_number": 44010, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 401284, "timestamp_epoch": "1533965783.936535000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "43851", "http.content_type": "image/png", "http.response.code": "200", "http.content_length": "1303" }, "src_ip": "103.5.149.72", "dst_port": 50278, "event_id": "evt-0a300f479102e1b89d0e1836", "src_port": 80, "tcp_stream": 1130, "udp_stream": null, "body_sha256": "44509da8c1e070e58d174497add5449046af4bd1a1b62aa38152d73c9372a394", "frame_number": 44021, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 1303, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 1303, "timestamp_epoch": "1533965783.983808000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "43853", "http.content_type": "image/png", "http.response.code": "200", "http.content_length": "559" }, "src_ip": "103.5.149.72", "dst_port": 50220, "event_id": "evt-fe38556c73854aabce6081b7", "src_port": 80, "tcp_stream": 1072, "udp_stream": null, "body_sha256": "09c4d94ef1b017b75ff5e2b9e68bcab620ec852cde6b08b21fb46f6d3ce8c904", "frame_number": 44032, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 559, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 559, "timestamp_epoch": "1533965784.000953000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "43877", "http.content_type": "image/png", "http.response.code": "200", "http.content_length": "1816" }, "src_ip": "103.5.149.72", "dst_port": 50218, "event_id": "evt-dbf3a14ac2db4ba8237d6404", "src_port": 80, "tcp_stream": 1070, "udp_stream": null, "body_sha256": "1b416e5dd993831d9e9f5073f76034d5d1485b7eeec0be5c57c3c408b9ca8f14", "frame_number": 44070, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 1816, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 1816, "timestamp_epoch": "1533965784.029075000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "43933", "http.content_type": "image/gif", "http.response.code": "200", "http.content_length": "43" }, "src_ip": "194.226.130.228", "dst_port": 50285, "event_id": "evt-9e35201cbcb71a5e339bfc68", "src_port": 80, "tcp_stream": 1137, "udp_stream": null, "body_sha256": "cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda", "frame_number": 44151, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 43, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 43, "timestamp_epoch": "1533965784.337316000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "43972", "http.content_type": "image/png", "http.response.code": "200", "http.content_length": "5657" }, "src_ip": "103.5.149.72", "dst_port": 50221, "event_id": "evt-557c818f0ac078b8c8eafbd5", "src_port": 80, "tcp_stream": 1073, "udp_stream": null, "body_sha256": "3cdffc1fdda52774a1ee46fcd7244b0ee88b11df0f7ddce7dc725609bd1f2a90", "frame_number": 44170, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 5657, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 5657, "timestamp_epoch": "1533965784.386310000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "43996", "http.content_type": "image/png", "http.response.code": "200", "http.content_length": "1258" }, "src_ip": "103.5.149.72", "dst_port": 50280, "event_id": "evt-a4798342caeae84c195c4a4e", "src_port": 80, "tcp_stream": 1133, "udp_stream": null, "body_sha256": "67dcf7446d48b5a0cb944a63bd3b69470cc6a48c024223aeff0252cc5b4f11b5", "frame_number": 44181, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 1258, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 1258, "timestamp_epoch": "1533965784.395940000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "44024", "http.content_type": "image/png", "http.response.code": "200", "http.content_length": "2269" }, "src_ip": "103.5.149.72", "dst_port": 50278, "event_id": "evt-201666445f8e79fb260071ec", "src_port": 80, "tcp_stream": 1130, "udp_stream": null, "body_sha256": "403f055d841332e37c429d5a4f0699e95a960529853388d36e4ef51e4309ebd0", "frame_number": 44210, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 2269, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 2269, "timestamp_epoch": "1533965784.461359000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "44034", "http.content_type": "image/png", "http.response.code": "200", "http.content_length": "247" }, "src_ip": "103.5.149.72", "dst_port": 50220, "event_id": "evt-b965d3edae6c8e350d3b6c76", "src_port": 80, "tcp_stream": 1072, "udp_stream": null, "body_sha256": "025bb8d092d17ec94d16f6a602b61447faf64f3260c93a4650e9b77b9003a3f9", "frame_number": 44212, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 247, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 247, "timestamp_epoch": "1533965784.461460000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "44072", "http.content_type": "image/png", "http.response.code": "200", "http.content_length": "2093" }, "src_ip": "103.5.149.72", "dst_port": 50218, "event_id": "evt-4f314116cded76a5c5c6bbc0", "src_port": 80, "tcp_stream": 1070, "udp_stream": null, "body_sha256": "c6e69e2ac48274e5650b25984db96e9b8c85f8c92941900207abb3d41b423cf7", "frame_number": 44237, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 2093, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 2093, "timestamp_epoch": "1533965784.480055000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "44172", "http.content_type": "image/png", "http.response.code": "200", "http.content_length": "470" }, "src_ip": "103.5.149.72", "dst_port": 50221, "event_id": "evt-1da1ba1934692ded58a336bb", "src_port": 80, "tcp_stream": 1073, "udp_stream": null, "body_sha256": "f379ea3023b93c6e5d2fe2945774dcf7c85a116326d9eb8f3274de541403811b", "frame_number": 44283, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 470, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 470, "timestamp_epoch": "1533965784.709122000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "44183", "http.content_type": "image/svg+xml", "http.response.code": "200", "http.content_length": "14903" }, "src_ip": "103.5.149.72", "dst_port": 50280, "event_id": "evt-bfa3c1ed96179ef24eebdd23", "src_port": 80, "tcp_stream": 1133, "udp_stream": null, "body_sha256": "99fb918a282d39d585d3d759f7903f7508925d0f78ae80e427cec27378c5b71b", "frame_number": 44312, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 14903, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 14903, "timestamp_epoch": "1533965784.893851000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "43657", "http.content_type": "application/vnd.ms-fontobject", "http.response.code": "200", "http.content_length": "29052" }, "src_ip": "103.5.149.72", "dst_port": 50219, "event_id": "evt-4be774df561dbdea8ab22e82", "src_port": 80, "tcp_stream": 1071, "udp_stream": null, "body_sha256": "387ad007219e458d5db35423310dcbc61b583b2611fde57a36879e31b3fb1d99", "frame_number": 44328, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 29052, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 29052, "timestamp_epoch": "1533965784.989637000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "44220", "http.content_type": "image/png", "http.response.code": "200", "http.content_length": "312" }, "src_ip": "103.5.149.72", "dst_port": 50278, "event_id": "evt-99f383ba115fdbc030170ce1", "src_port": 80, "tcp_stream": 1130, "udp_stream": null, "body_sha256": "38a2d4f024e57004e2d2324eead0ae08341ea9490151a439d6531132a5d2c2d5", "frame_number": 44409, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 312, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 312, "timestamp_epoch": "1533965785.323200000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "44226", "http.content_type": "image/png", "http.response.code": "200", "http.content_length": "370" }, "src_ip": "103.5.149.72", "dst_port": 50220, "event_id": "evt-5f97eb509c25d5acc047c2a7", "src_port": 80, "tcp_stream": 1072, "udp_stream": null, "body_sha256": "9a3425a07bbde19cc69878e803f30c78d60b61f49049265a20a01841a1028350", "frame_number": 44410, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 370, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 370, "timestamp_epoch": "1533965785.323370000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "44277", "http.content_type": "text/html", "http.response.code": "200", "http.content_length": "1479", "http.content_encoding": "gzip" }, "src_ip": "216.58.192.1", "dst_port": 50313, "event_id": "evt-8c62f6d8b17b25431e313d62", "src_port": 80, "tcp_stream": 1165, "udp_stream": null, "body_sha256": "ced5c873136c4fab4584c0c6d26dcd530c748303d7ed9b7a7966b2fe1d6f5915", "frame_number": 44415, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 2882, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 2882, "timestamp_epoch": "1533965785.323540000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "44239", "http.content_type": "application/json; charset=utf-8", "http.response.code": "200", "http.content_length": "932" }, "src_ip": "103.5.149.72", "dst_port": 50218, "event_id": "evt-bda2ab548c457e4a2af5122e", "src_port": 80, "tcp_stream": 1070, "udp_stream": null, "body_sha256": "b824ce476646a4ea83e2e7b3ccff9864cb702bf597c05656a470ec609954f9db", "frame_number": 44424, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 932, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 932, "timestamp_epoch": "1533965785.325303000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "44285", "http.content_type": "application/json; charset=utf-8", "http.response.code": "200", "http.content_length": "27503" }, "src_ip": "103.5.149.72", "dst_port": 50221, "event_id": "evt-cc0545737e14bdf70c00f0bd", "src_port": 80, "tcp_stream": 1073, "udp_stream": null, "body_sha256": "e4c763b60274fbb4f5ebfb43603452f0c592aedf39647951ce87182fdb702955", "frame_number": 44488, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 27503, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 27503, "timestamp_epoch": "1533965785.453535000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "44398", "http.content_type": "text/html", "http.response.code": "200", "http.content_length": "1479", "http.content_encoding": "gzip" }, "src_ip": "216.58.192.1", "dst_port": 50314, "event_id": "evt-a1647f46cfbd4cf53fa0e886", "src_port": 80, "tcp_stream": 1166, "udp_stream": null, "body_sha256": "ced5c873136c4fab4584c0c6d26dcd530c748303d7ed9b7a7966b2fe1d6f5915", "frame_number": 44696, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 2882, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 2882, "timestamp_epoch": "1533965786.038948000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "44836", "http.content_type": "text/css; charset=utf-8", "http.response.code": "200", "http.content_encoding": "gzip", "http.transfer_encoding": "chunked" }, "src_ip": "216.58.192.10", "dst_port": 50338, "event_id": "evt-47398f1f94bc5b4eed3a1351", "src_port": 80, "tcp_stream": 1190, "udp_stream": null, "body_sha256": "8380f10fcacb3780a860531c45384ab3bfdc2ab6a9b8ada7b38551448f69d889", "frame_number": 44998, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 224, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 224, "timestamp_epoch": "1533965786.617843000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "44800", "http.content_type": "text/javascript; charset=UTF-8", "http.response.code": "200", "http.content_length": "26268", "http.content_encoding": "gzip" }, "src_ip": "216.58.194.162", "dst_port": 50335, "event_id": "evt-6599e3390665fda623d67df7", "src_port": 80, "tcp_stream": 1187, "udp_stream": null, "body_sha256": "2ea3ff820ddb55c4c951ff1c0fbfe8590ebff986b806fb351f2f32aded2fefc4", "frame_number": 45009, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 72153, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 72153, "timestamp_epoch": "1533965786.714272000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "44840", "http.content_type": "text/css; charset=utf-8", "http.response.code": "200", "http.content_encoding": "gzip", "http.transfer_encoding": "chunked" }, "src_ip": "216.58.192.10", "dst_port": 50339, "event_id": "evt-d6da46fe76b7ffc57a003869", "src_port": 80, "tcp_stream": 1191, "udp_stream": null, "body_sha256": "96bc02edb88af74dfe132e8341ef9a8694400d86bf0deb6fd93d06591bc5fa8d", "frame_number": 45011, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 222, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 222, "timestamp_epoch": "1533965786.714704000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "44900", "http.response.code": "101" }, "src_ip": "103.5.149.77", "dst_port": 50334, "event_id": "evt-a45513753d70b833b73b0928", "src_port": 8080, "tcp_stream": 1186, "udp_stream": null, "frame_number": 45176, "timestamp_epoch": "1533965787.144926000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "45321", "http.content_type": "font/woff", "http.response.code": "200", "http.content_length": "19916" }, "src_ip": "216.58.192.3", "dst_port": 50345, "event_id": "evt-a75d19cd29edfeac6ac6935f", "src_port": 80, "tcp_stream": 1197, "udp_stream": null, "body_sha256": "3ab30e780c8b0bcc4998b838a5b30c3bfe28edead312906dc3c12271fae0699a", "frame_number": 45736, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 19916, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 19916, "timestamp_epoch": "1533965788.591645000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "45320", "http.content_type": "font/woff", "http.response.code": "200", "http.content_length": "19888" }, "src_ip": "216.58.192.3", "dst_port": 50346, "event_id": "evt-0718307b5f16c391cbd9e5d9", "src_port": 80, "tcp_stream": 1198, "udp_stream": null, "body_sha256": "468e579fe1210fa55525b1c470ed2d1958404512a2dd4fb972cac5ce0ff00b1f", "frame_number": 45737, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 19888, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 19888, "timestamp_epoch": "1533965788.591646000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "45898", "http.content_type": "text/html; charset=UTF-8", "http.response.code": "204", "http.content_length": "0" }, "src_ip": "216.58.192.4", "dst_port": 50356, "event_id": "evt-b45609417d575616c8dcb385", "src_port": 80, "tcp_stream": 1208, "udp_stream": null, "frame_number": 45959, "timestamp_epoch": "1533965789.404843000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "46258", "http.content_type": "image/x-icon", "http.response.code": "200", "http.content_length": "34494" }, "src_ip": "103.5.149.72", "dst_port": 50221, "event_id": "evt-8ab9fd12548e492af83dca01", "src_port": 80, "tcp_stream": 1073, "udp_stream": null, "body_sha256": "05879b64ff801a2c6fbc4e43a1872c6a0ab6a67d3839d1eb3ed8e4852d4d58bd", "frame_number": 46312, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 34494, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 34494, "timestamp_epoch": "1533965790.494171000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "46268", "http.content_type": "text/html; charset=UTF-8", "http.response.code": "200", "http.content_encoding": "gzip", "http.transfer_encoding": "chunked" }, "src_ip": "103.5.149.72", "dst_port": 50218, "event_id": "evt-32ca3ed5f336afa0b2fbf69d", "src_port": 80, "tcp_stream": 1070, "udp_stream": null, "body_sha256": "1dc9f4fe16b9590b8044c7389d2d1c37fb18ef5dad0ef801a6071f4df7c7a9d5", "frame_number": 46359, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 127688, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 127688, "timestamp_epoch": "1533965790.986215000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "46341", "http.content_type": "text/css", "http.response.code": "200", "http.content_encoding": "gzip", "http.transfer_encoding": "chunked" }, "src_ip": "103.5.149.72", "dst_port": 50221, "event_id": "evt-f07d0b8d4c66c3fd9fc1e75a", "src_port": 80, "tcp_stream": 1073, "udp_stream": null, "body_sha256": "cd649c61b13497605100760e8bf986b569254a716cc2b21612b8b4f09051a732", "frame_number": 46418, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 2670, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 2670, "timestamp_epoch": "1533965791.269544000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "46343", "http.content_type": "text/css", "http.response.code": "200", "http.content_encoding": "gzip", "http.transfer_encoding": "chunked" }, "src_ip": "103.5.149.72", "dst_port": 50278, "event_id": "evt-bcf999fad170645c261f3053", "src_port": 80, "tcp_stream": 1130, "udp_stream": null, "body_sha256": "e6145cbc4aac4c3d685d04d508cee083e4e4a8a727af838ed46de8f0384b6119", "frame_number": 46425, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 4171, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 4171, "timestamp_epoch": "1533965791.293732000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "46345", "http.content_type": "text/css", "http.response.code": "200", "http.content_encoding": "gzip", "http.transfer_encoding": "chunked" }, "src_ip": "103.5.149.72", "dst_port": 50220, "event_id": "evt-c84b220d6f92f55fcbdd8cb9", "src_port": 80, "tcp_stream": 1072, "udp_stream": null, "body_sha256": "ebdab894f319fe12a1b14f3dc8c883d45caf4c15e389fb9d6568145f926f4126", "frame_number": 46433, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 7533, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 7533, "timestamp_epoch": "1533965791.349917000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "46347", "http.content_type": "text/html", "http.response.code": "404", "http.content_encoding": "gzip", "http.transfer_encoding": "chunked" }, "src_ip": "103.5.149.72", "dst_port": 50219, "event_id": "evt-043c75fb2534b138552079dd", "src_port": 80, "tcp_stream": 1071, "udp_stream": null, "body_sha256": "f33c27745f2bd87344be790465ef984a972fd539dc83bd4f61d4242c607ef1ee", "frame_number": 46439, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 162, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 162, "timestamp_epoch": "1533965791.369624000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "46355", "http.content_type": "text/css", "http.response.code": "200", "http.content_encoding": "gzip", "http.transfer_encoding": "chunked" }, "src_ip": "103.5.149.72", "dst_port": 50280, "event_id": "evt-095e3311079f7b283c136f1c", "src_port": 80, "tcp_stream": 1133, "udp_stream": null, "body_sha256": "110c07b1c1d0b56bb1755a621024babe4a7f60cacd8ffe605ef41826d3fe6784", "frame_number": 46463, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 76152, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 76152, "timestamp_epoch": "1533965791.436706000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "46361", "http.content_type": "text/css", "http.response.code": "200", "http.content_encoding": "gzip", "http.transfer_encoding": "chunked" }, "src_ip": "103.5.149.72", "dst_port": 50218, "event_id": "evt-3117f23308f317a3b15c1238", "src_port": 80, "tcp_stream": 1070, "udp_stream": null, "body_sha256": "3836255ada8bd1d6a0ac85b332623efd56c48a84e44be7cdf39482e5e1fa9e3c", "frame_number": 46475, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 6821, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 6821, "timestamp_epoch": "1533965791.469549000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "46420", "http.content_type": "text/css", "http.response.code": "200", "http.content_encoding": "gzip", "http.transfer_encoding": "chunked" }, "src_ip": "103.5.149.72", "dst_port": 50221, "event_id": "evt-168ebb39e680a15e4c1fa43c", "src_port": 80, "tcp_stream": 1073, "udp_stream": null, "body_sha256": "7a788d144a48f85a8f0ffd046f90c7ae89208a52463f9e5ba27833ab2085a291", "frame_number": 46572, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 2258, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 2258, "timestamp_epoch": "1533965791.730204000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "46427", "http.content_type": "application/javascript", "http.response.code": "200", "http.content_length": "10013" }, "src_ip": "103.5.149.72", "dst_port": 50278, "event_id": "evt-58cdb3c6b8904e1b93ccf1f3", "src_port": 80, "tcp_stream": 1130, "udp_stream": null, "body_sha256": "a131c2b10883bc8647bffa08b4a6b27f04b376bbddb267a4d0c9d3e8ea851aa0", "frame_number": 46593, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 10013, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 10013, "timestamp_epoch": "1533965791.764965000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "46441", "http.content_type": "application/javascript", "http.response.code": "200", "http.content_length": "3364" }, "src_ip": "103.5.149.72", "dst_port": 50219, "event_id": "evt-67e9cdd8a7640aaefe3915e8", "src_port": 80, "tcp_stream": 1071, "udp_stream": null, "body_sha256": "8ed18faec0943d33882e94cf8e4f01b732ff4e7c84294a9852dbed7cbb07afd7", "frame_number": 46630, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 3364, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 3364, "timestamp_epoch": "1533965791.925149000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "46465", "http.content_type": "application/javascript", "http.response.code": "200", "http.content_length": "11271" }, "src_ip": "103.5.149.72", "dst_port": 50280, "event_id": "evt-c6f94c64389b5dceb4b1d6b5", "src_port": 80, "tcp_stream": 1133, "udp_stream": null, "body_sha256": "5aa35acedcb1d276b3b3a71371eb51bc910b970deb8a3c6111fa99959fe6c9c7", "frame_number": 46683, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 11271, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 11271, "timestamp_epoch": "1533965792.154573000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "46484", "http.content_type": "application/javascript", "http.response.code": "200", "http.content_length": "12028" }, "src_ip": "103.5.149.72", "dst_port": 50218, "event_id": "evt-44df4cd0f7e256d1bdc55b15", "src_port": 80, "tcp_stream": 1070, "udp_stream": null, "body_sha256": "a6dd05c22e36e46f367bb82192f989ccf6b9f5407e61addeaab44b7c53e30a00", "frame_number": 46735, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 12028, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 12028, "timestamp_epoch": "1533965792.353700000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "46895", "http.content_type": "text/html", "http.response.code": "200", "http.content_length": "12" }, "src_ip": "185.68.93.18", "dst_port": 50376, "event_id": "evt-82b1d020d283b7a26c69b964", "src_port": 80, "tcp_stream": 1228, "udp_stream": null, "body_sha256": "1fc3656d141db778f4636a6beb9eb0623e7b2a072ddce6013ed96f44988b78b5", "frame_number": 46902, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 12, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 12, "timestamp_epoch": "1533965794.805158000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "46979", "http.content_type": "text/html", "http.response.code": "200", "http.content_length": "12" }, "src_ip": "185.68.93.18", "dst_port": 50379, "event_id": "evt-a6291a5ce625a26bbdbdd45b", "src_port": 80, "tcp_stream": 1231, "udp_stream": null, "body_sha256": "1fc3656d141db778f4636a6beb9eb0623e7b2a072ddce6013ed96f44988b78b5", "frame_number": 46981, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 12, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 12, "timestamp_epoch": "1533965811.012931000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "47000", "http.content_type": "text/html", "http.response.code": "200", "http.content_length": "12" }, "src_ip": "185.68.93.18", "dst_port": 50380, "event_id": "evt-6a2023a758cb28191572d797", "src_port": 80, "tcp_stream": 1232, "udp_stream": null, "body_sha256": "1fc3656d141db778f4636a6beb9eb0623e7b2a072ddce6013ed96f44988b78b5", "frame_number": 47002, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 12, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 12, "timestamp_epoch": "1533965827.059725000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "47020", "http.content_type": "text/html", "http.response.code": "200", "http.content_length": "12" }, "src_ip": "185.68.93.18", "dst_port": 50381, "event_id": "evt-77a0c316de55489c4905c81c", "src_port": 80, "tcp_stream": 1233, "udp_stream": null, "body_sha256": "1fc3656d141db778f4636a6beb9eb0623e7b2a072ddce6013ed96f44988b78b5", "frame_number": 47022, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 12, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 12, "timestamp_epoch": "1533965843.109897000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "47112", "http.content_type": "text/html", "http.response.code": "200", "http.content_length": "12" }, "src_ip": "185.68.93.18", "dst_port": 50382, "event_id": "evt-d0e26e68230edc514a48c4c8", "src_port": 80, "tcp_stream": 1234, "udp_stream": null, "body_sha256": "1fc3656d141db778f4636a6beb9eb0623e7b2a072ddce6013ed96f44988b78b5", "frame_number": 47115, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 12, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 12, "timestamp_epoch": "1533965859.247335000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "47140", "http.content_type": "text/html", "http.response.code": "200", "http.content_length": "12" }, "src_ip": "185.68.93.18", "dst_port": 50383, "event_id": "evt-385cdc4f142412bfea8f1d8d", "src_port": 80, "tcp_stream": 1235, "udp_stream": null, "body_sha256": "1fc3656d141db778f4636a6beb9eb0623e7b2a072ddce6013ed96f44988b78b5", "frame_number": 47142, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 12, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 12, "timestamp_epoch": "1533965875.148895000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "47152", "http.content_type": "text/html", "http.response.code": "200", "http.content_length": "12" }, "src_ip": "185.68.93.18", "dst_port": 50384, "event_id": "evt-9c55798c07d02890c6774a2d", "src_port": 80, "tcp_stream": 1236, "udp_stream": null, "body_sha256": "1fc3656d141db778f4636a6beb9eb0623e7b2a072ddce6013ed96f44988b78b5", "frame_number": 47155, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 12, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 12, "timestamp_epoch": "1533965891.227980000" }, { "kind": "http_response", "dst_ip": "192.168.1.95", "fields": { "http.request_in": "47174", "http.content_type": "text/html", "http.response.code": "200", "http.content_length": "12" }, "src_ip": "185.68.93.18", "dst_port": 50385, "event_id": "evt-c7ba6557cb4df87be0293955", "src_port": 80, "tcp_stream": 1237, "udp_stream": null, "body_sha256": "1fc3656d141db778f4636a6beb9eb0623e7b2a072ddce6013ed96f44988b78b5", "frame_number": 47176, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 12, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 12, "timestamp_epoch": "1533965907.203061000" } ], "tls_client_hello": [ { "kind": "tls_client_hello", "dst_ip": "207.244.80.166", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "www.rt.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-689985787b9d19ea8837476e", "src_port": 49195, "tcp_stream": 37, "udp_stream": null, "frame_number": 550, "timestamp_epoch": "1533964544.926326000" }, { "kind": "tls_client_hello", "dst_ip": "207.244.80.166", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "www.rt.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-59422222392438e32536d8c2", "src_port": 49194, "tcp_stream": 38, "udp_stream": null, "frame_number": 552, "timestamp_epoch": "1533964544.926457000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.0.42", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ajax.googleapis.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-a23de1d851667561c007da7a", "src_port": 49205, "tcp_stream": 48, "udp_stream": null, "frame_number": 624, "timestamp_epoch": "1533964545.709230000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.0.42", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ajax.googleapis.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-d6204e4fe33f8dbdbcca7dea", "src_port": 49204, "tcp_stream": 47, "udp_stream": null, "frame_number": 626, "timestamp_epoch": "1533964545.709442000" }, { "kind": "tls_client_hello", "dst_ip": "207.244.80.166", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "www.rt.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-6e99cd72e3679a769e3664cc", "src_port": 49199, "tcp_stream": 42, "udp_stream": null, "frame_number": 636, "timestamp_epoch": "1533964545.733784000" }, { "kind": "tls_client_hello", "dst_ip": "207.244.80.166", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "www.rt.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-cd38144118d5594cea1d49d2", "src_port": 49196, "tcp_stream": 39, "udp_stream": null, "frame_number": 638, "timestamp_epoch": "1533964545.733803000" }, { "kind": "tls_client_hello", "dst_ip": "207.244.80.166", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "www.rt.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-28bf583195db24b3c51bcc7a", "src_port": 49198, "tcp_stream": 41, "udp_stream": null, "frame_number": 642, "timestamp_epoch": "1533964545.736658000" }, { "kind": "tls_client_hello", "dst_ip": "207.244.80.166", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "www.rt.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-6df9d7ae9ea5e461a9e9c324", "src_port": 49197, "tcp_stream": 40, "udp_stream": null, "frame_number": 646, "timestamp_epoch": "1533964545.736960000" }, { "kind": "tls_client_hello", "dst_ip": "173.241.250.220", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ruptly-d.openx.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-68a3774b2c9b401edb0c8ef4", "src_port": 49209, "tcp_stream": 51, "udp_stream": null, "frame_number": 651, "timestamp_epoch": "1533964545.746485000" }, { "kind": "tls_client_hello", "dst_ip": "173.241.250.220", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ruptly-d.openx.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-97051c82a77078161f3fddc8", "src_port": 49208, "tcp_stream": 52, "udp_stream": null, "frame_number": 659, "timestamp_epoch": "1533964545.748147000" }, { "kind": "tls_client_hello", "dst_ip": "185.28.71.53", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cdni.rt.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-7bccd825c045c1ab6e938e04", "src_port": 49210, "tcp_stream": 53, "udp_stream": null, "frame_number": 692, "timestamp_epoch": "1533964545.823140000" }, { "kind": "tls_client_hello", "dst_ip": "185.28.71.53", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cdni.rt.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-a734179f632dfd9484e37fca", "src_port": 49211, "tcp_stream": 54, "udp_stream": null, "frame_number": 696, "timestamp_epoch": "1533964545.823802000" }, { "kind": "tls_client_hello", "dst_ip": "185.28.71.53", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cdni.rt.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-e149172de99836e0664805e7", "src_port": 49213, "tcp_stream": 56, "udp_stream": null, "frame_number": 698, "timestamp_epoch": "1533964545.824007000" }, { "kind": "tls_client_hello", "dst_ip": "185.28.71.53", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cdni.rt.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-dbf737d224ac863afd437519", "src_port": 49212, "tcp_stream": 55, "udp_stream": null, "frame_number": 699, "timestamp_epoch": "1533964545.824041000" }, { "kind": "tls_client_hello", "dst_ip": "185.28.71.53", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cdni.rt.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-a98a756888b0893468c73f08", "src_port": 49214, "tcp_stream": 57, "udp_stream": null, "frame_number": 702, "timestamp_epoch": "1533964545.824352000" }, { "kind": "tls_client_hello", "dst_ip": "185.28.71.53", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cdni.rt.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-a11820edb9b4a7f7b1f73a58", "src_port": 49215, "tcp_stream": 58, "udp_stream": null, "frame_number": 704, "timestamp_epoch": "1533964545.824437000" }, { "kind": "tls_client_hello", "dst_ip": "136.243.25.70", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pp.lp4.io" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-0ca9dcb6f01950d6ad3a0afc", "src_port": 49200, "tcp_stream": 43, "udp_stream": null, "frame_number": 712, "timestamp_epoch": "1533964545.855496000" }, { "kind": "tls_client_hello", "dst_ip": "136.243.25.70", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pp.lp4.io" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-2a2afc6f2b068ba7222dc361", "src_port": 49201, "tcp_stream": 44, "udp_stream": null, "frame_number": 730, "timestamp_epoch": "1533964545.873598000" }, { "kind": "tls_client_hello", "dst_ip": "178.154.131.215", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "yastatic.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-ccf9ebfae0c5e8ead7349978", "src_port": 49203, "tcp_stream": 46, "udp_stream": null, "frame_number": 741, "timestamp_epoch": "1533964545.878035000" }, { "kind": "tls_client_hello", "dst_ip": "87.240.129.133", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "vk.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-d57d8f107954489f99a7865e", "src_port": 49206, "tcp_stream": 49, "udp_stream": null, "frame_number": 747, "timestamp_epoch": "1533964545.885142000" }, { "kind": "tls_client_hello", "dst_ip": "87.240.129.133", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "vk.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-6a0f013aae824ab2c1f9f8b1", "src_port": 49207, "tcp_stream": 50, "udp_stream": null, "frame_number": 758, "timestamp_epoch": "1533964545.899143000" }, { "kind": "tls_client_hello", "dst_ip": "178.154.131.215", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "yastatic.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-9610c95ba5a2c557311e08ab", "src_port": 49202, "tcp_stream": 45, "udp_stream": null, "frame_number": 770, "timestamp_epoch": "1533964545.905290000" }, { "kind": "tls_client_hello", "dst_ip": "185.28.71.53", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cdni.rt.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-596a1475f73e5ef1555aed91", "src_port": 49216, "tcp_stream": 59, "udp_stream": null, "frame_number": 1264, "timestamp_epoch": "1533964546.538622000" }, { "kind": "tls_client_hello", "dst_ip": "185.28.71.53", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cdni.rt.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-e888ce9ba0f30c366c92d0de", "src_port": 49217, "tcp_stream": 60, "udp_stream": null, "frame_number": 1266, "timestamp_epoch": "1533964546.538863000" }, { "kind": "tls_client_hello", "dst_ip": "185.28.71.53", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cdni.rt.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-a1717d28794ffd357bbb7ecf", "src_port": 49219, "tcp_stream": 62, "udp_stream": null, "frame_number": 2255, "timestamp_epoch": "1533964549.224979000" }, { "kind": "tls_client_hello", "dst_ip": "185.28.71.53", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cdni.rt.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-545f8d9d2dcf9d3a9903e012", "src_port": 49218, "tcp_stream": 61, "udp_stream": null, "frame_number": 2257, "timestamp_epoch": "1533964549.225497000" }, { "kind": "tls_client_hello", "dst_ip": "185.28.71.53", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cdni.rt.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-3dbf08176e80d28e8b74ed62", "src_port": 49220, "tcp_stream": 63, "udp_stream": null, "frame_number": 2381, "timestamp_epoch": "1533964549.653129000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.10", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "fonts.googleapis.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-a39d714748e4d2e6e32d84c9", "src_port": 49221, "tcp_stream": 64, "udp_stream": null, "frame_number": 2517, "timestamp_epoch": "1533964550.141655000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.10", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "fonts.googleapis.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-607e35fb47cfb3c68de243d1", "src_port": 49222, "tcp_stream": 65, "udp_stream": null, "frame_number": 2518, "timestamp_epoch": "1533964550.141657000" }, { "kind": "tls_client_hello", "dst_ip": "104.20.21.239", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "rum-static.pingdom.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-ca5dc578631e454d41100b6a", "src_port": 49224, "tcp_stream": 66, "udp_stream": null, "frame_number": 3236, "timestamp_epoch": "1533964552.452729000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.194.162", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "www.googletagservices.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-793cc1ca73a5649f6b2fc3b8", "src_port": 49226, "tcp_stream": 69, "udp_stream": null, "frame_number": 3238, "timestamp_epoch": "1533964552.452910000" }, { "kind": "tls_client_hello", "dst_ip": "104.20.21.239", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "rum-static.pingdom.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-d6bc3cdb95efd698fa0c1492", "src_port": 49223, "tcp_stream": 67, "udp_stream": null, "frame_number": 3244, "timestamp_epoch": "1533964552.457149000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.194.162", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "www.googletagservices.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-3a022c02e94ea8e4d12546cb", "src_port": 49225, "tcp_stream": 68, "udp_stream": null, "frame_number": 3246, "timestamp_epoch": "1533964552.457436000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.3", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "fonts.gstatic.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-946f1e027afce2cd19b39962", "src_port": 49231, "tcp_stream": 74, "udp_stream": null, "frame_number": 3264, "timestamp_epoch": "1533964552.477001000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.3", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "fonts.gstatic.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-5d027d868150d49d2eac9a09", "src_port": 49232, "tcp_stream": 75, "udp_stream": null, "frame_number": 3266, "timestamp_epoch": "1533964552.477100000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.3", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "fonts.gstatic.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-4671014b07618ac908683026", "src_port": 49230, "tcp_stream": 73, "udp_stream": null, "frame_number": 3267, "timestamp_epoch": "1533964552.477139000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.6.78", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "www.youtube.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-e83cb8884c84cb560947ba8e", "src_port": 49238, "tcp_stream": 81, "udp_stream": null, "frame_number": 3318, "timestamp_epoch": "1533964552.685613000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.6.78", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "www.youtube.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-e50f6bdd2d34839ba70b72ac", "src_port": 49237, "tcp_stream": 80, "udp_stream": null, "frame_number": 3321, "timestamp_epoch": "1533964552.686031000" }, { "kind": "tls_client_hello", "dst_ip": "207.244.80.166", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "www.rt.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-4af58d7460b0d647ee0de99d", "src_port": 49234, "tcp_stream": 77, "udp_stream": null, "frame_number": 3376, "timestamp_epoch": "1533964552.740894000" }, { "kind": "tls_client_hello", "dst_ip": "207.244.80.166", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "www.rt.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-8558d21547e764a7c6ae2203", "src_port": 49227, "tcp_stream": 70, "udp_stream": null, "frame_number": 3378, "timestamp_epoch": "1533964552.741152000" }, { "kind": "tls_client_hello", "dst_ip": "207.244.80.166", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "www.rt.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-20bc608edc1e9f51a41bba95", "src_port": 49235, "tcp_stream": 78, "udp_stream": null, "frame_number": 3380, "timestamp_epoch": "1533964552.741239000" }, { "kind": "tls_client_hello", "dst_ip": "207.244.80.166", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "www.rt.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-b686203f48d567ee73852079", "src_port": 49236, "tcp_stream": 79, "udp_stream": null, "frame_number": 3382, "timestamp_epoch": "1533964552.741451000" }, { "kind": "tls_client_hello", "dst_ip": "207.244.80.166", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "www.rt.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-0e525da5be086f3653fdf0c4", "src_port": 49233, "tcp_stream": 76, "udp_stream": null, "frame_number": 3384, "timestamp_epoch": "1533964552.741554000" }, { "kind": "tls_client_hello", "dst_ip": "213.180.193.90", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "an.yandex.ru" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-ca1bf20f89c44a597f7a0c00", "src_port": 49228, "tcp_stream": 71, "udp_stream": null, "frame_number": 3430, "timestamp_epoch": "1533964552.803227000" }, { "kind": "tls_client_hello", "dst_ip": "213.180.193.90", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "an.yandex.ru" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-16c446e57889405234a7a164", "src_port": 49229, "tcp_stream": 72, "udp_stream": null, "frame_number": 3432, "timestamp_epoch": "1533964552.803334000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.14", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "www.google-analytics.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-d68fc2b09deadee5689a2082", "src_port": 49246, "tcp_stream": 89, "udp_stream": null, "frame_number": 3448, "timestamp_epoch": "1533964552.872865000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.14", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "www.google-analytics.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-222c6b060da700720eca334e", "src_port": 49245, "tcp_stream": 88, "udp_stream": null, "frame_number": 3452, "timestamp_epoch": "1533964552.874123000" }, { "kind": "tls_client_hello", "dst_ip": "104.25.163.34", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tru.am" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-ce9ad6657073808912d2c8f8", "src_port": 49249, "tcp_stream": 92, "udp_stream": null, "frame_number": 3486, "timestamp_epoch": "1533964552.880734000" }, { "kind": "tls_client_hello", "dst_ip": "104.25.163.34", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tru.am" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-5b0af8bc715973b969d9b8e6", "src_port": 49250, "tcp_stream": 93, "udp_stream": null, "frame_number": 3494, "timestamp_epoch": "1533964552.882566000" }, { "kind": "tls_client_hello", "dst_ip": "23.55.50.209", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "sb.scorecardresearch.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-626dc54ad6dc7699a72436b8", "src_port": 49248, "tcp_stream": 91, "udp_stream": null, "frame_number": 3496, "timestamp_epoch": "1533964552.884239000" }, { "kind": "tls_client_hello", "dst_ip": "23.55.50.209", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "sb.scorecardresearch.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-9563ec4384aceb8b7a5b64ab", "src_port": 49247, "tcp_stream": 90, "udp_stream": null, "frame_number": 3504, "timestamp_epoch": "1533964552.885100000" }, { "kind": "tls_client_hello", "dst_ip": "88.212.196.123", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "counter.yadro.ru" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-d789a6984fda4de9e1a1fd3c", "src_port": 49240, "tcp_stream": 83, "udp_stream": null, "frame_number": 3529, "timestamp_epoch": "1533964552.955577000" }, { "kind": "tls_client_hello", "dst_ip": "88.212.196.123", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "counter.yadro.ru" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-19ee2056063373c9e4024045", "src_port": 49239, "tcp_stream": 82, "udp_stream": null, "frame_number": 3536, "timestamp_epoch": "1533964552.957535000" }, { "kind": "tls_client_hello", "dst_ip": "194.226.130.229", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "www.tns-counter.ru" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-73d015cde47e93537d49dbb1", "src_port": 49242, "tcp_stream": 85, "udp_stream": null, "frame_number": 3557, "timestamp_epoch": "1533964552.967444000" }, { "kind": "tls_client_hello", "dst_ip": "93.158.134.119", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "mc.yandex.ru" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-c03e293a48df5f1f67d4027d", "src_port": 49243, "tcp_stream": 87, "udp_stream": null, "frame_number": 3558, "timestamp_epoch": "1533964552.967445000" }, { "kind": "tls_client_hello", "dst_ip": "93.158.134.119", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "mc.yandex.ru" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-9f79d0fddc191cfc40cb78a8", "src_port": 49244, "tcp_stream": 86, "udp_stream": null, "frame_number": 3561, "timestamp_epoch": "1533964552.967829000" }, { "kind": "tls_client_hello", "dst_ip": "194.226.130.229", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "www.tns-counter.ru" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-ee7aff84e7e36e8d0c027e72", "src_port": 49241, "tcp_stream": 84, "udp_stream": null, "frame_number": 3563, "timestamp_epoch": "1533964552.967938000" }, { "kind": "tls_client_hello", "dst_ip": "207.244.80.166", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "www.rt.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-f66ac60b448bc3e9c3718ced", "src_port": 49252, "tcp_stream": 94, "udp_stream": null, "frame_number": 3768, "timestamp_epoch": "1533964553.364593000" }, { "kind": "tls_client_hello", "dst_ip": "207.244.80.166", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "www.rt.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-3f1183c6a56142e711bd8db6", "src_port": 49251, "tcp_stream": 95, "udp_stream": null, "frame_number": 3770, "timestamp_epoch": "1533964553.365363000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.6.78", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "www.youtube.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-127c788acadad3a32911eedf", "src_port": 49255, "tcp_stream": 98, "udp_stream": null, "frame_number": 3953, "timestamp_epoch": "1533964553.582136000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.6.78", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "www.youtube.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-f064eaaeeb60b69add9d9da3", "src_port": 49253, "tcp_stream": 96, "udp_stream": null, "frame_number": 3955, "timestamp_epoch": "1533964553.582237000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.6.78", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "www.youtube.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-7c0b4e48f05a52f88f490117", "src_port": 49254, "tcp_stream": 97, "udp_stream": null, "frame_number": 3969, "timestamp_epoch": "1533964553.584391000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.194.162", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "adservice.google.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-19b2c3dd08b9ebcfee406b24", "src_port": 49257, "tcp_stream": 99, "udp_stream": null, "frame_number": 4029, "timestamp_epoch": "1533964553.660668000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.194.162", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "adservice.google.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-7221435cc85eed8d2ecbc7a2", "src_port": 49258, "tcp_stream": 100, "udp_stream": null, "frame_number": 4031, "timestamp_epoch": "1533964553.662840000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.2", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "securepubads.g.doubleclick.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-6b788877181216a4062d1f06", "src_port": 49256, "tcp_stream": 101, "udp_stream": null, "frame_number": 4033, "timestamp_epoch": "1533964553.663008000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.2", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "securepubads.g.doubleclick.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-9c03b38251ba3bab54e32f45", "src_port": 49259, "tcp_stream": 102, "udp_stream": null, "frame_number": 4037, "timestamp_epoch": "1533964553.663428000" }, { "kind": "tls_client_hello", "dst_ip": "74.125.195.156", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "stats.g.doubleclick.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-1a757c2315f91fd87e0c3d36", "src_port": 49262, "tcp_stream": 105, "udp_stream": null, "frame_number": 4404, "timestamp_epoch": "1533964554.396779000" }, { "kind": "tls_client_hello", "dst_ip": "74.125.195.156", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "stats.g.doubleclick.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-f7643d001480496caffb0073", "src_port": 49263, "tcp_stream": 106, "udp_stream": null, "frame_number": 4412, "timestamp_epoch": "1533964554.397822000" }, { "kind": "tls_client_hello", "dst_ip": "173.241.250.220", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ruptly-d.openx.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-c2bcb7d755e32a64576015ec", "src_port": 49265, "tcp_stream": 108, "udp_stream": null, "frame_number": 4626, "timestamp_epoch": "1533964555.042529000" }, { "kind": "tls_client_hello", "dst_ip": "173.241.250.220", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ruptly-d.openx.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-b810f1cb15a17ee1ed32dd32", "src_port": 49264, "tcp_stream": 107, "udp_stream": null, "frame_number": 4629, "timestamp_epoch": "1533964555.043031000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.4", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "www.google.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-ebd796aebf5b099073ad60d2", "src_port": 49266, "tcp_stream": 109, "udp_stream": null, "frame_number": 4775, "timestamp_epoch": "1533964555.360271000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.4", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "www.google.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-4f9d207abf14962f483d1d68", "src_port": 49267, "tcp_stream": 110, "udp_stream": null, "frame_number": 4777, "timestamp_epoch": "1533964555.360273000" }, { "kind": "tls_client_hello", "dst_ip": "173.241.250.143", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "us-u.openx.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-c715a0f5ce398579c8a3d4c9", "src_port": 49268, "tcp_stream": 111, "udp_stream": null, "frame_number": 4925, "timestamp_epoch": "1533964555.708590000" }, { "kind": "tls_client_hello", "dst_ip": "173.241.250.143", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "us-u.openx.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-71ef6c0594a9097a338c9a02", "src_port": 49269, "tcp_stream": 112, "udp_stream": null, "frame_number": 4934, "timestamp_epoch": "1533964555.710501000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.1", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tpc.googlesyndication.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-f278eee7afa2500653213219", "src_port": 49270, "tcp_stream": 113, "udp_stream": null, "frame_number": 4986, "timestamp_epoch": "1533964555.774473000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.1", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tpc.googlesyndication.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-5e8e93fcc73585a4d36dab99", "src_port": 49271, "tcp_stream": 114, "udp_stream": null, "frame_number": 4996, "timestamp_epoch": "1533964555.787234000" }, { "kind": "tls_client_hello", "dst_ip": "74.6.34.27", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pr-bh.ybp.yahoo.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-ff7ce5c7c926859ce177fe3b", "src_port": 49274, "tcp_stream": 117, "udp_stream": null, "frame_number": 5184, "timestamp_epoch": "1533964556.077465000" }, { "kind": "tls_client_hello", "dst_ip": "74.6.34.27", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pr-bh.ybp.yahoo.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-cd75127b2f0e0909bc8bde2f", "src_port": 49275, "tcp_stream": 118, "udp_stream": null, "frame_number": 5188, "timestamp_epoch": "1533964556.079603000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.6.66", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cm.g.doubleclick.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-734b4d831e0a0c9be574aa2d", "src_port": 49281, "tcp_stream": 124, "udp_stream": null, "frame_number": 5207, "timestamp_epoch": "1533964556.093107000" }, { "kind": "tls_client_hello", "dst_ip": "69.194.244.11", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ad.turn.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-96fba1725497ac2ed1d53bf4", "src_port": 49279, "tcp_stream": 122, "udp_stream": null, "frame_number": 5211, "timestamp_epoch": "1533964556.093873000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.6.66", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cm.g.doubleclick.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-9cbf2ced536dc49da32280c2", "src_port": 49278, "tcp_stream": 121, "udp_stream": null, "frame_number": 5212, "timestamp_epoch": "1533964556.093986000" }, { "kind": "tls_client_hello", "dst_ip": "151.101.2.49", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "sync-tm.everesttech.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-d92b0baa26f1bc26f4e02b5d", "src_port": 49282, "tcp_stream": 125, "udp_stream": null, "frame_number": 5214, "timestamp_epoch": "1533964556.094107000" }, { "kind": "tls_client_hello", "dst_ip": "69.194.244.11", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ad.turn.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-518069037b08d257ba1e898b", "src_port": 49280, "tcp_stream": 123, "udp_stream": null, "frame_number": 5216, "timestamp_epoch": "1533964556.094416000" }, { "kind": "tls_client_hello", "dst_ip": "151.101.2.49", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "sync-tm.everesttech.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-9dc8f07fe545c0cad168e71e", "src_port": 49283, "tcp_stream": 126, "udp_stream": null, "frame_number": 5218, "timestamp_epoch": "1533964556.094443000" }, { "kind": "tls_client_hello", "dst_ip": "216.200.232.221", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "sync.mathtag.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-106748974dd9fc9d5f8aeea1", "src_port": 49272, "tcp_stream": 115, "udp_stream": null, "frame_number": 5234, "timestamp_epoch": "1533964556.109083000" }, { "kind": "tls_client_hello", "dst_ip": "216.200.232.221", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "sync.mathtag.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-74d8a84eac910e5252c73bc6", "src_port": 49273, "tcp_stream": 116, "udp_stream": null, "frame_number": 5237, "timestamp_epoch": "1533964556.109634000" }, { "kind": "tls_client_hello", "dst_ip": "54.186.116.83", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "match.adsrvr.org" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-f545b68a8f6322709981ae82", "src_port": 49277, "tcp_stream": 120, "udp_stream": null, "frame_number": 5245, "timestamp_epoch": "1533964556.112608000" }, { "kind": "tls_client_hello", "dst_ip": "54.186.116.83", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "match.adsrvr.org" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-0caf32a6c64884aee858b1ee", "src_port": 49276, "tcp_stream": 119, "udp_stream": null, "frame_number": 5246, "timestamp_epoch": "1533964556.112610000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.3", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "fonts.gstatic.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-4125ef1eabdae06a5bceac1b", "src_port": 49286, "tcp_stream": 129, "udp_stream": null, "frame_number": 5477, "timestamp_epoch": "1533964556.949763000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.194.162", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "googleads.g.doubleclick.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-c7d143d247347647070297c6", "src_port": 49288, "tcp_stream": 131, "udp_stream": null, "frame_number": 5484, "timestamp_epoch": "1533964556.953322000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.194.162", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "googleads.g.doubleclick.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-877f1107b688302eb7e70170", "src_port": 49287, "tcp_stream": 130, "udp_stream": null, "frame_number": 5489, "timestamp_epoch": "1533964556.954242000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.6", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "static.doubleclick.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-8c03ff28dc2dc4efb85b4560", "src_port": 49289, "tcp_stream": 132, "udp_stream": null, "frame_number": 5541, "timestamp_epoch": "1533964557.014836000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.6", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "static.doubleclick.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-0641021890deaa3821da254c", "src_port": 49290, "tcp_stream": 133, "udp_stream": null, "frame_number": 5551, "timestamp_epoch": "1533964557.021044000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.0.54", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "i.ytimg.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-f71c1060bf6cffe028737767", "src_port": 49292, "tcp_stream": 135, "udp_stream": null, "frame_number": 5705, "timestamp_epoch": "1533964558.825936000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.0.54", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "i.ytimg.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-b3d59f6c529702a1ddb7a70a", "src_port": 49291, "tcp_stream": 134, "udp_stream": null, "frame_number": 5707, "timestamp_epoch": "1533964558.827148000" }, { "kind": "tls_client_hello", "dst_ip": "13.33.106.254", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "static.chartbeat.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-e07f290928ad02ec60508ed5", "src_port": 49295, "tcp_stream": 138, "udp_stream": null, "frame_number": 5881, "timestamp_epoch": "1533964559.508438000" }, { "kind": "tls_client_hello", "dst_ip": "104.20.21.239", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "rum-collector.pingdom.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-25f5dd744b1b451b00a00ddb", "src_port": 49299, "tcp_stream": 142, "udp_stream": null, "frame_number": 5883, "timestamp_epoch": "1533964559.508584000" }, { "kind": "tls_client_hello", "dst_ip": "13.33.106.254", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "static.chartbeat.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-6a4169037897a07050fcd669", "src_port": 49296, "tcp_stream": 139, "udp_stream": null, "frame_number": 5887, "timestamp_epoch": "1533964559.509117000" }, { "kind": "tls_client_hello", "dst_ip": "104.20.21.239", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "rum-collector.pingdom.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-9a2f8e761fbb34d0e7db9cf0", "src_port": 49300, "tcp_stream": 143, "udp_stream": null, "frame_number": 5891, "timestamp_epoch": "1533964559.512892000" }, { "kind": "tls_client_hello", "dst_ip": "69.174.248.228", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pixel-sync.sitescout.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-ad4177428f1f2498f4736e05", "src_port": 49302, "tcp_stream": 145, "udp_stream": null, "frame_number": 5900, "timestamp_epoch": "1533964559.530894000" }, { "kind": "tls_client_hello", "dst_ip": "69.174.248.228", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pixel-sync.sitescout.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-d78bb37ce99415d29f4480bb", "src_port": 49301, "tcp_stream": 144, "udp_stream": null, "frame_number": 5901, "timestamp_epoch": "1533964559.530984000" }, { "kind": "tls_client_hello", "dst_ip": "198.23.90.60", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "um.simpli.fi" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-c45a8b9c07b3307d41be81e7", "src_port": 49304, "tcp_stream": 147, "udp_stream": null, "frame_number": 5913, "timestamp_epoch": "1533964559.549609000" }, { "kind": "tls_client_hello", "dst_ip": "173.241.250.104", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "rtb.openx.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-663cf74a697be07ad13e67dc", "src_port": 49303, "tcp_stream": 146, "udp_stream": null, "frame_number": 5917, "timestamp_epoch": "1533964559.549991000" }, { "kind": "tls_client_hello", "dst_ip": "136.243.25.70", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pp.lp4.io" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-d356a13da26fb12a97a158e1", "src_port": 49293, "tcp_stream": 136, "udp_stream": null, "frame_number": 5919, "timestamp_epoch": "1533964559.550519000" }, { "kind": "tls_client_hello", "dst_ip": "198.23.90.60", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "um.simpli.fi" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-70723ab251ca22a90f2084f1", "src_port": 49306, "tcp_stream": 149, "udp_stream": null, "frame_number": 5920, "timestamp_epoch": "1533964559.550654000" }, { "kind": "tls_client_hello", "dst_ip": "136.243.25.70", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pp.lp4.io" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-6412b67efac051ceec6db359", "src_port": 49294, "tcp_stream": 137, "udp_stream": null, "frame_number": 5922, "timestamp_epoch": "1533964559.550786000" }, { "kind": "tls_client_hello", "dst_ip": "173.241.250.104", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "rtb.openx.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-219418f6db3137084d261c1f", "src_port": 49305, "tcp_stream": 148, "udp_stream": null, "frame_number": 5923, "timestamp_epoch": "1533964559.550920000" }, { "kind": "tls_client_hello", "dst_ip": "149.174.66.131", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ox.pxl.ace.advertising.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-9d9428340c4e6e7f91433910", "src_port": 49307, "tcp_stream": 150, "udp_stream": null, "frame_number": 5940, "timestamp_epoch": "1533964559.589148000" }, { "kind": "tls_client_hello", "dst_ip": "149.174.66.131", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ox.pxl.ace.advertising.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-d5acff7a50e43c6e219285fa", "src_port": 49308, "tcp_stream": 151, "udp_stream": null, "frame_number": 5950, "timestamp_epoch": "1533964559.594136000" }, { "kind": "tls_client_hello", "dst_ip": "34.246.244.104", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "rum-collector-2.pingdom.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-45d990c445bcc5b8202b665b", "src_port": 49297, "tcp_stream": 140, "udp_stream": null, "frame_number": 5996, "timestamp_epoch": "1533964559.652325000" }, { "kind": "tls_client_hello", "dst_ip": "34.246.244.104", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "rum-collector-2.pingdom.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-72b4f3b885c97f8f883b3811", "src_port": 49298, "tcp_stream": 141, "udp_stream": null, "frame_number": 5998, "timestamp_epoch": "1533964559.652692000" }, { "kind": "tls_client_hello", "dst_ip": "69.174.248.228", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pixel.sitescout.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-02b4d385eed70a0be8ce9402", "src_port": 49311, "tcp_stream": 154, "udp_stream": null, "frame_number": 6163, "timestamp_epoch": "1533964559.928446000" }, { "kind": "tls_client_hello", "dst_ip": "69.174.248.228", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pixel.sitescout.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-23ab127ef27738a80c97dc87", "src_port": 49312, "tcp_stream": 155, "udp_stream": null, "frame_number": 6165, "timestamp_epoch": "1533964559.928564000" }, { "kind": "tls_client_hello", "dst_ip": "98.136.101.121", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ads.yahoo.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-4b18770913c2cd9cff29461a", "src_port": 49310, "tcp_stream": 153, "udp_stream": null, "frame_number": 6171, "timestamp_epoch": "1533964559.929820000" }, { "kind": "tls_client_hello", "dst_ip": "98.136.101.121", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ads.yahoo.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-af5ea4700e5d1ddc01d0423f", "src_port": 49309, "tcp_stream": 152, "udp_stream": null, "frame_number": 6172, "timestamp_epoch": "1533964559.929935000" }, { "kind": "tls_client_hello", "dst_ip": "50.16.201.198", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ping.chartbeat.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-587a4ed2af0a0130562380d8", "src_port": 49313, "tcp_stream": 156, "udp_stream": null, "frame_number": 6210, "timestamp_epoch": "1533964560.054258000" }, { "kind": "tls_client_hello", "dst_ip": "50.16.201.198", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ping.chartbeat.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-9a9eb778f3c4c66920df85ba", "src_port": 49314, "tcp_stream": 157, "udp_stream": null, "frame_number": 6214, "timestamp_epoch": "1533964560.058896000" }, { "kind": "tls_client_hello", "dst_ip": "67.195.229.45", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cookiex.ngd.yahoo.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-93efa3d865f48ecb5f19799f", "src_port": 49317, "tcp_stream": 160, "udp_stream": null, "frame_number": 6299, "timestamp_epoch": "1533964560.408414000" }, { "kind": "tls_client_hello", "dst_ip": "67.195.229.45", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cookiex.ngd.yahoo.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-948ebd7d74e368d8d93f39fa", "src_port": 49318, "tcp_stream": 161, "udp_stream": null, "frame_number": 6301, "timestamp_epoch": "1533964560.408600000" }, { "kind": "tls_client_hello", "dst_ip": "199.38.167.128", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "p.rfihub.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-0e1f51c7260ca2049761d3a3", "src_port": 49319, "tcp_stream": 162, "udp_stream": null, "frame_number": 6340, "timestamp_epoch": "1533964560.688711000" }, { "kind": "tls_client_hello", "dst_ip": "199.38.167.128", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "p.rfihub.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-0a89b4a89b5060590e320887", "src_port": 49320, "tcp_stream": 163, "udp_stream": null, "frame_number": 6344, "timestamp_epoch": "1533964560.711802000" }, { "kind": "tls_client_hello", "dst_ip": "72.21.81.200", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "iecvlist.microsoft.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-7e5d2f4e964efb8b74a0451c", "src_port": 49322, "tcp_stream": 165, "udp_stream": null, "frame_number": 6520, "timestamp_epoch": "1533964574.443493000" }, { "kind": "tls_client_hello", "dst_ip": "72.21.81.200", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "iecvlist.microsoft.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-9419005b8a2c83e5397896f4", "src_port": 49321, "tcp_stream": 164, "udp_stream": null, "frame_number": 6522, "timestamp_epoch": "1533964574.443681000" }, { "kind": "tls_client_hello", "dst_ip": "87.250.251.37", "fields": { "tls.handshake.ja3": "1d095e68489d3c535297cd8dffb06cb9", "tls.handshake.extensions_server_name": "pop.yandex.com" }, "src_ip": "192.168.1.95", "dst_port": 995, "event_id": "evt-f09e775155ff9010bc5f6503", "src_port": 49323, "tcp_stream": 166, "udp_stream": null, "frame_number": 6571, "timestamp_epoch": "1533964577.639943000" }, { "kind": "tls_client_hello", "dst_ip": "136.243.25.70", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pp.lp4.io" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-d858f8fdf7e777ccc7eab18f", "src_port": 49326, "tcp_stream": 170, "udp_stream": null, "frame_number": 6690, "timestamp_epoch": "1533964622.291023000" }, { "kind": "tls_client_hello", "dst_ip": "136.243.25.70", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pp.lp4.io" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-78890628d7fa61b1635f63cd", "src_port": 49327, "tcp_stream": 171, "udp_stream": null, "frame_number": 6691, "timestamp_epoch": "1533964622.291025000" }, { "kind": "tls_client_hello", "dst_ip": "77.88.21.38", "fields": { "tls.handshake.ja3": "1d095e68489d3c535297cd8dffb06cb9", "tls.handshake.extensions_server_name": "smtp.yandex.com" }, "src_ip": "192.168.1.95", "dst_port": 465, "event_id": "evt-d17d2d235b00c86d5d1d92c0", "src_port": 49328, "tcp_stream": 172, "udp_stream": null, "frame_number": 7093, "timestamp_epoch": "1533964677.699779000" }, { "kind": "tls_client_hello", "dst_ip": "136.243.25.70", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pp.lp4.io" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-373190f31bc4fba6e2f34ba3", "src_port": 49330, "tcp_stream": 173, "udp_stream": null, "frame_number": 7136, "timestamp_epoch": "1533964682.159024000" }, { "kind": "tls_client_hello", "dst_ip": "136.243.25.70", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pp.lp4.io" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-13e4867acb86a582afefa1a6", "src_port": 49329, "tcp_stream": 174, "udp_stream": null, "frame_number": 7140, "timestamp_epoch": "1533964682.167350000" }, { "kind": "tls_client_hello", "dst_ip": "50.16.201.198", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ping.chartbeat.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-594cd983d92ccb49167627f2", "src_port": 49332, "tcp_stream": 176, "udp_stream": null, "frame_number": 7174, "timestamp_epoch": "1533964739.950773000" }, { "kind": "tls_client_hello", "dst_ip": "50.16.201.198", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ping.chartbeat.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-507cd340f45707e2560d10df", "src_port": 49331, "tcp_stream": 175, "udp_stream": null, "frame_number": 7180, "timestamp_epoch": "1533964739.962159000" }, { "kind": "tls_client_hello", "dst_ip": "87.250.251.37", "fields": { "tls.handshake.ja3": "1d095e68489d3c535297cd8dffb06cb9", "tls.handshake.extensions_server_name": "pop.yandex.com" }, "src_ip": "192.168.1.95", "dst_port": 995, "event_id": "evt-b97c781a77183bf48e18140b", "src_port": 49333, "tcp_stream": 177, "udp_stream": null, "frame_number": 7200, "timestamp_epoch": "1533964761.191924000" }, { "kind": "tls_client_hello", "dst_ip": "50.16.201.198", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ping.chartbeat.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-5fef124003a7ecf1f09ba842", "src_port": 49337, "tcp_stream": 180, "udp_stream": null, "frame_number": 7347, "timestamp_epoch": "1533964875.352644000" }, { "kind": "tls_client_hello", "dst_ip": "50.16.201.198", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ping.chartbeat.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-143b6ca63835845c4086dab8", "src_port": 49336, "tcp_stream": 181, "udp_stream": null, "frame_number": 7349, "timestamp_epoch": "1533964875.352768000" }, { "kind": "tls_client_hello", "dst_ip": "136.243.25.70", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pp.lp4.io" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-e6d0c6a2affae05b27510aa2", "src_port": 49339, "tcp_stream": 183, "udp_stream": null, "frame_number": 7378, "timestamp_epoch": "1533964894.375662000" }, { "kind": "tls_client_hello", "dst_ip": "136.243.25.70", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pp.lp4.io" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-4ae4020e55a299c8dd2f5a07", "src_port": 49338, "tcp_stream": 182, "udp_stream": null, "frame_number": 7382, "timestamp_epoch": "1533964894.376436000" }, { "kind": "tls_client_hello", "dst_ip": "207.244.80.166", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "www.rt.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-e0b6558f9fe06e9f7309c3eb", "src_port": 49342, "tcp_stream": 186, "udp_stream": null, "frame_number": 7410, "timestamp_epoch": "1533964896.704230000" }, { "kind": "tls_client_hello", "dst_ip": "207.244.80.166", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "www.rt.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-00a9293744c84ca820deb37c", "src_port": 49343, "tcp_stream": 187, "udp_stream": null, "frame_number": 7414, "timestamp_epoch": "1533964896.704820000" }, { "kind": "tls_client_hello", "dst_ip": "93.158.134.119", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "mc.yandex.ru" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-584bc78b7a3cce76a01d7e7d", "src_port": 49340, "tcp_stream": 184, "udp_stream": null, "frame_number": 7420, "timestamp_epoch": "1533964896.798333000" }, { "kind": "tls_client_hello", "dst_ip": "93.158.134.119", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "mc.yandex.ru" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-f090f376d3516c837a5291c4", "src_port": 49341, "tcp_stream": 185, "udp_stream": null, "frame_number": 7422, "timestamp_epoch": "1533964896.798517000" }, { "kind": "tls_client_hello", "dst_ip": "185.28.71.53", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cdni.rt.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-ce0615cfa8141b6d67ada2dc", "src_port": 49344, "tcp_stream": 188, "udp_stream": null, "frame_number": 7493, "timestamp_epoch": "1533964897.294499000" }, { "kind": "tls_client_hello", "dst_ip": "185.28.71.53", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cdni.rt.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-3eb6e113e684c27cea3b99c2", "src_port": 49346, "tcp_stream": 190, "udp_stream": null, "frame_number": 7501, "timestamp_epoch": "1533964897.294992000" }, { "kind": "tls_client_hello", "dst_ip": "185.28.71.53", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cdni.rt.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-a12987991e35032d4e4f8f0d", "src_port": 49347, "tcp_stream": 191, "udp_stream": null, "frame_number": 7503, "timestamp_epoch": "1533964897.295172000" }, { "kind": "tls_client_hello", "dst_ip": "185.28.71.53", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cdni.rt.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-cff09cd51015b6dbf7137171", "src_port": 49345, "tcp_stream": 189, "udp_stream": null, "frame_number": 7505, "timestamp_epoch": "1533964897.295174000" }, { "kind": "tls_client_hello", "dst_ip": "185.28.71.53", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cdni.rt.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-dac52ef0f2021e270e8a675d", "src_port": 49349, "tcp_stream": 193, "udp_stream": null, "frame_number": 7511, "timestamp_epoch": "1533964897.295895000" }, { "kind": "tls_client_hello", "dst_ip": "185.28.71.53", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cdni.rt.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-d66ae0237e6b6c0100a92531", "src_port": 49348, "tcp_stream": 192, "udp_stream": null, "frame_number": 7513, "timestamp_epoch": "1533964897.295919000" }, { "kind": "tls_client_hello", "dst_ip": "205.185.216.42", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "launcher.spot.im" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-864f97d4e3dc6c9ac1cd7077", "src_port": 49351, "tcp_stream": 195, "udp_stream": null, "frame_number": 7552, "timestamp_epoch": "1533964897.403131000" }, { "kind": "tls_client_hello", "dst_ip": "205.185.216.42", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "launcher.spot.im" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-a3042d5beb3fc9bb3430dae2", "src_port": 49350, "tcp_stream": 194, "udp_stream": null, "frame_number": 7554, "timestamp_epoch": "1533964897.403225000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.194.162", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "adservice.google.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-46911efeaed762883ba961b4", "src_port": 49353, "tcp_stream": 197, "udp_stream": null, "frame_number": 7831, "timestamp_epoch": "1533964897.703908000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.194.162", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "adservice.google.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-a507a11007a5fa7a218a2142", "src_port": 49352, "tcp_stream": 196, "udp_stream": null, "frame_number": 7833, "timestamp_epoch": "1533964897.704223000" }, { "kind": "tls_client_hello", "dst_ip": "173.241.250.220", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ruptly-d.openx.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-17fcde426cfe0733afcee970", "src_port": 49355, "tcp_stream": 199, "udp_stream": null, "frame_number": 7944, "timestamp_epoch": "1533964897.818985000" }, { "kind": "tls_client_hello", "dst_ip": "173.241.250.220", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ruptly-d.openx.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-2d2705d2477dc6cade718ea3", "src_port": 49354, "tcp_stream": 198, "udp_stream": null, "frame_number": 7946, "timestamp_epoch": "1533964897.819227000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.6.78", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "www.youtube.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-c4df18bde637feccb304f6bb", "src_port": 49359, "tcp_stream": 203, "udp_stream": null, "frame_number": 8129, "timestamp_epoch": "1533964897.943050000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.6.78", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "www.youtube.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-715e087426ed7aa4070c74a9", "src_port": 49358, "tcp_stream": 202, "udp_stream": null, "frame_number": 8131, "timestamp_epoch": "1533964897.943323000" }, { "kind": "tls_client_hello", "dst_ip": "213.180.193.90", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "an.yandex.ru" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-3e6c7b609fe9e9fbf2d66994", "src_port": 49357, "tcp_stream": 201, "udp_stream": null, "frame_number": 8338, "timestamp_epoch": "1533964898.152886000" }, { "kind": "tls_client_hello", "dst_ip": "213.180.193.90", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "an.yandex.ru" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-11aeff32891c38d58d57261b", "src_port": 49356, "tcp_stream": 200, "udp_stream": null, "frame_number": 8340, "timestamp_epoch": "1533964898.153065000" }, { "kind": "tls_client_hello", "dst_ip": "23.220.174.162", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "widget.engageya.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-b1d6f2faa6972677abdf134a", "src_port": 49363, "tcp_stream": 207, "udp_stream": null, "frame_number": 8377, "timestamp_epoch": "1533964898.226439000" }, { "kind": "tls_client_hello", "dst_ip": "23.220.174.162", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "widget.engageya.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-cf9b2defea931b3bc88b5619", "src_port": 49362, "tcp_stream": 206, "udp_stream": null, "frame_number": 8379, "timestamp_epoch": "1533964898.226623000" }, { "kind": "tls_client_hello", "dst_ip": "173.0.153.44", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "mixi.media" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-bd5355f811a16f1a42c6cf5f", "src_port": 49361, "tcp_stream": 205, "udp_stream": null, "frame_number": 8405, "timestamp_epoch": "1533964898.230941000" }, { "kind": "tls_client_hello", "dst_ip": "23.55.50.209", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "sb.scorecardresearch.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-a9831ea0ad30b459dccaefe1", "src_port": 49368, "tcp_stream": 212, "udp_stream": null, "frame_number": 8415, "timestamp_epoch": "1533964898.250583000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.14", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "www.google-analytics.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-d7093bba7c3fdc7c9a883c50", "src_port": 49370, "tcp_stream": 214, "udp_stream": null, "frame_number": 8417, "timestamp_epoch": "1533964898.250746000" }, { "kind": "tls_client_hello", "dst_ip": "23.55.50.209", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "sb.scorecardresearch.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-00b10a68786f87f51ab60656", "src_port": 49369, "tcp_stream": 213, "udp_stream": null, "frame_number": 8419, "timestamp_epoch": "1533964898.250855000" }, { "kind": "tls_client_hello", "dst_ip": "173.0.153.44", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "mixi.media" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-02f6bb501c4eb1f20d46ff68", "src_port": 49360, "tcp_stream": 204, "udp_stream": null, "frame_number": 8421, "timestamp_epoch": "1533964898.251259000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.14", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "www.google-analytics.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-abf3d36e2a807443076a470e", "src_port": 49371, "tcp_stream": 215, "udp_stream": null, "frame_number": 8425, "timestamp_epoch": "1533964898.266221000" }, { "kind": "tls_client_hello", "dst_ip": "194.226.130.229", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "www.tns-counter.ru" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-8f833075a7bea842f5ddf948", "src_port": 49367, "tcp_stream": 211, "udp_stream": null, "frame_number": 8454, "timestamp_epoch": "1533964898.311765000" }, { "kind": "tls_client_hello", "dst_ip": "194.226.130.229", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "www.tns-counter.ru" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-3d843c0d9f7b3f8247cc68c0", "src_port": 49366, "tcp_stream": 210, "udp_stream": null, "frame_number": 8477, "timestamp_epoch": "1533964898.327920000" }, { "kind": "tls_client_hello", "dst_ip": "88.212.196.123", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "counter.yadro.ru" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-39cd3c1ef1f4276bce379171", "src_port": 49365, "tcp_stream": 209, "udp_stream": null, "frame_number": 8485, "timestamp_epoch": "1533964898.334174000" }, { "kind": "tls_client_hello", "dst_ip": "88.212.196.123", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "counter.yadro.ru" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-f34fef232bf8e13e8dd7748d", "src_port": 49364, "tcp_stream": 208, "udp_stream": null, "frame_number": 8497, "timestamp_epoch": "1533964898.346644000" }, { "kind": "tls_client_hello", "dst_ip": "104.25.163.34", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "beacon.tru.am" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-b7f255dcea0f1b9c35ec7f04", "src_port": 49372, "tcp_stream": 216, "udp_stream": null, "frame_number": 8555, "timestamp_epoch": "1533964898.435467000" }, { "kind": "tls_client_hello", "dst_ip": "74.125.195.156", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "stats.g.doubleclick.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-f17ed15783d0bb8630f737f5", "src_port": 49375, "tcp_stream": 219, "udp_stream": null, "frame_number": 8691, "timestamp_epoch": "1533964898.653579000" }, { "kind": "tls_client_hello", "dst_ip": "74.125.195.156", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "stats.g.doubleclick.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-34ee550a20b6b7847130265f", "src_port": 49376, "tcp_stream": 220, "udp_stream": null, "frame_number": 8693, "timestamp_epoch": "1533964898.654114000" }, { "kind": "tls_client_hello", "dst_ip": "173.241.250.143", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "us-u.openx.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-f515229accf9b326cc5e1be8", "src_port": 49378, "tcp_stream": 222, "udp_stream": null, "frame_number": 8695, "timestamp_epoch": "1533964898.654670000" }, { "kind": "tls_client_hello", "dst_ip": "173.241.250.143", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "us-u.openx.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-aa20f7938e1eecfd9722c070", "src_port": 49377, "tcp_stream": 221, "udp_stream": null, "frame_number": 8699, "timestamp_epoch": "1533964898.655738000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.2", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "securepubads.g.doubleclick.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-18e7eed1264317be2e6af8f1", "src_port": 49381, "tcp_stream": 225, "udp_stream": null, "frame_number": 8727, "timestamp_epoch": "1533964898.704460000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.2", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "securepubads.g.doubleclick.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-52cbb9b43b62b7e8d8cd0d0c", "src_port": 49382, "tcp_stream": 226, "udp_stream": null, "frame_number": 8729, "timestamp_epoch": "1533964898.704490000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.6.78", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "www.youtube.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-a42331cb8c67c2de2c71c5c8", "src_port": 49385, "tcp_stream": 229, "udp_stream": null, "frame_number": 8743, "timestamp_epoch": "1533964898.710388000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.6.78", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "www.youtube.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-67a172ef0d3d898766fbf15f", "src_port": 49384, "tcp_stream": 228, "udp_stream": null, "frame_number": 8745, "timestamp_epoch": "1533964898.710484000" }, { "kind": "tls_client_hello", "dst_ip": "173.241.250.220", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ruptly-d.openx.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-8089564ea2e87c234e12bb46", "src_port": 49383, "tcp_stream": 227, "udp_stream": null, "frame_number": 8747, "timestamp_epoch": "1533964898.710746000" }, { "kind": "tls_client_hello", "dst_ip": "95.142.20.17", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "recs.engageya.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-dec01aa138f866672170e663", "src_port": 49380, "tcp_stream": 224, "udp_stream": null, "frame_number": 8801, "timestamp_epoch": "1533964898.751838000" }, { "kind": "tls_client_hello", "dst_ip": "95.142.20.17", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "recs.engageya.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-5b892e8041e04ff5093cf2df", "src_port": 49379, "tcp_stream": 223, "udp_stream": null, "frame_number": 8805, "timestamp_epoch": "1533964898.752738000" }, { "kind": "tls_client_hello", "dst_ip": "54.183.95.126", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pixel.advertising.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-eef84e9aea295e3339051134", "src_port": 49397, "tcp_stream": 241, "udp_stream": null, "frame_number": 9013, "timestamp_epoch": "1533964898.995095000" }, { "kind": "tls_client_hello", "dst_ip": "104.254.150.77", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ib.adnxs.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-2b32aeddd6af132e999fa8e7", "src_port": 49391, "tcp_stream": 235, "udp_stream": null, "frame_number": 9015, "timestamp_epoch": "1533964898.995291000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.4", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "www.google.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-df579e4f0a864d797da8554e", "src_port": 49392, "tcp_stream": 236, "udp_stream": null, "frame_number": 9024, "timestamp_epoch": "1533964898.996399000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.4", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "www.google.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-f1f45565db044fb64f81b6e9", "src_port": 49393, "tcp_stream": 237, "udp_stream": null, "frame_number": 9027, "timestamp_epoch": "1533964898.996583000" }, { "kind": "tls_client_hello", "dst_ip": "54.183.95.126", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pixel.advertising.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-4d8286052783250f8b6daeff", "src_port": 49396, "tcp_stream": 240, "udp_stream": null, "frame_number": 9028, "timestamp_epoch": "1533964898.996894000" }, { "kind": "tls_client_hello", "dst_ip": "104.254.150.77", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ib.adnxs.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-6b2a008090c3a9203eb98e28", "src_port": 49388, "tcp_stream": 232, "udp_stream": null, "frame_number": 9029, "timestamp_epoch": "1533964898.996896000" }, { "kind": "tls_client_hello", "dst_ip": "52.89.90.109", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pixel.quantserve.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-bd42b87a18e8eba7d033fcd7", "src_port": 49387, "tcp_stream": 231, "udp_stream": null, "frame_number": 9041, "timestamp_epoch": "1533964899.006328000" }, { "kind": "tls_client_hello", "dst_ip": "52.89.90.109", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pixel.quantserve.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-e3d114d57d833ac822f3357d", "src_port": 49386, "tcp_stream": 230, "udp_stream": null, "frame_number": 9045, "timestamp_epoch": "1533964899.006696000" }, { "kind": "tls_client_hello", "dst_ip": "35.185.244.37", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "x.bidswitch.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-1a3c5c4d4306fe9e41b347d6", "src_port": 49399, "tcp_stream": 243, "udp_stream": null, "frame_number": 9061, "timestamp_epoch": "1533964899.026077000" }, { "kind": "tls_client_hello", "dst_ip": "35.185.244.37", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "x.bidswitch.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-2a05bc7bb08d5be938d78911", "src_port": 49398, "tcp_stream": 242, "udp_stream": null, "frame_number": 9063, "timestamp_epoch": "1533964899.026517000" }, { "kind": "tls_client_hello", "dst_ip": "52.94.232.32", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "s.amazon-adsystem.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-08eec2b3cb2fb69b4b3d7814", "src_port": 49390, "tcp_stream": 234, "udp_stream": null, "frame_number": 9086, "timestamp_epoch": "1533964899.055405000" }, { "kind": "tls_client_hello", "dst_ip": "52.94.232.32", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "s.amazon-adsystem.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-e4268c49ba6cd8f75e1b2881", "src_port": 49389, "tcp_stream": 233, "udp_stream": null, "frame_number": 9088, "timestamp_epoch": "1533964899.055718000" }, { "kind": "tls_client_hello", "dst_ip": "185.167.164.37", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "c1.adform.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-aa4133374a41e41180e2b5c6", "src_port": 49395, "tcp_stream": 239, "udp_stream": null, "frame_number": 9121, "timestamp_epoch": "1533964899.068592000" }, { "kind": "tls_client_hello", "dst_ip": "185.167.164.37", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "c1.adform.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-529e8eefe37ba45df6c07929", "src_port": 49394, "tcp_stream": 238, "udp_stream": null, "frame_number": 9156, "timestamp_epoch": "1533964899.081075000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.194.162", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "googleads.g.doubleclick.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-4e9fa8277741388b7ded7836", "src_port": 49403, "tcp_stream": 247, "udp_stream": null, "frame_number": 9665, "timestamp_epoch": "1533964899.587690000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.1", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tpc.googlesyndication.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-89dfcc05a17727810ddc283f", "src_port": 49404, "tcp_stream": 248, "udp_stream": null, "frame_number": 9666, "timestamp_epoch": "1533964899.587924000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.1", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tpc.googlesyndication.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-cc019e1b330c9640cab918f8", "src_port": 49405, "tcp_stream": 249, "udp_stream": null, "frame_number": 9668, "timestamp_epoch": "1533964899.588139000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.2", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "securepubads.g.doubleclick.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-1db006d2f1bcc4cc604e4529", "src_port": 49406, "tcp_stream": 250, "udp_stream": null, "frame_number": 9672, "timestamp_epoch": "1533964899.588524000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.194.162", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "googleads.g.doubleclick.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-249eae10f925b866cbb43137", "src_port": 49402, "tcp_stream": 246, "udp_stream": null, "frame_number": 9674, "timestamp_epoch": "1533964899.588806000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.194.162", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "googleads.g.doubleclick.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-6666e43736905f0bbecf3a94", "src_port": 49408, "tcp_stream": 252, "udp_stream": null, "frame_number": 9694, "timestamp_epoch": "1533964899.600626000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.194.162", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "googleads.g.doubleclick.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-47ccc12c150976ee2674749b", "src_port": 49407, "tcp_stream": 251, "udp_stream": null, "frame_number": 9710, "timestamp_epoch": "1533964899.602873000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.2", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "securepubads.g.doubleclick.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-4ccf5932724ad3d3803d5487", "src_port": 49409, "tcp_stream": 253, "udp_stream": null, "frame_number": 9712, "timestamp_epoch": "1533964899.603389000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.1", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tpc.googlesyndication.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-57e438a41e3a6212f565b1cd", "src_port": 49414, "tcp_stream": 258, "udp_stream": null, "frame_number": 9716, "timestamp_epoch": "1533964899.603619000" }, { "kind": "tls_client_hello", "dst_ip": "173.0.153.44", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "target.mixi.media" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-ccb3c8e658775af6e9ec55d2", "src_port": 49412, "tcp_stream": 256, "udp_stream": null, "frame_number": 9722, "timestamp_epoch": "1533964899.605767000" }, { "kind": "tls_client_hello", "dst_ip": "173.0.153.44", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "static.mixi.media" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-10bc9f14ebb09f480ef33d93", "src_port": 49413, "tcp_stream": 257, "udp_stream": null, "frame_number": 9724, "timestamp_epoch": "1533964899.606021000" }, { "kind": "tls_client_hello", "dst_ip": "173.0.153.44", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "target.mixi.media" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-d5e25249920fe1bf0df38961", "src_port": 49411, "tcp_stream": 254, "udp_stream": null, "frame_number": 9734, "timestamp_epoch": "1533964899.613514000" }, { "kind": "tls_client_hello", "dst_ip": "173.0.153.44", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "static.mixi.media" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-1a4a64a2c3b0c12c24b11967", "src_port": 49410, "tcp_stream": 255, "udp_stream": null, "frame_number": 9735, "timestamp_epoch": "1533964899.613515000" }, { "kind": "tls_client_hello", "dst_ip": "136.243.42.249", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "stat.media" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-b19aed3abf0be24ab245aecb", "src_port": 49400, "tcp_stream": 244, "udp_stream": null, "frame_number": 9758, "timestamp_epoch": "1533964899.626749000" }, { "kind": "tls_client_hello", "dst_ip": "136.243.42.249", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "stat.media" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-dc7b7455b8dff049676401fd", "src_port": 49401, "tcp_stream": 245, "udp_stream": null, "frame_number": 9775, "timestamp_epoch": "1533964899.632814000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.194.162", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pagead2.googlesyndication.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-5756a6f6c2deb6e07e447dde", "src_port": 49415, "tcp_stream": 259, "udp_stream": null, "frame_number": 9803, "timestamp_epoch": "1533964899.642217000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.194.162", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pagead2.googlesyndication.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-43b06508239f47bdcfbe5213", "src_port": 49416, "tcp_stream": 260, "udp_stream": null, "frame_number": 9805, "timestamp_epoch": "1533964899.642445000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.194.162", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pagead2.googlesyndication.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-2c891b63b552ddf8f4b630b9", "src_port": 49417, "tcp_stream": 261, "udp_stream": null, "frame_number": 9811, "timestamp_epoch": "1533964899.643460000" }, { "kind": "tls_client_hello", "dst_ip": "23.73.225.194", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "2886.tm.zedo.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-aaa2e11ac9bc8dfacc580655", "src_port": 49418, "tcp_stream": 262, "udp_stream": null, "frame_number": 9929, "timestamp_epoch": "1533964899.746035000" }, { "kind": "tls_client_hello", "dst_ip": "23.73.225.194", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "2886.tm.zedo.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-ca1ee855b45d044325d5ddbe", "src_port": 49419, "tcp_stream": 263, "udp_stream": null, "frame_number": 9933, "timestamp_epoch": "1533964899.746839000" }, { "kind": "tls_client_hello", "dst_ip": "8.247.90.250", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cdn.marphezis.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-5ba69421e85b6d594b2495a6", "src_port": 49420, "tcp_stream": 264, "udp_stream": null, "frame_number": 9963, "timestamp_epoch": "1533964899.757726000" }, { "kind": "tls_client_hello", "dst_ip": "8.247.90.250", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cdn.marphezis.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-7a0baff2b58f78a10c05f570", "src_port": 49421, "tcp_stream": 265, "udp_stream": null, "frame_number": 9965, "timestamp_epoch": "1533964899.757871000" }, { "kind": "tls_client_hello", "dst_ip": "35.186.208.100", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "a.company-target.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-e2f4db09ee13e1d55b1c0a44", "src_port": 49422, "tcp_stream": 266, "udp_stream": null, "frame_number": 10224, "timestamp_epoch": "1533964899.986592000" }, { "kind": "tls_client_hello", "dst_ip": "35.186.208.100", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "a.company-target.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-912295f2d3af483f16b21688", "src_port": 49423, "tcp_stream": 267, "udp_stream": null, "frame_number": 10240, "timestamp_epoch": "1533964899.991848000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.194.162", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "googleads.g.doubleclick.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-7097bf7cb3fe4e974d4de255", "src_port": 49424, "tcp_stream": 268, "udp_stream": null, "frame_number": 10385, "timestamp_epoch": "1533964900.268062000" }, { "kind": "tls_client_hello", "dst_ip": "23.220.174.162", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "images9.engageya.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-e4e1d27abac9eb2be21f5f54", "src_port": 49431, "tcp_stream": 275, "udp_stream": null, "frame_number": 10651, "timestamp_epoch": "1533964900.685939000" }, { "kind": "tls_client_hello", "dst_ip": "23.220.174.162", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "images9.engageya.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-e33df117783cd9c8594277fd", "src_port": 49435, "tcp_stream": 279, "udp_stream": null, "frame_number": 10657, "timestamp_epoch": "1533964900.688301000" }, { "kind": "tls_client_hello", "dst_ip": "23.220.174.162", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "images9.engageya.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-65b9357fc9a110f0b357bc0b", "src_port": 49432, "tcp_stream": 276, "udp_stream": null, "frame_number": 10659, "timestamp_epoch": "1533964900.688509000" }, { "kind": "tls_client_hello", "dst_ip": "23.220.174.162", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "images9.engageya.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-662a851a4b20fb604198816f", "src_port": 49434, "tcp_stream": 278, "udp_stream": null, "frame_number": 10661, "timestamp_epoch": "1533964900.688758000" }, { "kind": "tls_client_hello", "dst_ip": "23.220.174.162", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "images9.engageya.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-96f0f054121b77785de17073", "src_port": 49433, "tcp_stream": 277, "udp_stream": null, "frame_number": 10663, "timestamp_epoch": "1533964900.688850000" }, { "kind": "tls_client_hello", "dst_ip": "13.33.107.160", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "teutorigos-cat.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-b5d21c5d2128f56a9b1fd2b6", "src_port": 49430, "tcp_stream": 274, "udp_stream": null, "frame_number": 10675, "timestamp_epoch": "1533964900.703100000" }, { "kind": "tls_client_hello", "dst_ip": "54.209.71.223", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "t.cwkuki.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-ce790ddb0427d8e3c97d7821", "src_port": 49425, "tcp_stream": 269, "udp_stream": null, "frame_number": 10679, "timestamp_epoch": "1533964900.703345000" }, { "kind": "tls_client_hello", "dst_ip": "13.33.107.160", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "teutorigos-cat.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-5cfc7b67a16f33c4d8d32c47", "src_port": 49429, "tcp_stream": 273, "udp_stream": null, "frame_number": 10680, "timestamp_epoch": "1533964900.703501000" }, { "kind": "tls_client_hello", "dst_ip": "23.73.239.75", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ss3.zedo.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-eacc7107a426e1383cdc51d2", "src_port": 49440, "tcp_stream": 284, "udp_stream": null, "frame_number": 10687, "timestamp_epoch": "1533964900.709018000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.0.54", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "i.ytimg.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-b31e8b997a9e1a8d0e57acf8", "src_port": 49438, "tcp_stream": 282, "udp_stream": null, "frame_number": 10697, "timestamp_epoch": "1533964900.710385000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.0.54", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "i.ytimg.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-c679f4104973aa731f28a37e", "src_port": 49439, "tcp_stream": 283, "udp_stream": null, "frame_number": 10699, "timestamp_epoch": "1533964900.710596000" }, { "kind": "tls_client_hello", "dst_ip": "54.209.71.223", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "t.cwkuki.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-bbae5d32985db30e3c4bc4b2", "src_port": 49426, "tcp_stream": 270, "udp_stream": null, "frame_number": 10707, "timestamp_epoch": "1533964900.713504000" }, { "kind": "tls_client_hello", "dst_ip": "23.73.239.75", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ss3.zedo.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-bb2b7a1fe8e2899696775e52", "src_port": 49441, "tcp_stream": 285, "udp_stream": null, "frame_number": 10717, "timestamp_epoch": "1533964900.716816000" }, { "kind": "tls_client_hello", "dst_ip": "162.210.199.69", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "b1sync.zemanta.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-b8d019dc1b35260a7c856a31", "src_port": 49428, "tcp_stream": 271, "udp_stream": null, "frame_number": 10780, "timestamp_epoch": "1533964900.763909000" }, { "kind": "tls_client_hello", "dst_ip": "162.210.199.69", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "b1sync.zemanta.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-8f8261a8bf898843714fa9bd", "src_port": 49427, "tcp_stream": 272, "udp_stream": null, "frame_number": 10781, "timestamp_epoch": "1533964900.763991000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.6", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "s0.2mdn.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-60d6255b0f18f6799d7ed382", "src_port": 49443, "tcp_stream": 287, "udp_stream": null, "frame_number": 10810, "timestamp_epoch": "1533964900.776539000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.6", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "s0.2mdn.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-61ef8f2607fbc576bdb73a46", "src_port": 49442, "tcp_stream": 286, "udp_stream": null, "frame_number": 10811, "timestamp_epoch": "1533964900.777020000" }, { "kind": "tls_client_hello", "dst_ip": "95.142.20.29", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ucs02.engageya.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-a4b8639849690192689f4bc2", "src_port": 49436, "tcp_stream": 280, "udp_stream": null, "frame_number": 10878, "timestamp_epoch": "1533964900.852025000" }, { "kind": "tls_client_hello", "dst_ip": "95.142.20.29", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ucs02.engageya.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-5e9f6fbb4c51872ffe121a42", "src_port": 49437, "tcp_stream": 281, "udp_stream": null, "frame_number": 10881, "timestamp_epoch": "1533964900.852278000" }, { "kind": "tls_client_hello", "dst_ip": "173.241.250.220", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "delivery-us-west-1.openx.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-d16e54817fcd12172f8cf7f5", "src_port": 49446, "tcp_stream": 291, "udp_stream": null, "frame_number": 11389, "timestamp_epoch": "1533964901.234054000" }, { "kind": "tls_client_hello", "dst_ip": "173.241.250.220", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "delivery-us-west-1.openx.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-94fa04d30fb52da986cf4587", "src_port": 49447, "tcp_stream": 290, "udp_stream": null, "frame_number": 11391, "timestamp_epoch": "1533964901.234373000" }, { "kind": "tls_client_hello", "dst_ip": "23.54.22.209", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "widgets.outbrain.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-96954ac1abaa80198820135d", "src_port": 49449, "tcp_stream": 293, "udp_stream": null, "frame_number": 11393, "timestamp_epoch": "1533964901.234478000" }, { "kind": "tls_client_hello", "dst_ip": "23.54.22.209", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "widgets.outbrain.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-7b67f6224b05af7c32aaddb9", "src_port": 49448, "tcp_stream": 292, "udp_stream": null, "frame_number": 11399, "timestamp_epoch": "1533964901.236361000" }, { "kind": "tls_client_hello", "dst_ip": "54.175.110.202", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ads.deliverimp.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-d70e916d3b9286e14de9ea21", "src_port": 49444, "tcp_stream": 288, "udp_stream": null, "frame_number": 11409, "timestamp_epoch": "1533964901.242573000" }, { "kind": "tls_client_hello", "dst_ip": "54.175.110.202", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ads.deliverimp.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-049e01f0c711cc577d86dcea", "src_port": 49445, "tcp_stream": 289, "udp_stream": null, "frame_number": 11411, "timestamp_epoch": "1533964901.243326000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.6.66", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cm.g.doubleclick.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-e5905c21f6ef86d0cbbeb821", "src_port": 49457, "tcp_stream": 301, "udp_stream": null, "frame_number": 11522, "timestamp_epoch": "1533964901.338831000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.6.66", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cm.g.doubleclick.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-0d1a9c2658015457b9c2b009", "src_port": 49454, "tcp_stream": 298, "udp_stream": null, "frame_number": 11523, "timestamp_epoch": "1533964901.339056000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.6.66", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cm.g.doubleclick.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-7074c0c27ec7886341210972", "src_port": 49455, "tcp_stream": 299, "udp_stream": null, "frame_number": 11524, "timestamp_epoch": "1533964901.339078000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.6.66", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cm.g.doubleclick.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-e252e805d9f90c039124ea08", "src_port": 49456, "tcp_stream": 300, "udp_stream": null, "frame_number": 11525, "timestamp_epoch": "1533964901.339204000" }, { "kind": "tls_client_hello", "dst_ip": "178.154.131.215", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "yastatic.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-64ed51fc83bbf98f9fb8e08f", "src_port": 49451, "tcp_stream": 295, "udp_stream": null, "frame_number": 11792, "timestamp_epoch": "1533964901.575300000" }, { "kind": "tls_client_hello", "dst_ip": "178.154.131.215", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "yastatic.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-186e2e4678eef22a5d4b400d", "src_port": 49450, "tcp_stream": 294, "udp_stream": null, "frame_number": 11803, "timestamp_epoch": "1533964901.578555000" }, { "kind": "tls_client_hello", "dst_ip": "148.251.82.59", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "smi2.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-de5a4cfac0c8b2770d5a6c09", "src_port": 49460, "tcp_stream": 304, "udp_stream": null, "frame_number": 11837, "timestamp_epoch": "1533964901.592161000" }, { "kind": "tls_client_hello", "dst_ip": "148.251.82.59", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "net.finam.ru" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-793cafeaac762e86c5b44767", "src_port": 49459, "tcp_stream": 303, "udp_stream": null, "frame_number": 11850, "timestamp_epoch": "1533964901.594524000" }, { "kind": "tls_client_hello", "dst_ip": "148.251.82.59", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "net.finam.ru" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-c5114292bc6121ca2e7fe58d", "src_port": 49458, "tcp_stream": 302, "udp_stream": null, "frame_number": 11854, "timestamp_epoch": "1533964901.598920000" }, { "kind": "tls_client_hello", "dst_ip": "148.251.82.59", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "smi2.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-7e5658399042ac137b9dbb67", "src_port": 49461, "tcp_stream": 305, "udp_stream": null, "frame_number": 11855, "timestamp_epoch": "1533964901.598922000" }, { "kind": "tls_client_hello", "dst_ip": "23.54.23.55", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "z.moatads.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-fa8cde61aac15c9906261f68", "src_port": 49467, "tcp_stream": 311, "udp_stream": null, "frame_number": 11959, "timestamp_epoch": "1533964901.767859000" }, { "kind": "tls_client_hello", "dst_ip": "23.54.23.55", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "z.moatads.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-bd8d09c2a4f1b511b77dc36e", "src_port": 49464, "tcp_stream": 308, "udp_stream": null, "frame_number": 11964, "timestamp_epoch": "1533964901.769138000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.2", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "googleads4.g.doubleclick.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-22dc4bba92e82cc787f1c0a9", "src_port": 49465, "tcp_stream": 309, "udp_stream": null, "frame_number": 11970, "timestamp_epoch": "1533964901.775522000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.2", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "googleads4.g.doubleclick.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-e31e97dc07f034ca410b5bef", "src_port": 49466, "tcp_stream": 310, "udp_stream": null, "frame_number": 11971, "timestamp_epoch": "1533964901.775654000" }, { "kind": "tls_client_hello", "dst_ip": "46.161.36.8", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "smi2.ru" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-8209bc1b0c4c914b9c636f16", "src_port": 49463, "tcp_stream": 307, "udp_stream": null, "frame_number": 12000, "timestamp_epoch": "1533964901.816031000" }, { "kind": "tls_client_hello", "dst_ip": "46.161.36.8", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "smi2.ru" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-0117e74363469d59446b2604", "src_port": 49462, "tcp_stream": 306, "udp_stream": null, "frame_number": 12008, "timestamp_epoch": "1533964901.819747000" }, { "kind": "tls_client_hello", "dst_ip": "104.110.128.239", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "stags.bluekai.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-48a7830e66cf52bf8735786c", "src_port": 49468, "tcp_stream": 312, "udp_stream": null, "frame_number": 12022, "timestamp_epoch": "1533964901.828960000" }, { "kind": "tls_client_hello", "dst_ip": "104.110.128.239", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "stags.bluekai.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-84c00533927e355b7ba123d5", "src_port": 49469, "tcp_stream": 313, "udp_stream": null, "frame_number": 12023, "timestamp_epoch": "1533964901.829056000" }, { "kind": "tls_client_hello", "dst_ip": "104.36.113.17", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "image2.pubmatic.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-b1c1ab591bcb7ca042696830", "src_port": 49470, "tcp_stream": 314, "udp_stream": null, "frame_number": 12042, "timestamp_epoch": "1533964901.843881000" }, { "kind": "tls_client_hello", "dst_ip": "104.36.113.17", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "image2.pubmatic.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-517ee31026aeedc850b3bd81", "src_port": 49471, "tcp_stream": 315, "udp_stream": null, "frame_number": 12044, "timestamp_epoch": "1533964901.844190000" }, { "kind": "tls_client_hello", "dst_ip": "54.176.157.57", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "saxp.zedo.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-45a621d6f7eb9d1701d1d2ae", "src_port": 49473, "tcp_stream": 317, "udp_stream": null, "frame_number": 12192, "timestamp_epoch": "1533964901.975102000" }, { "kind": "tls_client_hello", "dst_ip": "54.176.157.57", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "saxp.zedo.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-91b54e5fb7d6e02c77fad30a", "src_port": 49472, "tcp_stream": 316, "udp_stream": null, "frame_number": 12204, "timestamp_epoch": "1533964901.978717000" }, { "kind": "tls_client_hello", "dst_ip": "23.35.180.245", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "code.createjs.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-4e1846a5b04746e1ed6ea588", "src_port": 49479, "tcp_stream": 323, "udp_stream": null, "frame_number": 12427, "timestamp_epoch": "1533964902.276965000" }, { "kind": "tls_client_hello", "dst_ip": "23.35.180.245", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "code.createjs.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-27df723f0a7cf593f3e4b126", "src_port": 49478, "tcp_stream": 322, "udp_stream": null, "frame_number": 12429, "timestamp_epoch": "1533964902.277117000" }, { "kind": "tls_client_hello", "dst_ip": "173.0.153.44", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "static4.mixi.media" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-cf8518a8120189ce295c730d", "src_port": 49477, "tcp_stream": 321, "udp_stream": null, "frame_number": 12437, "timestamp_epoch": "1533964902.280038000" }, { "kind": "tls_client_hello", "dst_ip": "173.0.153.44", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "static2.mixi.media" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-f47b65963dedcfc40c4ffedd", "src_port": 49474, "tcp_stream": 318, "udp_stream": null, "frame_number": 12443, "timestamp_epoch": "1533964902.281194000" }, { "kind": "tls_client_hello", "dst_ip": "173.0.153.44", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "static2.mixi.media" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-a9f1d35b2ab7dba93677de56", "src_port": 49475, "tcp_stream": 319, "udp_stream": null, "frame_number": 12455, "timestamp_epoch": "1533964902.286395000" }, { "kind": "tls_client_hello", "dst_ip": "173.0.153.44", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "static4.mixi.media" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-49fc4aa609237d1bb66db938", "src_port": 49476, "tcp_stream": 320, "udp_stream": null, "frame_number": 12477, "timestamp_epoch": "1533964902.313628000" }, { "kind": "tls_client_hello", "dst_ip": "23.54.23.55", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "px.moatads.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-6c744da83346803a9f7dcc43", "src_port": 49480, "tcp_stream": 324, "udp_stream": null, "frame_number": 12638, "timestamp_epoch": "1533964902.589662000" }, { "kind": "tls_client_hello", "dst_ip": "23.54.23.55", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "px.moatads.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-1f743c0692084c214d15bd99", "src_port": 49481, "tcp_stream": 325, "udp_stream": null, "frame_number": 12671, "timestamp_epoch": "1533964902.643109000" }, { "kind": "tls_client_hello", "dst_ip": "173.0.153.44", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "static4.mixi.media" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-0cc8aa0fc2fc7dbaf42cc8a6", "src_port": 49482, "tcp_stream": 326, "udp_stream": null, "frame_number": 12727, "timestamp_epoch": "1533964902.689619000" }, { "kind": "tls_client_hello", "dst_ip": "173.0.153.44", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "static4.mixi.media" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-9f689ea24bab9a6fa20a9d7a", "src_port": 49483, "tcp_stream": 327, "udp_stream": null, "frame_number": 12751, "timestamp_epoch": "1533964902.700649000" }, { "kind": "tls_client_hello", "dst_ip": "173.0.153.44", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "static5.mixi.media" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-ae7830b5c705d3b401b9b4a4", "src_port": 49484, "tcp_stream": 328, "udp_stream": null, "frame_number": 12824, "timestamp_epoch": "1533964902.792686000" }, { "kind": "tls_client_hello", "dst_ip": "173.0.153.44", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "static5.mixi.media" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-f5406fc391ecd904d7a97ca4", "src_port": 49485, "tcp_stream": 329, "udp_stream": null, "frame_number": 12847, "timestamp_epoch": "1533964902.811465000" }, { "kind": "tls_client_hello", "dst_ip": "64.41.197.55", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tt1.zedo.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-a79e38b1d6d943672fb2c584", "src_port": 49487, "tcp_stream": 331, "udp_stream": null, "frame_number": 12887, "timestamp_epoch": "1533964902.838650000" }, { "kind": "tls_client_hello", "dst_ip": "64.41.197.55", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tt1.zedo.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-4945b2fb946bb5391a33b037", "src_port": 49486, "tcp_stream": 330, "udp_stream": null, "frame_number": 12889, "timestamp_epoch": "1533964902.838771000" }, { "kind": "tls_client_hello", "dst_ip": "23.220.187.187", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ads.rubiconproject.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-a88286fcbfd066de9c8ca606", "src_port": 49489, "tcp_stream": 333, "udp_stream": null, "frame_number": 12923, "timestamp_epoch": "1533964902.867200000" }, { "kind": "tls_client_hello", "dst_ip": "23.220.187.187", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ads.rubiconproject.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-9022df7ff62239d464527ec9", "src_port": 49488, "tcp_stream": 332, "udp_stream": null, "frame_number": 12930, "timestamp_epoch": "1533964902.870165000" }, { "kind": "tls_client_hello", "dst_ip": "23.73.239.75", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ss3.zedo.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-6f62ec3e8993adec293a2ca1", "src_port": 49492, "tcp_stream": 336, "udp_stream": null, "frame_number": 13104, "timestamp_epoch": "1533964903.067416000" }, { "kind": "tls_client_hello", "dst_ip": "204.2.250.100", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tag.1rx.io" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-465f3e7981d7ebc079004749", "src_port": 49491, "tcp_stream": 335, "udp_stream": null, "frame_number": 13105, "timestamp_epoch": "1533964903.067494000" }, { "kind": "tls_client_hello", "dst_ip": "204.2.250.100", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tag.1rx.io" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-ffd6554835f6f45c006ae695", "src_port": 49490, "tcp_stream": 334, "udp_stream": null, "frame_number": 13115, "timestamp_epoch": "1533964903.080511000" }, { "kind": "tls_client_hello", "dst_ip": "64.41.197.55", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tt1.zedo.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-4dbfdc138ce6f96b51e72c41", "src_port": 49494, "tcp_stream": 338, "udp_stream": null, "frame_number": 13336, "timestamp_epoch": "1533964903.232805000" }, { "kind": "tls_client_hello", "dst_ip": "64.41.197.55", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tt1.zedo.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-cab3d589f299e851dc0b8dc3", "src_port": 49493, "tcp_stream": 337, "udp_stream": null, "frame_number": 13337, "timestamp_epoch": "1533964903.232952000" }, { "kind": "tls_client_hello", "dst_ip": "151.101.2.2", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "odb.outbrain.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-6ce73735bb15a5f28c638848", "src_port": 49495, "tcp_stream": 339, "udp_stream": null, "frame_number": 13419, "timestamp_epoch": "1533964903.334955000" }, { "kind": "tls_client_hello", "dst_ip": "151.101.2.2", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "odb.outbrain.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-56f6ed88b3f674181ee3eb93", "src_port": 49496, "tcp_stream": 340, "udp_stream": null, "frame_number": 13422, "timestamp_epoch": "1533964903.335215000" }, { "kind": "tls_client_hello", "dst_ip": "173.241.250.220", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "zedo-d.openx.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-b5ed632ab6ca5036aad85fab", "src_port": 49498, "tcp_stream": 342, "udp_stream": null, "frame_number": 13425, "timestamp_epoch": "1533964903.335589000" }, { "kind": "tls_client_hello", "dst_ip": "173.241.250.220", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "zedo-d.openx.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-107c1a52bc03b12f63fcd45a", "src_port": 49497, "tcp_stream": 341, "udp_stream": null, "frame_number": 13427, "timestamp_epoch": "1533964903.335838000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.10", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "imasdk.googleapis.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-21d24e1c5d968e6e72d6750a", "src_port": 49500, "tcp_stream": 344, "udp_stream": null, "frame_number": 13439, "timestamp_epoch": "1533964903.380407000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.10", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "imasdk.googleapis.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-76536ff2f39095d367dfb961", "src_port": 49499, "tcp_stream": 343, "udp_stream": null, "frame_number": 13441, "timestamp_epoch": "1533964903.383586000" }, { "kind": "tls_client_hello", "dst_ip": "64.41.197.55", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tt1.zedo.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-e3aa46f4387c214bc15a3ff4", "src_port": 49502, "tcp_stream": 346, "udp_stream": null, "frame_number": 13496, "timestamp_epoch": "1533964903.482466000" }, { "kind": "tls_client_hello", "dst_ip": "64.41.197.55", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tt1.zedo.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-6882517f0c706fd03b33ab72", "src_port": 49501, "tcp_stream": 345, "udp_stream": null, "frame_number": 13505, "timestamp_epoch": "1533964903.493197000" }, { "kind": "tls_client_hello", "dst_ip": "64.41.197.55", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tt1.zedo.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-0388014a6a1f63fd51fed2dd", "src_port": 49504, "tcp_stream": 348, "udp_stream": null, "frame_number": 13511, "timestamp_epoch": "1533964903.504997000" }, { "kind": "tls_client_hello", "dst_ip": "64.41.197.55", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tt1.zedo.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-5e06041d1a5f6c2251c9ccd4", "src_port": 49503, "tcp_stream": 347, "udp_stream": null, "frame_number": 13512, "timestamp_epoch": "1533964903.505113000" }, { "kind": "tls_client_hello", "dst_ip": "13.57.70.199", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "fastlane-adv.rubiconproject.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-f3f008e741d1f605911064b1", "src_port": 49505, "tcp_stream": 349, "udp_stream": null, "frame_number": 13560, "timestamp_epoch": "1533964903.549819000" }, { "kind": "tls_client_hello", "dst_ip": "64.41.197.55", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tt1.zedo.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-9103860fb121463442f517db", "src_port": 49507, "tcp_stream": 351, "udp_stream": null, "frame_number": 13601, "timestamp_epoch": "1533964903.579811000" }, { "kind": "tls_client_hello", "dst_ip": "74.119.117.70", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "bidder.criteo.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-303be3dd1012842965e7ee3f", "src_port": 49506, "tcp_stream": 350, "udp_stream": null, "frame_number": 13603, "timestamp_epoch": "1533964903.580609000" }, { "kind": "tls_client_hello", "dst_ip": "64.7.205.2", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "qcx.quantserve.com" }, "src_ip": "192.168.1.95", "dst_port": 8443, "event_id": "evt-3b8281889d54fd137a72e0c0", "src_port": 49508, "tcp_stream": 352, "udp_stream": null, "frame_number": 13611, "timestamp_epoch": "1533964903.595117000" }, { "kind": "tls_client_hello", "dst_ip": "64.41.197.55", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tt1.zedo.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-0cf58c8fd582746cb66b6086", "src_port": 49510, "tcp_stream": 354, "udp_stream": null, "frame_number": 13631, "timestamp_epoch": "1533964903.624503000" }, { "kind": "tls_client_hello", "dst_ip": "74.214.196.133", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "bid.contextweb.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-23b92e4e75378cea1f70fee3", "src_port": 49511, "tcp_stream": 355, "udp_stream": null, "frame_number": 13633, "timestamp_epoch": "1533964903.624634000" }, { "kind": "tls_client_hello", "dst_ip": "35.164.209.30", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "g2.gumgum.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-562b8e10abdeb4961756012e", "src_port": 49509, "tcp_stream": 353, "udp_stream": null, "frame_number": 13673, "timestamp_epoch": "1533964903.645216000" }, { "kind": "tls_client_hello", "dst_ip": "35.164.209.30", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "g2.gumgum.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-7839aa60f26046eea000cf9b", "src_port": 49512, "tcp_stream": 356, "udp_stream": null, "frame_number": 13674, "timestamp_epoch": "1533964903.645497000" }, { "kind": "tls_client_hello", "dst_ip": "195.244.31.10", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "hb-api.omnitagjs.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-2211bd418a5268f407e2caed", "src_port": 49513, "tcp_stream": 357, "udp_stream": null, "frame_number": 13770, "timestamp_epoch": "1533964903.717409000" }, { "kind": "tls_client_hello", "dst_ip": "64.41.197.55", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tt1.zedo.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-b8a07f58b216daee70556497", "src_port": 49515, "tcp_stream": 359, "udp_stream": null, "frame_number": 13872, "timestamp_epoch": "1533964903.772678000" }, { "kind": "tls_client_hello", "dst_ip": "64.41.197.55", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tt1.zedo.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-8495177d01078a1d7dc6b185", "src_port": 49514, "tcp_stream": 358, "udp_stream": null, "frame_number": 13880, "timestamp_epoch": "1533964903.781394000" }, { "kind": "tls_client_hello", "dst_ip": "64.41.197.55", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tt1.zedo.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-ac67333805c3907b3b65fb0f", "src_port": 49516, "tcp_stream": 360, "udp_stream": null, "frame_number": 13913, "timestamp_epoch": "1533964903.793456000" }, { "kind": "tls_client_hello", "dst_ip": "64.41.197.55", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tt1.zedo.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-12830ad7e13720fbdb9f5943", "src_port": 49517, "tcp_stream": 361, "udp_stream": null, "frame_number": 13915, "timestamp_epoch": "1533964903.793584000" }, { "kind": "tls_client_hello", "dst_ip": "23.35.182.113", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "images.outbrainimg.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-4f897521ba11272530b40f17", "src_port": 49519, "tcp_stream": 363, "udp_stream": null, "frame_number": 13925, "timestamp_epoch": "1533964903.796988000" }, { "kind": "tls_client_hello", "dst_ip": "23.35.182.113", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "images.outbrainimg.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-3a4b597999bbbd933e566155", "src_port": 49518, "tcp_stream": 362, "udp_stream": null, "frame_number": 13929, "timestamp_epoch": "1533964903.798419000" }, { "kind": "tls_client_hello", "dst_ip": "23.35.182.113", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "images.outbrainimg.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-e3152ed33a30477873967485", "src_port": 49520, "tcp_stream": 364, "udp_stream": null, "frame_number": 13938, "timestamp_epoch": "1533964903.810237000" }, { "kind": "tls_client_hello", "dst_ip": "64.41.197.55", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tt1.zedo.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-64ad6f44b1d9c85e32b762a7", "src_port": 49521, "tcp_stream": 365, "udp_stream": null, "frame_number": 14009, "timestamp_epoch": "1533964903.870950000" }, { "kind": "tls_client_hello", "dst_ip": "64.41.197.55", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tt1.zedo.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-083367228fe20cead26b1356", "src_port": 49522, "tcp_stream": 366, "udp_stream": null, "frame_number": 14047, "timestamp_epoch": "1533964903.937187000" }, { "kind": "tls_client_hello", "dst_ip": "64.41.197.55", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tt1.zedo.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-6e8aac1314051fbb9dbabb12", "src_port": 49523, "tcp_stream": 367, "udp_stream": null, "frame_number": 14191, "timestamp_epoch": "1533964904.073957000" }, { "kind": "tls_client_hello", "dst_ip": "64.41.197.55", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tt1.zedo.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-2926da3235fcb91a153127b9", "src_port": 49524, "tcp_stream": 368, "udp_stream": null, "frame_number": 14244, "timestamp_epoch": "1533964904.125634000" }, { "kind": "tls_client_hello", "dst_ip": "64.41.197.55", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tt1.zedo.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-4dc3c4f36f566622fb523792", "src_port": 49525, "tcp_stream": 369, "udp_stream": null, "frame_number": 14263, "timestamp_epoch": "1533964904.148063000" }, { "kind": "tls_client_hello", "dst_ip": "64.41.197.55", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tt1.zedo.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-1e755f5df9e1f1e793e7bfa5", "src_port": 49526, "tcp_stream": 370, "udp_stream": null, "frame_number": 14265, "timestamp_epoch": "1533964904.148355000" }, { "kind": "tls_client_hello", "dst_ip": "64.41.197.55", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tt1.zedo.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-baec1aa53dfe641be8242a06", "src_port": 49527, "tcp_stream": 371, "udp_stream": null, "frame_number": 14280, "timestamp_epoch": "1533964904.213422000" }, { "kind": "tls_client_hello", "dst_ip": "64.41.197.55", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tt1.zedo.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-345e78a057398934afd8d80b", "src_port": 49528, "tcp_stream": 372, "udp_stream": null, "frame_number": 14362, "timestamp_epoch": "1533964904.327254000" }, { "kind": "tls_client_hello", "dst_ip": "173.241.250.143", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "us-u.openx.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-89debea64bdbacf363bd42e4", "src_port": 49530, "tcp_stream": 374, "udp_stream": null, "frame_number": 14364, "timestamp_epoch": "1533964904.327679000" }, { "kind": "tls_client_hello", "dst_ip": "173.241.250.143", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "us-u.openx.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-d404bc6cc3bd46f55ae7bee8", "src_port": 49532, "tcp_stream": 376, "udp_stream": null, "frame_number": 14366, "timestamp_epoch": "1533964904.327827000" }, { "kind": "tls_client_hello", "dst_ip": "173.241.250.143", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "us-u.openx.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-da524fb90cffa141a8725b0a", "src_port": 49529, "tcp_stream": 373, "udp_stream": null, "frame_number": 14368, "timestamp_epoch": "1533964904.328213000" }, { "kind": "tls_client_hello", "dst_ip": "173.241.250.143", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "us-u.openx.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-93aa85be2809fb9371ca3e7e", "src_port": 49531, "tcp_stream": 375, "udp_stream": null, "frame_number": 14369, "timestamp_epoch": "1533964904.328294000" }, { "kind": "tls_client_hello", "dst_ip": "64.41.197.55", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tt1.zedo.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-f60bd83cf9eac0215681bb63", "src_port": 49533, "tcp_stream": 377, "udp_stream": null, "frame_number": 14423, "timestamp_epoch": "1533964904.402695000" }, { "kind": "tls_client_hello", "dst_ip": "64.41.197.55", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tt1.zedo.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-768bfe8a14edf9231641c7ec", "src_port": 49536, "tcp_stream": 380, "udp_stream": null, "frame_number": 14431, "timestamp_epoch": "1533964904.424997000" }, { "kind": "tls_client_hello", "dst_ip": "34.194.201.62", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pix.spot.im" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-4dec6851fde5de3d85c41112", "src_port": 49534, "tcp_stream": 378, "udp_stream": null, "frame_number": 14459, "timestamp_epoch": "1533964904.454417000" }, { "kind": "tls_client_hello", "dst_ip": "64.41.197.55", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tt1.zedo.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-a7518169a7f57d14c74b499f", "src_port": 49537, "tcp_stream": 381, "udp_stream": null, "frame_number": 14463, "timestamp_epoch": "1533964904.472978000" }, { "kind": "tls_client_hello", "dst_ip": "34.194.201.62", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pix.spot.im" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-b853a459a147ad4fb53dc265", "src_port": 49535, "tcp_stream": 379, "udp_stream": null, "frame_number": 14465, "timestamp_epoch": "1533964904.473391000" }, { "kind": "tls_client_hello", "dst_ip": "104.20.21.239", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "rum-collector.pingdom.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-cac57313e81d34e0a2b291bc", "src_port": 49541, "tcp_stream": 385, "udp_stream": null, "frame_number": 14493, "timestamp_epoch": "1533964904.506379000" }, { "kind": "tls_client_hello", "dst_ip": "104.20.21.239", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "rum-collector.pingdom.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-924b5b227f01911f5d853004", "src_port": 49540, "tcp_stream": 384, "udp_stream": null, "frame_number": 14499, "timestamp_epoch": "1533964904.513679000" }, { "kind": "tls_client_hello", "dst_ip": "64.41.197.55", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tt1.zedo.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-636248d4795593ecd578c2b5", "src_port": 49543, "tcp_stream": 387, "udp_stream": null, "frame_number": 14587, "timestamp_epoch": "1533964904.627079000" }, { "kind": "tls_client_hello", "dst_ip": "23.73.239.75", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ss3.zedo.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-6b2e422224e10e8216d323b8", "src_port": 49542, "tcp_stream": 386, "udp_stream": null, "frame_number": 14590, "timestamp_epoch": "1533964904.627776000" }, { "kind": "tls_client_hello", "dst_ip": "64.41.197.55", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tt1.zedo.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-240ff1d8463de218774d0ecd", "src_port": 49544, "tcp_stream": 388, "udp_stream": null, "frame_number": 14597, "timestamp_epoch": "1533964904.628398000" }, { "kind": "tls_client_hello", "dst_ip": "23.73.239.75", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ss3.zedo.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-670241b950eafc3d6837fb71", "src_port": 49545, "tcp_stream": 389, "udp_stream": null, "frame_number": 14606, "timestamp_epoch": "1533964904.635702000" }, { "kind": "tls_client_hello", "dst_ip": "64.41.197.55", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tt1.zedo.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-446f66330aa0420aade01105", "src_port": 49546, "tcp_stream": 390, "udp_stream": null, "frame_number": 14627, "timestamp_epoch": "1533964904.641771000" }, { "kind": "tls_client_hello", "dst_ip": "34.246.244.104", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "rum-collector-2.pingdom.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-03a76e1d146badad5b795bc4", "src_port": 49539, "tcp_stream": 383, "udp_stream": null, "frame_number": 14633, "timestamp_epoch": "1533964904.646300000" }, { "kind": "tls_client_hello", "dst_ip": "34.246.244.104", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "rum-collector-2.pingdom.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-c17ae4b74ba247f425c00144", "src_port": 49538, "tcp_stream": 382, "udp_stream": null, "frame_number": 14638, "timestamp_epoch": "1533964904.647172000" }, { "kind": "tls_client_hello", "dst_ip": "23.213.38.151", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ads.scorecardresearch.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-50ef0e9890f161fb43372d3f", "src_port": 49548, "tcp_stream": 392, "udp_stream": null, "frame_number": 14680, "timestamp_epoch": "1533964904.690554000" }, { "kind": "tls_client_hello", "dst_ip": "23.213.38.151", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ads.scorecardresearch.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-173534787ae3ac0f30bbe535", "src_port": 49547, "tcp_stream": 391, "udp_stream": null, "frame_number": 14701, "timestamp_epoch": "1533964904.697213000" }, { "kind": "tls_client_hello", "dst_ip": "54.191.4.242", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "id.rlcdn.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-9315a73ee098e9559dd8cc6c", "src_port": 49552, "tcp_stream": 396, "udp_stream": null, "frame_number": 14725, "timestamp_epoch": "1533964904.712726000" }, { "kind": "tls_client_hello", "dst_ip": "54.191.4.242", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "id.rlcdn.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-e2606e8abea97f67fbc609a3", "src_port": 49551, "tcp_stream": 395, "udp_stream": null, "frame_number": 14726, "timestamp_epoch": "1533964904.712920000" }, { "kind": "tls_client_hello", "dst_ip": "54.186.237.130", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "i.w55c.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-f9d3f020601daef9efd44fb3", "src_port": 49553, "tcp_stream": 398, "udp_stream": null, "frame_number": 14728, "timestamp_epoch": "1533964904.713278000" }, { "kind": "tls_client_hello", "dst_ip": "54.186.237.130", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "i.w55c.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-bb2999f84d247886e0bbd410", "src_port": 49554, "tcp_stream": 397, "udp_stream": null, "frame_number": 14729, "timestamp_epoch": "1533964904.713386000" }, { "kind": "tls_client_hello", "dst_ip": "4.78.226.232", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "oxp.mxptint.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-4042afa1eb47185fef40f6a0", "src_port": 49550, "tcp_stream": 394, "udp_stream": null, "frame_number": 14741, "timestamp_epoch": "1533964904.728872000" }, { "kind": "tls_client_hello", "dst_ip": "52.9.78.114", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "magnetic.t.domdex.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-a9bed0000704b4f668931206", "src_port": 49558, "tcp_stream": 402, "udp_stream": null, "frame_number": 14742, "timestamp_epoch": "1533964904.728998000" }, { "kind": "tls_client_hello", "dst_ip": "52.9.78.114", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "magnetic.t.domdex.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-dde47fdb1d3178b9a7d69066", "src_port": 49557, "tcp_stream": 401, "udp_stream": null, "frame_number": 14744, "timestamp_epoch": "1533964904.729235000" }, { "kind": "tls_client_hello", "dst_ip": "4.78.226.232", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "oxp.mxptint.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-b0b7b164418644bf09f22717", "src_port": 49549, "tcp_stream": 393, "udp_stream": null, "frame_number": 14752, "timestamp_epoch": "1533964904.737397000" }, { "kind": "tls_client_hello", "dst_ip": "34.211.69.152", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "rtb.gumgum.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-24de8193ba6a8d6594140e9c", "src_port": 49559, "tcp_stream": 403, "udp_stream": null, "frame_number": 14758, "timestamp_epoch": "1533964904.744354000" }, { "kind": "tls_client_hello", "dst_ip": "64.41.197.55", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tt1.zedo.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-793fb4adbf4484d70eb47727", "src_port": 49561, "tcp_stream": 405, "udp_stream": null, "frame_number": 14767, "timestamp_epoch": "1533964904.748832000" }, { "kind": "tls_client_hello", "dst_ip": "23.8.170.84", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "contextual.media.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-48a3892b76d53be6ae6f9046", "src_port": 49563, "tcp_stream": 407, "udp_stream": null, "frame_number": 14772, "timestamp_epoch": "1533964904.749793000" }, { "kind": "tls_client_hello", "dst_ip": "64.41.197.55", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tt1.zedo.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-cfd15f0e0ad95031aadc488e", "src_port": 49562, "tcp_stream": 406, "udp_stream": null, "frame_number": 14779, "timestamp_epoch": "1533964904.751514000" }, { "kind": "tls_client_hello", "dst_ip": "23.8.170.84", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "contextual.media.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-cbb8834e95f9859caf9973fa", "src_port": 49564, "tcp_stream": 408, "udp_stream": null, "frame_number": 14781, "timestamp_epoch": "1533964904.752200000" }, { "kind": "tls_client_hello", "dst_ip": "34.211.69.152", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "rtb.gumgum.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-3ca880484597391b8d077be7", "src_port": 49560, "tcp_stream": 404, "udp_stream": null, "frame_number": 14783, "timestamp_epoch": "1533964904.753223000" }, { "kind": "tls_client_hello", "dst_ip": "8.39.36.145", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "optimized-by.rubiconproject.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-dd43a98956c4e04aae5d1311", "src_port": 49570, "tcp_stream": 414, "udp_stream": null, "frame_number": 14819, "timestamp_epoch": "1533964904.795068000" }, { "kind": "tls_client_hello", "dst_ip": "8.39.36.145", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "optimized-by.rubiconproject.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-6b9f1e2f8b78b26c246d0408", "src_port": 49569, "tcp_stream": 413, "udp_stream": null, "frame_number": 14821, "timestamp_epoch": "1533964904.795277000" }, { "kind": "tls_client_hello", "dst_ip": "64.233.184.94", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "csi.gstatic.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-07042ad80768594efac27714", "src_port": 49556, "tcp_stream": 400, "udp_stream": null, "frame_number": 14869, "timestamp_epoch": "1533964904.839279000" }, { "kind": "tls_client_hello", "dst_ip": "64.233.184.94", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "csi.gstatic.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-db600b5a470b6cd151a858ab", "src_port": 49555, "tcp_stream": 399, "udp_stream": null, "frame_number": 14870, "timestamp_epoch": "1533964904.839407000" }, { "kind": "tls_client_hello", "dst_ip": "146.20.133.87", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "v.lkqd.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-df1a136f4061a2ace3fd6fdc", "src_port": 49565, "tcp_stream": 409, "udp_stream": null, "frame_number": 14930, "timestamp_epoch": "1533964904.905276000" }, { "kind": "tls_client_hello", "dst_ip": "146.20.133.87", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "v.lkqd.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-a69247d7a6314bccc3234fe8", "src_port": 49567, "tcp_stream": 411, "udp_stream": null, "frame_number": 14934, "timestamp_epoch": "1533964904.912081000" }, { "kind": "tls_client_hello", "dst_ip": "146.20.133.87", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "v.lkqd.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-7c2f97f8bfea14501a94c648", "src_port": 49566, "tcp_stream": 410, "udp_stream": null, "frame_number": 14935, "timestamp_epoch": "1533964904.912221000" }, { "kind": "tls_client_hello", "dst_ip": "146.20.133.87", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "v.lkqd.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-3220ed652a561b9911e4b837", "src_port": 49568, "tcp_stream": 412, "udp_stream": null, "frame_number": 14938, "timestamp_epoch": "1533964904.912592000" }, { "kind": "tls_client_hello", "dst_ip": "23.73.239.75", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tt3.zedo.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-0bb3d4663961df15cb91ce6d", "src_port": 49571, "tcp_stream": 415, "udp_stream": null, "frame_number": 15084, "timestamp_epoch": "1533964905.116295000" }, { "kind": "tls_client_hello", "dst_ip": "23.73.239.75", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tt3.zedo.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-5addeaa70db305610f9b580d", "src_port": 49572, "tcp_stream": 416, "udp_stream": null, "frame_number": 15091, "timestamp_epoch": "1533964905.125018000" }, { "kind": "tls_client_hello", "dst_ip": "205.185.216.10", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ad.lkqd.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-2279ade1c14498008f99079f", "src_port": 49573, "tcp_stream": 417, "udp_stream": null, "frame_number": 15195, "timestamp_epoch": "1533964906.256898000" }, { "kind": "tls_client_hello", "dst_ip": "205.185.216.10", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ad.lkqd.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-d025bc7e14f0fab6ce74e63f", "src_port": 49574, "tcp_stream": 418, "udp_stream": null, "frame_number": 15199, "timestamp_epoch": "1533964906.257378000" }, { "kind": "tls_client_hello", "dst_ip": "205.185.216.10", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ad.lkqd.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-e74cd1a8d0ff84c211fbd607", "src_port": 49576, "tcp_stream": 420, "udp_stream": null, "frame_number": 15205, "timestamp_epoch": "1533964906.258704000" }, { "kind": "tls_client_hello", "dst_ip": "205.185.216.10", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ad.lkqd.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-a7497ab2622d979a571fe856", "src_port": 49575, "tcp_stream": 419, "udp_stream": null, "frame_number": 15206, "timestamp_epoch": "1533964906.258705000" }, { "kind": "tls_client_hello", "dst_ip": "205.185.216.10", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ad.lkqd.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-a1dfc0c616ddbf7e706a77da", "src_port": 49577, "tcp_stream": 421, "udp_stream": null, "frame_number": 15211, "timestamp_epoch": "1533964906.272741000" }, { "kind": "tls_client_hello", "dst_ip": "205.185.216.10", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ad.lkqd.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-cba54cadee9dd833412e5b93", "src_port": 49578, "tcp_stream": 422, "udp_stream": null, "frame_number": 15221, "timestamp_epoch": "1533964906.310134000" }, { "kind": "tls_client_hello", "dst_ip": "74.119.117.129", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "static.criteo.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-ae8cc327c25fea1637a1b667", "src_port": 49579, "tcp_stream": 423, "udp_stream": null, "frame_number": 15565, "timestamp_epoch": "1533964906.748908000" }, { "kind": "tls_client_hello", "dst_ip": "74.119.117.129", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "static.criteo.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-961b733b4418aa1d522663bf", "src_port": 49580, "tcp_stream": 424, "udp_stream": null, "frame_number": 15569, "timestamp_epoch": "1533964906.750692000" }, { "kind": "tls_client_hello", "dst_ip": "54.214.11.239", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "hbevents.1rx.io" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-ffde7f12f0013798dfcbd5a4", "src_port": 49581, "tcp_stream": 425, "udp_stream": null, "frame_number": 15602, "timestamp_epoch": "1533964906.851735000" }, { "kind": "tls_client_hello", "dst_ip": "54.214.11.239", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "hbevents.1rx.io" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-8b2cb7492448d94c7cfce3ea", "src_port": 49582, "tcp_stream": 426, "udp_stream": null, "frame_number": 15603, "timestamp_epoch": "1533964906.851959000" }, { "kind": "tls_client_hello", "dst_ip": "146.20.132.243", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "t.lkqd.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-f41651ea5f251c5c4b8c5b50", "src_port": 49584, "tcp_stream": 428, "udp_stream": null, "frame_number": 15676, "timestamp_epoch": "1533964907.180598000" }, { "kind": "tls_client_hello", "dst_ip": "146.20.132.243", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "t.lkqd.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-2bd2e016db658c0da4c5a039", "src_port": 49585, "tcp_stream": 429, "udp_stream": null, "frame_number": 15677, "timestamp_epoch": "1533964907.180602000" }, { "kind": "tls_client_hello", "dst_ip": "146.20.132.243", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "t.lkqd.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-effe8a178a98faae72c774b8", "src_port": 49583, "tcp_stream": 427, "udp_stream": null, "frame_number": 15682, "timestamp_epoch": "1533964907.187736000" }, { "kind": "tls_client_hello", "dst_ip": "146.20.132.243", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "t.lkqd.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-387cc5a63e75eb755e637473", "src_port": 49586, "tcp_stream": 430, "udp_stream": null, "frame_number": 15727, "timestamp_epoch": "1533964907.339216000" }, { "kind": "tls_client_hello", "dst_ip": "146.20.132.243", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "t.lkqd.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-e8ddbb4ae335fe3d55685051", "src_port": 49587, "tcp_stream": 431, "udp_stream": null, "frame_number": 15735, "timestamp_epoch": "1533964907.423343000" }, { "kind": "tls_client_hello", "dst_ip": "64.41.197.55", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tt1.zedo.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-79577d04ccbe4301a6fd705f", "src_port": 49589, "tcp_stream": 432, "udp_stream": null, "frame_number": 15764, "timestamp_epoch": "1533964907.556693000" }, { "kind": "tls_client_hello", "dst_ip": "64.41.197.55", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tt1.zedo.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-08705c5cac5a200e532194d4", "src_port": 49588, "tcp_stream": 433, "udp_stream": null, "frame_number": 15766, "timestamp_epoch": "1533964907.556829000" }, { "kind": "tls_client_hello", "dst_ip": "146.20.132.243", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "t.lkqd.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-a4e962beb7d6ae16d4b9a5e2", "src_port": 49590, "tcp_stream": 434, "udp_stream": null, "frame_number": 15831, "timestamp_epoch": "1533964907.716650000" }, { "kind": "tls_client_hello", "dst_ip": "23.54.21.180", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ads.pubmatic.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-215c2a1b439e86e3f9b33bb2", "src_port": 49591, "tcp_stream": 435, "udp_stream": null, "frame_number": 15851, "timestamp_epoch": "1533964907.775575000" }, { "kind": "tls_client_hello", "dst_ip": "23.54.21.180", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ads.pubmatic.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-a7642215abf0c62450c13616", "src_port": 49592, "tcp_stream": 436, "udp_stream": null, "frame_number": 15853, "timestamp_epoch": "1533964907.776016000" }, { "kind": "tls_client_hello", "dst_ip": "104.36.113.23", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "image6.pubmatic.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-c014d1860117d5ffb83a4def", "src_port": 49593, "tcp_stream": 437, "udp_stream": null, "frame_number": 15937, "timestamp_epoch": "1533964908.117624000" }, { "kind": "tls_client_hello", "dst_ip": "104.36.113.23", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "image6.pubmatic.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-7d40ec24e6d7f26ab2b89b2d", "src_port": 49594, "tcp_stream": 438, "udp_stream": null, "frame_number": 15938, "timestamp_epoch": "1533964908.117625000" }, { "kind": "tls_client_hello", "dst_ip": "69.194.244.11", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ad.turn.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-02e6969f721564bc13f202f2", "src_port": 49595, "tcp_stream": 440, "udp_stream": null, "frame_number": 15992, "timestamp_epoch": "1533964908.383881000" }, { "kind": "tls_client_hello", "dst_ip": "69.194.244.11", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ad.turn.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-3cc4b11b1b0e4d9c34aeafa8", "src_port": 49596, "tcp_stream": 439, "udp_stream": null, "frame_number": 16000, "timestamp_epoch": "1533964908.387288000" }, { "kind": "tls_client_hello", "dst_ip": "151.101.2.49", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "sync-tm.everesttech.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-ff6d2c22f8eda184b1c153c9", "src_port": 49602, "tcp_stream": 446, "udp_stream": null, "frame_number": 16001, "timestamp_epoch": "1533964908.387464000" }, { "kind": "tls_client_hello", "dst_ip": "151.101.2.49", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "sync-tm.everesttech.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-83f7eaa4c83ecfc5390c9987", "src_port": 49601, "tcp_stream": 445, "udp_stream": null, "frame_number": 16002, "timestamp_epoch": "1533964908.387715000" }, { "kind": "tls_client_hello", "dst_ip": "54.186.116.83", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "match.adsrvr.org" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-2872b4019ff0412748b818a1", "src_port": 49600, "tcp_stream": 444, "udp_stream": null, "frame_number": 16022, "timestamp_epoch": "1533964908.405170000" }, { "kind": "tls_client_hello", "dst_ip": "54.186.116.83", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "match.adsrvr.org" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-200dea6aa8b0d05797e2f5f6", "src_port": 49599, "tcp_stream": 443, "udp_stream": null, "frame_number": 16026, "timestamp_epoch": "1533964908.405722000" }, { "kind": "tls_client_hello", "dst_ip": "216.200.232.221", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "sync.mathtag.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-7877df4694faf9f1c80541f8", "src_port": 49604, "tcp_stream": 448, "udp_stream": null, "frame_number": 16046, "timestamp_epoch": "1533964908.428705000" }, { "kind": "tls_client_hello", "dst_ip": "216.200.232.221", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "sync.mathtag.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-11bbb17dde9b5e291727f69b", "src_port": 49603, "tcp_stream": 447, "udp_stream": null, "frame_number": 16047, "timestamp_epoch": "1533964908.428863000" }, { "kind": "tls_client_hello", "dst_ip": "74.119.117.94", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "dis.criteo.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-4a1d746894a01bd67216237f", "src_port": 49605, "tcp_stream": 449, "udp_stream": null, "frame_number": 16074, "timestamp_epoch": "1533964908.456604000" }, { "kind": "tls_client_hello", "dst_ip": "74.119.117.94", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "dis.criteo.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-6730e927752c32054ca9ea03", "src_port": 49606, "tcp_stream": 450, "udp_stream": null, "frame_number": 16081, "timestamp_epoch": "1533964908.458723000" }, { "kind": "tls_client_hello", "dst_ip": "199.38.167.128", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "p.rfihub.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-d3c9bef1eace218f83053dfb", "src_port": 49597, "tcp_stream": 441, "udp_stream": null, "frame_number": 16084, "timestamp_epoch": "1533964908.459084000" }, { "kind": "tls_client_hello", "dst_ip": "199.38.167.128", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "p.rfihub.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-792ad0dea26d21d8f18a5c40", "src_port": 49598, "tcp_stream": 442, "udp_stream": null, "frame_number": 16086, "timestamp_epoch": "1533964908.459668000" }, { "kind": "tls_client_hello", "dst_ip": "205.180.87.137", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pubmatic-match.dotomi.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-bb8394bbdb82d059cc5a8a60", "src_port": 49611, "tcp_stream": 455, "udp_stream": null, "frame_number": 16105, "timestamp_epoch": "1533964908.481382000" }, { "kind": "tls_client_hello", "dst_ip": "205.180.87.137", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pubmatic-match.dotomi.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-1811ea6594e3504c9c64e890", "src_port": 49612, "tcp_stream": 456, "udp_stream": null, "frame_number": 16106, "timestamp_epoch": "1533964908.481558000" }, { "kind": "tls_client_hello", "dst_ip": "52.44.44.54", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "p.adsymptotic.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-7f4c6710b16545f95154889f", "src_port": 49610, "tcp_stream": 454, "udp_stream": null, "frame_number": 16152, "timestamp_epoch": "1533964908.533771000" }, { "kind": "tls_client_hello", "dst_ip": "52.44.44.54", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "p.adsymptotic.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-f40bc54678465325989ca0a1", "src_port": 49609, "tcp_stream": 453, "udp_stream": null, "frame_number": 16164, "timestamp_epoch": "1533964908.543183000" }, { "kind": "tls_client_hello", "dst_ip": "104.193.83.156", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pubmatic2waycm-atl.netmng.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-c08b0fb3b05550b631d45031", "src_port": 49608, "tcp_stream": 452, "udp_stream": null, "frame_number": 16166, "timestamp_epoch": "1533964908.543281000" }, { "kind": "tls_client_hello", "dst_ip": "104.36.113.17", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "simage2.pubmatic.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-e1e59f38522191356df4abb9", "src_port": 49613, "tcp_stream": 457, "udp_stream": null, "frame_number": 16175, "timestamp_epoch": "1533964908.544073000" }, { "kind": "tls_client_hello", "dst_ip": "104.193.83.156", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pubmatic2waycm-atl.netmng.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-eeab6b7ba72421882b6202de", "src_port": 49607, "tcp_stream": 451, "udp_stream": null, "frame_number": 16176, "timestamp_epoch": "1533964908.544102000" }, { "kind": "tls_client_hello", "dst_ip": "104.36.113.17", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "simage2.pubmatic.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-4771587ca0ebb9dfc614e171", "src_port": 49614, "tcp_stream": 458, "udp_stream": null, "frame_number": 16177, "timestamp_epoch": "1533964908.544241000" }, { "kind": "tls_client_hello", "dst_ip": "104.36.113.17", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "simage2.pubmatic.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-864745dfbd5182bbfe48bc5e", "src_port": 49615, "tcp_stream": 459, "udp_stream": null, "frame_number": 16248, "timestamp_epoch": "1533964908.650930000" }, { "kind": "tls_client_hello", "dst_ip": "104.36.113.17", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "simage2.pubmatic.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-e04048d424fb14a80624668f", "src_port": 49617, "tcp_stream": 461, "udp_stream": null, "frame_number": 16357, "timestamp_epoch": "1533964908.823331000" }, { "kind": "tls_client_hello", "dst_ip": "104.36.113.17", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "simage2.pubmatic.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-4af3ec5fe7a5ef62f007c8dc", "src_port": 49616, "tcp_stream": 460, "udp_stream": null, "frame_number": 16359, "timestamp_epoch": "1533964908.823497000" }, { "kind": "tls_client_hello", "dst_ip": "104.36.113.17", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "simage2.pubmatic.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-5a1ce3ac0c36f65b65b7790d", "src_port": 49618, "tcp_stream": 462, "udp_stream": null, "frame_number": 16375, "timestamp_epoch": "1533964908.839064000" }, { "kind": "tls_client_hello", "dst_ip": "104.36.113.24", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "image4.pubmatic.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-a0b038437600e398257813c2", "src_port": 49619, "tcp_stream": 463, "udp_stream": null, "frame_number": 16412, "timestamp_epoch": "1533964908.961212000" }, { "kind": "tls_client_hello", "dst_ip": "104.36.113.24", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "image4.pubmatic.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-01b126326cd0ec04c5e79e9c", "src_port": 49620, "tcp_stream": 464, "udp_stream": null, "frame_number": 16413, "timestamp_epoch": "1533964908.961417000" }, { "kind": "tls_client_hello", "dst_ip": "184.26.122.58", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "eus.rubiconproject.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-711b180ee6c16b51bee3affe", "src_port": 49621, "tcp_stream": 465, "udp_stream": null, "frame_number": 16464, "timestamp_epoch": "1533964909.174457000" }, { "kind": "tls_client_hello", "dst_ip": "184.26.122.58", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "eus.rubiconproject.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-fed287899184b709727895fb", "src_port": 49622, "tcp_stream": 466, "udp_stream": null, "frame_number": 16466, "timestamp_epoch": "1533964909.174601000" }, { "kind": "tls_client_hello", "dst_ip": "54.246.133.167", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "dpm.demdex.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-1d44d29339b48cb9ae16037a", "src_port": 49624, "tcp_stream": 468, "udp_stream": null, "frame_number": 16534, "timestamp_epoch": "1533964909.914087000" }, { "kind": "tls_client_hello", "dst_ip": "54.246.133.167", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "dpm.demdex.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-ba92fa83bd1e29cd51ac7c74", "src_port": 49623, "tcp_stream": 467, "udp_stream": null, "frame_number": 16536, "timestamp_epoch": "1533964909.916198000" }, { "kind": "tls_client_hello", "dst_ip": "8.39.36.172", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "token.rubiconproject.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-bff020d097b9e229d9dbcd62", "src_port": 49625, "tcp_stream": 469, "udp_stream": null, "frame_number": 16588, "timestamp_epoch": "1533964910.150506000" }, { "kind": "tls_client_hello", "dst_ip": "8.39.36.172", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "token.rubiconproject.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-7b4c1c5e560ae2545a0ed45a", "src_port": 49626, "tcp_stream": 470, "udp_stream": null, "frame_number": 16592, "timestamp_epoch": "1533964910.156208000" }, { "kind": "tls_client_hello", "dst_ip": "8.39.36.172", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "token.rubiconproject.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-9c6bee9a82b10a6f313e9683", "src_port": 49627, "tcp_stream": 471, "udp_stream": null, "frame_number": 16600, "timestamp_epoch": "1533964910.171224000" }, { "kind": "tls_client_hello", "dst_ip": "8.39.36.143", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pixel.rubiconproject.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-66bbf8b6c5d1b6f49a29258c", "src_port": 49628, "tcp_stream": 472, "udp_stream": null, "frame_number": 16630, "timestamp_epoch": "1533964910.249486000" }, { "kind": "tls_client_hello", "dst_ip": "8.39.36.143", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pixel.rubiconproject.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-5f14ef3ce88c0bc619579097", "src_port": 49629, "tcp_stream": 473, "udp_stream": null, "frame_number": 16633, "timestamp_epoch": "1533964910.249866000" }, { "kind": "tls_client_hello", "dst_ip": "8.39.36.143", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pixel.rubiconproject.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-426d0a0505264427cbc50eee", "src_port": 49631, "tcp_stream": 474, "udp_stream": null, "frame_number": 16637, "timestamp_epoch": "1533964910.251487000" }, { "kind": "tls_client_hello", "dst_ip": "8.39.36.143", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pixel.rubiconproject.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-4672bfa70e66bbe76462edaa", "src_port": 49630, "tcp_stream": 475, "udp_stream": null, "frame_number": 16643, "timestamp_epoch": "1533964910.254776000" }, { "kind": "tls_client_hello", "dst_ip": "8.39.36.143", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pixel.rubiconproject.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-d4bbd3d3dfea5cac1524a605", "src_port": 49632, "tcp_stream": 476, "udp_stream": null, "frame_number": 16644, "timestamp_epoch": "1533964910.255157000" }, { "kind": "tls_client_hello", "dst_ip": "74.6.34.27", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pr-bh.ybp.yahoo.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-2955deda81e8cb3283895edb", "src_port": 49633, "tcp_stream": 477, "udp_stream": null, "frame_number": 16736, "timestamp_epoch": "1533964910.417681000" }, { "kind": "tls_client_hello", "dst_ip": "98.136.101.121", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ads.yahoo.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-dff61e9f339529109d2b4914", "src_port": 49635, "tcp_stream": 479, "udp_stream": null, "frame_number": 16747, "timestamp_epoch": "1533964910.427694000" }, { "kind": "tls_client_hello", "dst_ip": "74.6.34.27", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pr-bh.ybp.yahoo.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-90fceb0c436bf80d75c7360f", "src_port": 49634, "tcp_stream": 478, "udp_stream": null, "frame_number": 16749, "timestamp_epoch": "1533964910.427951000" }, { "kind": "tls_client_hello", "dst_ip": "98.136.101.121", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ads.yahoo.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-a63010df205557dbfb34a488", "src_port": 49636, "tcp_stream": 480, "udp_stream": null, "frame_number": 16750, "timestamp_epoch": "1533964910.428144000" }, { "kind": "tls_client_hello", "dst_ip": "104.36.113.24", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "simage4.pubmatic.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-bf1893f2416b0913a58113cb", "src_port": 49637, "tcp_stream": 481, "udp_stream": null, "frame_number": 16757, "timestamp_epoch": "1533964910.464401000" }, { "kind": "tls_client_hello", "dst_ip": "104.36.113.24", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "simage4.pubmatic.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-30c08472d4d640b3e2e51978", "src_port": 49638, "tcp_stream": 482, "udp_stream": null, "frame_number": 16759, "timestamp_epoch": "1533964910.464624000" }, { "kind": "tls_client_hello", "dst_ip": "67.195.229.45", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cookiex.ngd.yahoo.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-f6277de3ba0794dd550541b9", "src_port": 49639, "tcp_stream": 483, "udp_stream": null, "frame_number": 16846, "timestamp_epoch": "1533964910.795788000" }, { "kind": "tls_client_hello", "dst_ip": "67.195.229.45", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cookiex.ngd.yahoo.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-ae7b91ffbb30d7e247fb68b1", "src_port": 49640, "tcp_stream": 484, "udp_stream": null, "frame_number": 16849, "timestamp_epoch": "1533964910.796568000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.2", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ade.googlesyndication.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-11c6afd210505fd9ba4bbdf3", "src_port": 49641, "tcp_stream": 485, "udp_stream": null, "frame_number": 16958, "timestamp_epoch": "1533964912.979369000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.2", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ade.googlesyndication.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-f98b36ce55d741315f8dbb67", "src_port": 49642, "tcp_stream": 486, "udp_stream": null, "frame_number": 16962, "timestamp_epoch": "1533964912.980377000" }, { "kind": "tls_client_hello", "dst_ip": "54.176.157.57", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "saxp.zedo.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-1071a478b68fb1af2c50ec30", "src_port": 49644, "tcp_stream": 488, "udp_stream": null, "frame_number": 17163, "timestamp_epoch": "1533964954.907270000" }, { "kind": "tls_client_hello", "dst_ip": "54.176.157.57", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "saxp.zedo.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-b21e24829fbf76d48a4af01e", "src_port": 49643, "tcp_stream": 487, "udp_stream": null, "frame_number": 17164, "timestamp_epoch": "1533964954.907271000" }, { "kind": "tls_client_hello", "dst_ip": "64.41.197.55", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tt1.zedo.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-1b29e604a954c074d07ae764", "src_port": 49646, "tcp_stream": 489, "udp_stream": null, "frame_number": 17171, "timestamp_epoch": "1533964954.912801000" }, { "kind": "tls_client_hello", "dst_ip": "64.41.197.55", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tt1.zedo.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-e1e12a0ea2e8639a033735fb", "src_port": 49645, "tcp_stream": 490, "udp_stream": null, "frame_number": 17172, "timestamp_epoch": "1533964954.912900000" }, { "kind": "tls_client_hello", "dst_ip": "94.31.29.138", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cdn.jsdelivr.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-4fa368bf82ff6ad643894f9d", "src_port": 49647, "tcp_stream": 491, "udp_stream": null, "frame_number": 17318, "timestamp_epoch": "1533964955.947846000" }, { "kind": "tls_client_hello", "dst_ip": "94.31.29.138", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cdn.jsdelivr.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-104f12083b5d5ab16ebb5ff1", "src_port": 49648, "tcp_stream": 492, "udp_stream": null, "frame_number": 17319, "timestamp_epoch": "1533964955.947973000" }, { "kind": "tls_client_hello", "dst_ip": "35.171.141.177", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "uat-secure.technoratimedia.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-e877a3ff44e51ffa5e663263", "src_port": 49649, "tcp_stream": 493, "udp_stream": null, "frame_number": 17386, "timestamp_epoch": "1533964956.426876000" }, { "kind": "tls_client_hello", "dst_ip": "35.171.141.177", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "uat-secure.technoratimedia.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-7b3703d643a2d8d4e300425c", "src_port": 49650, "tcp_stream": 494, "udp_stream": null, "frame_number": 17387, "timestamp_epoch": "1533964956.427338000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.10", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "imasdk.googleapis.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-5441f6717dd643e2e22cb625", "src_port": 49651, "tcp_stream": 495, "udp_stream": null, "frame_number": 17509, "timestamp_epoch": "1533964956.619349000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.6", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "s0.2mdn.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-dd6e1e95a0672cbbabf38419", "src_port": 49652, "tcp_stream": 496, "udp_stream": null, "frame_number": 17525, "timestamp_epoch": "1533964956.631645000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.194.162", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "adservice.google.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-f71c2245382b8030789c5927", "src_port": 49653, "tcp_stream": 497, "udp_stream": null, "frame_number": 17533, "timestamp_epoch": "1533964956.641278000" }, { "kind": "tls_client_hello", "dst_ip": "52.27.237.90", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "vid-io.springserve.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-43664ea400a2c24f00facc70", "src_port": 49655, "tcp_stream": 499, "udp_stream": null, "frame_number": 17781, "timestamp_epoch": "1533964957.193121000" }, { "kind": "tls_client_hello", "dst_ip": "52.27.237.90", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "vid-io.springserve.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-b0a5193d0b92c6cc7ea56e65", "src_port": 49654, "tcp_stream": 498, "udp_stream": null, "frame_number": 17782, "timestamp_epoch": "1533964957.193122000" }, { "kind": "tls_client_hello", "dst_ip": "52.44.165.199", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "uat-net.technoratimedia.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-a7ff73a5bb53dae65f02feaf", "src_port": 49656, "tcp_stream": 500, "udp_stream": null, "frame_number": 17946, "timestamp_epoch": "1533964957.595012000" }, { "kind": "tls_client_hello", "dst_ip": "52.44.165.199", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "uat-net.technoratimedia.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-301c6531089754b4683523ea", "src_port": 49657, "tcp_stream": 501, "udp_stream": null, "frame_number": 17957, "timestamp_epoch": "1533964957.625014000" }, { "kind": "tls_client_hello", "dst_ip": "35.164.52.21", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "vid.springserve.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-4d010f15d8bec21ed2a365e2", "src_port": 49658, "tcp_stream": 502, "udp_stream": null, "frame_number": 17965, "timestamp_epoch": "1533964957.628407000" }, { "kind": "tls_client_hello", "dst_ip": "35.164.52.21", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "vid.springserve.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-03c896a68bf572b11ddef53d", "src_port": 49659, "tcp_stream": 503, "udp_stream": null, "frame_number": 17966, "timestamp_epoch": "1533964957.628409000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.2", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pubads.g.doubleclick.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-8e43c5674fbcb1d8bc3d371b", "src_port": 49660, "tcp_stream": 504, "udp_stream": null, "frame_number": 18134, "timestamp_epoch": "1533964958.132879000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.2", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pubads.g.doubleclick.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-a7e4305110332591824eefaa", "src_port": 49661, "tcp_stream": 505, "udp_stream": null, "frame_number": 18135, "timestamp_epoch": "1533964958.133287000" }, { "kind": "tls_client_hello", "dst_ip": "104.254.150.69", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "secure.adnxs.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-8f2ae1a46f79aed9688c14f0", "src_port": 49666, "tcp_stream": 510, "udp_stream": null, "frame_number": 18224, "timestamp_epoch": "1533964958.517047000" }, { "kind": "tls_client_hello", "dst_ip": "104.254.150.69", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "secure.adnxs.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-127b960519f554a2edaebd4d", "src_port": 49667, "tcp_stream": 511, "udp_stream": null, "frame_number": 18227, "timestamp_epoch": "1533964958.517518000" }, { "kind": "tls_client_hello", "dst_ip": "8.41.222.241", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "sync.1rx.io" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-6ffcdb0dc088031dcb9325be", "src_port": 49663, "tcp_stream": 507, "udp_stream": null, "frame_number": 18238, "timestamp_epoch": "1533964958.548661000" }, { "kind": "tls_client_hello", "dst_ip": "8.41.222.241", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "sync.1rx.io" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-f68c38f20b8ff154982c6ec8", "src_port": 49662, "tcp_stream": 506, "udp_stream": null, "frame_number": 18239, "timestamp_epoch": "1533964958.549363000" }, { "kind": "tls_client_hello", "dst_ip": "23.220.187.187", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "secure-assets.rubiconproject.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-ab6880a0502032c48e10bdc2", "src_port": 49672, "tcp_stream": 516, "udp_stream": null, "frame_number": 18246, "timestamp_epoch": "1533964958.557671000" }, { "kind": "tls_client_hello", "dst_ip": "23.220.187.187", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "secure-assets.rubiconproject.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-4a16961a63a6a1c270940dfc", "src_port": 49671, "tcp_stream": 515, "udp_stream": null, "frame_number": 18248, "timestamp_epoch": "1533964958.557673000" }, { "kind": "tls_client_hello", "dst_ip": "207.244.102.143", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "sync.aralego.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-4219104a50228709b291f934", "src_port": 49664, "tcp_stream": 508, "udp_stream": null, "frame_number": 18254, "timestamp_epoch": "1533964958.577179000" }, { "kind": "tls_client_hello", "dst_ip": "207.244.102.143", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "sync.aralego.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-93519335a958fae8b0455779", "src_port": 49665, "tcp_stream": 509, "udp_stream": null, "frame_number": 18255, "timestamp_epoch": "1533964958.577252000" }, { "kind": "tls_client_hello", "dst_ip": "52.26.87.58", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "sync.springserve.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-a80b35646e9080a44662fc92", "src_port": 49668, "tcp_stream": 512, "udp_stream": null, "frame_number": 18262, "timestamp_epoch": "1533964958.578339000" }, { "kind": "tls_client_hello", "dst_ip": "52.26.87.58", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "sync.springserve.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-066e1a5357be649693a25ba0", "src_port": 49669, "tcp_stream": 513, "udp_stream": null, "frame_number": 18263, "timestamp_epoch": "1533964958.578487000" }, { "kind": "tls_client_hello", "dst_ip": "52.44.165.199", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "uat-net.technoratimedia.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-bba58d9542e959530a7af4a8", "src_port": 49670, "tcp_stream": 514, "udp_stream": null, "frame_number": 18298, "timestamp_epoch": "1533964958.637131000" }, { "kind": "tls_client_hello", "dst_ip": "94.31.29.250", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "vpaid.springserve.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-06e1584e38953311134be11f", "src_port": 49673, "tcp_stream": 517, "udp_stream": null, "frame_number": 18317, "timestamp_epoch": "1533964958.687621000" }, { "kind": "tls_client_hello", "dst_ip": "94.31.29.250", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "vpaid.springserve.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-010bed8ef877177c81e0ae39", "src_port": 49674, "tcp_stream": 518, "udp_stream": null, "frame_number": 18326, "timestamp_epoch": "1533964958.690508000" }, { "kind": "tls_client_hello", "dst_ip": "69.174.248.228", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pixel-sync.sitescout.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-ca04eb914afbf09178e1faeb", "src_port": 49677, "tcp_stream": 521, "udp_stream": null, "frame_number": 18582, "timestamp_epoch": "1533964959.371649000" }, { "kind": "tls_client_hello", "dst_ip": "69.174.248.228", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pixel-sync.sitescout.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-8dc4973e77afb40dedc471f0", "src_port": 49678, "tcp_stream": 522, "udp_stream": null, "frame_number": 18584, "timestamp_epoch": "1533964959.371752000" }, { "kind": "tls_client_hello", "dst_ip": "185.167.164.37", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "c1.adform.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-65b31691a64a4e1b0fc77370", "src_port": 49675, "tcp_stream": 519, "udp_stream": null, "frame_number": 18603, "timestamp_epoch": "1533964959.399499000" }, { "kind": "tls_client_hello", "dst_ip": "185.167.164.37", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "c1.adform.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-0568a3db126eb4f834344674", "src_port": 49676, "tcp_stream": 520, "udp_stream": null, "frame_number": 18604, "timestamp_epoch": "1533964959.399749000" }, { "kind": "tls_client_hello", "dst_ip": "104.254.150.77", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ib.adnxs.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-f72b5211c5e32a6747730f3e", "src_port": 49680, "tcp_stream": 524, "udp_stream": null, "frame_number": 18640, "timestamp_epoch": "1533964959.508962000" }, { "kind": "tls_client_hello", "dst_ip": "104.254.150.77", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ib.adnxs.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-93f805620d8532c18efaaf60", "src_port": 49679, "tcp_stream": 523, "udp_stream": null, "frame_number": 18646, "timestamp_epoch": "1533964959.510081000" }, { "kind": "tls_client_hello", "dst_ip": "151.101.2.49", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "match.basebanner.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-984960bcda78d239aa171241", "src_port": 49683, "tcp_stream": 527, "udp_stream": null, "frame_number": 18677, "timestamp_epoch": "1533964959.691383000" }, { "kind": "tls_client_hello", "dst_ip": "151.101.2.49", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "match.basebanner.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-a12acc4c2cd4ee0564fd3f81", "src_port": 49684, "tcp_stream": 528, "udp_stream": null, "frame_number": 18685, "timestamp_epoch": "1533964959.704203000" }, { "kind": "tls_client_hello", "dst_ip": "34.207.5.71", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "idsync.rlcdn.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-6bf61037689298751925613c", "src_port": 49682, "tcp_stream": 526, "udp_stream": null, "frame_number": 18695, "timestamp_epoch": "1533964959.750246000" }, { "kind": "tls_client_hello", "dst_ip": "34.207.5.71", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "idsync.rlcdn.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-fef6ac35dc7dbed28c1fc791", "src_port": 49681, "tcp_stream": 525, "udp_stream": null, "frame_number": 18696, "timestamp_epoch": "1533964959.750247000" }, { "kind": "tls_client_hello", "dst_ip": "204.11.109.68", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "a.tribalfusion.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-c7f206b51becb68ce9da6c41", "src_port": 49688, "tcp_stream": 532, "udp_stream": null, "frame_number": 18707, "timestamp_epoch": "1533964959.880531000" }, { "kind": "tls_client_hello", "dst_ip": "204.11.109.68", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "a.tribalfusion.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-8cf934de7164e507f2b52a3e", "src_port": 49687, "tcp_stream": 531, "udp_stream": null, "frame_number": 18708, "timestamp_epoch": "1533964959.880813000" }, { "kind": "tls_client_hello", "dst_ip": "204.2.197.201", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "idpix.media6degrees.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-f311a83112f239dd9e2628dc", "src_port": 49686, "tcp_stream": 530, "udp_stream": null, "frame_number": 18738, "timestamp_epoch": "1533964959.945476000" }, { "kind": "tls_client_hello", "dst_ip": "204.2.197.201", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "idpix.media6degrees.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-11ad7f4c3fb286afcafcc4b4", "src_port": 49685, "tcp_stream": 529, "udp_stream": null, "frame_number": 18740, "timestamp_epoch": "1533964959.945828000" }, { "kind": "tls_client_hello", "dst_ip": "104.254.150.77", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ib.adnxs.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-517940e56dd65f1a33e2bc9c", "src_port": 49690, "tcp_stream": 534, "udp_stream": null, "frame_number": 18749, "timestamp_epoch": "1533964959.984935000" }, { "kind": "tls_client_hello", "dst_ip": "104.254.150.77", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ib.adnxs.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-ac12341e04c7d6fc555e71c2", "src_port": 49689, "tcp_stream": 533, "udp_stream": null, "frame_number": 18750, "timestamp_epoch": "1533964959.985057000" }, { "kind": "tls_client_hello", "dst_ip": "216.115.100.123", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cdn-ssl.vidible.tv" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-dc33ed20d6147521bb62702a", "src_port": 49691, "tcp_stream": 535, "udp_stream": null, "frame_number": 18856, "timestamp_epoch": "1533964960.141466000" }, { "kind": "tls_client_hello", "dst_ip": "216.115.100.123", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cdn-ssl.vidible.tv" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-7678b4a7cd84cda0dabddb93", "src_port": 49692, "tcp_stream": 536, "udp_stream": null, "frame_number": 18857, "timestamp_epoch": "1533964960.142493000" }, { "kind": "tls_client_hello", "dst_ip": "185.167.164.39", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "a1.adform.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-0f794f0545c073cef91486c6", "src_port": 49694, "tcp_stream": 538, "udp_stream": null, "frame_number": 18890, "timestamp_epoch": "1533964960.194958000" }, { "kind": "tls_client_hello", "dst_ip": "185.167.164.39", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "a1.adform.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-cb5e3fedcf6a21b9c8ae3a70", "src_port": 49693, "tcp_stream": 537, "udp_stream": null, "frame_number": 18894, "timestamp_epoch": "1533964960.196730000" }, { "kind": "tls_client_hello", "dst_ip": "69.174.248.228", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pixel.sitescout.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-51bba9416af1dc4d088d1014", "src_port": 49698, "tcp_stream": 542, "udp_stream": null, "frame_number": 18904, "timestamp_epoch": "1533964960.217591000" }, { "kind": "tls_client_hello", "dst_ip": "69.174.248.228", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pixel.sitescout.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-059a00ded85cfb9ab0fa399f", "src_port": 49697, "tcp_stream": 541, "udp_stream": null, "frame_number": 18908, "timestamp_epoch": "1533964960.218196000" }, { "kind": "tls_client_hello", "dst_ip": "208.185.50.80", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pixel-us-east.rubiconproject.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-d87e35a698366dfceafdcbb0", "src_port": 49695, "tcp_stream": 539, "udp_stream": null, "frame_number": 18914, "timestamp_epoch": "1533964960.219733000" }, { "kind": "tls_client_hello", "dst_ip": "208.185.50.80", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pixel-us-east.rubiconproject.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-ea697d3aeb0924c25610d57a", "src_port": 49696, "tcp_stream": 540, "udp_stream": null, "frame_number": 18935, "timestamp_epoch": "1533964960.247858000" }, { "kind": "tls_client_hello", "dst_ip": "52.94.232.32", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "s.amazon-adsystem.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-d27a21c94a6f601d5636bd3a", "src_port": 49700, "tcp_stream": 544, "udp_stream": null, "frame_number": 19098, "timestamp_epoch": "1533964960.618687000" }, { "kind": "tls_client_hello", "dst_ip": "54.183.210.45", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ads.adaptv.advertising.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-876f5e1f70b28e0a71848f7f", "src_port": 49701, "tcp_stream": 545, "udp_stream": null, "frame_number": 19099, "timestamp_epoch": "1533964960.618867000" }, { "kind": "tls_client_hello", "dst_ip": "52.94.232.32", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "s.amazon-adsystem.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-7227e659697e57134eeec7c1", "src_port": 49699, "tcp_stream": 543, "udp_stream": null, "frame_number": 19101, "timestamp_epoch": "1533964960.619057000" }, { "kind": "tls_client_hello", "dst_ip": "54.183.210.45", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ads.adaptv.advertising.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-5c29dc7db0bd3dce9f0bd02b", "src_port": 49702, "tcp_stream": 546, "udp_stream": null, "frame_number": 19103, "timestamp_epoch": "1533964960.619216000" }, { "kind": "tls_client_hello", "dst_ip": "185.167.166.41", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "s2.adform.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-67efcc8d523348f36ca9dca1", "src_port": 49703, "tcp_stream": 547, "udp_stream": null, "frame_number": 19173, "timestamp_epoch": "1533964960.919412000" }, { "kind": "tls_client_hello", "dst_ip": "185.167.166.41", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "s2.adform.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-18ee394a0793ccee268f083c", "src_port": 49704, "tcp_stream": 548, "udp_stream": null, "frame_number": 19177, "timestamp_epoch": "1533964960.930591000" }, { "kind": "tls_client_hello", "dst_ip": "34.213.12.32", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "vid-io.springserve.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-8d38d4d736aae376536b2245", "src_port": 49705, "tcp_stream": 549, "udp_stream": null, "frame_number": 19235, "timestamp_epoch": "1533964961.462412000" }, { "kind": "tls_client_hello", "dst_ip": "104.254.150.77", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "lax1-ib.adnxs.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-cc377b24e30b104ce9f23649", "src_port": 49708, "tcp_stream": 552, "udp_stream": null, "frame_number": 19336, "timestamp_epoch": "1533964961.815273000" }, { "kind": "tls_client_hello", "dst_ip": "104.254.150.77", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "lax1-ib.adnxs.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-a657550b0816a3eafbed32b1", "src_port": 49709, "tcp_stream": 553, "udp_stream": null, "frame_number": 19342, "timestamp_epoch": "1533964961.831082000" }, { "kind": "tls_client_hello", "dst_ip": "151.101.53.108", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "acdn.adnxs.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-af485bd8083f2572f3154ed0", "src_port": 49711, "tcp_stream": 554, "udp_stream": null, "frame_number": 19349, "timestamp_epoch": "1533964961.843188000" }, { "kind": "tls_client_hello", "dst_ip": "151.101.53.108", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "acdn.adnxs.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-ee024396bf3e3a36a26a7e7a", "src_port": 49710, "tcp_stream": 555, "udp_stream": null, "frame_number": 19352, "timestamp_epoch": "1533964961.843951000" }, { "kind": "tls_client_hello", "dst_ip": "109.232.197.110", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "mm.melia.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-7431af4f5e0e3ab4ea29820a", "src_port": 49706, "tcp_stream": 550, "udp_stream": null, "frame_number": 19358, "timestamp_epoch": "1533964961.845258000" }, { "kind": "tls_client_hello", "dst_ip": "109.232.197.110", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "mm.melia.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-20453b248daac282cc7d112b", "src_port": 49707, "tcp_stream": 551, "udp_stream": null, "frame_number": 19359, "timestamp_epoch": "1533964961.845259000" }, { "kind": "tls_client_hello", "dst_ip": "23.54.20.214", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cdn.adnxs.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-1a79098326763e3c0d97502d", "src_port": 49712, "tcp_stream": 556, "udp_stream": null, "frame_number": 19365, "timestamp_epoch": "1533964961.847417000" }, { "kind": "tls_client_hello", "dst_ip": "23.54.20.214", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cdn.adnxs.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-9b90adc0ac1ee1b2a6e58790", "src_port": 49713, "tcp_stream": 557, "udp_stream": null, "frame_number": 19368, "timestamp_epoch": "1533964961.847994000" }, { "kind": "tls_client_hello", "dst_ip": "72.21.91.113", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tags.crwdcntrl.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-db91f4b82dfdeb34a12a4eec", "src_port": 49714, "tcp_stream": 558, "udp_stream": null, "frame_number": 19374, "timestamp_epoch": "1533964961.873178000" }, { "kind": "tls_client_hello", "dst_ip": "72.21.91.113", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tags.crwdcntrl.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-565e47b1926f49e54e79237d", "src_port": 49715, "tcp_stream": 559, "udp_stream": null, "frame_number": 19381, "timestamp_epoch": "1533964961.876009000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.10", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "fonts.googleapis.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-5d398f70fbf8989fb8330e30", "src_port": 49716, "tcp_stream": 560, "udp_stream": null, "frame_number": 19599, "timestamp_epoch": "1533964962.530305000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.10", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "fonts.googleapis.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-7746a2875c30a961aab1da00", "src_port": 49717, "tcp_stream": 561, "udp_stream": null, "frame_number": 19602, "timestamp_epoch": "1533964962.532060000" }, { "kind": "tls_client_hello", "dst_ip": "34.237.234.13", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "melia.sp1.convertro.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-1e446f41e3a7564535aeb9de", "src_port": 49719, "tcp_stream": 563, "udp_stream": null, "frame_number": 19632, "timestamp_epoch": "1533964962.734007000" }, { "kind": "tls_client_hello", "dst_ip": "34.237.234.13", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "melia.sp1.convertro.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-28c4b5be9a5e264f7f67685a", "src_port": 49718, "tcp_stream": 562, "udp_stream": null, "frame_number": 19633, "timestamp_epoch": "1533964962.734030000" }, { "kind": "tls_client_hello", "dst_ip": "204.79.197.200", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "c.bing.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-a53d4fee3018fc7be3fede62", "src_port": 49720, "tcp_stream": 564, "udp_stream": null, "frame_number": 19753, "timestamp_epoch": "1533964962.972433000" }, { "kind": "tls_client_hello", "dst_ip": "198.54.12.145", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "sync.search.spotxchange.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-2a482ca4ef9a62a848433d0b", "src_port": 49727, "tcp_stream": 571, "udp_stream": null, "frame_number": 19769, "timestamp_epoch": "1533964962.999760000" }, { "kind": "tls_client_hello", "dst_ip": "204.79.197.200", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "c.bing.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-2009198e074048246373e97a", "src_port": 49721, "tcp_stream": 565, "udp_stream": null, "frame_number": 19773, "timestamp_epoch": "1533964963.000514000" }, { "kind": "tls_client_hello", "dst_ip": "161.170.239.188", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "beacon.walmart.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-138f31f556f6d677e0076454", "src_port": 49724, "tcp_stream": 568, "udp_stream": null, "frame_number": 19781, "timestamp_epoch": "1533964963.001566000" }, { "kind": "tls_client_hello", "dst_ip": "161.170.239.188", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "beacon.walmart.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-e084543020c9bb014c1d9cd2", "src_port": 49725, "tcp_stream": 569, "udp_stream": null, "frame_number": 19782, "timestamp_epoch": "1533964963.001718000" }, { "kind": "tls_client_hello", "dst_ip": "198.54.12.145", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "sync.search.spotxchange.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-2fa2bfa1b0d78f069be18ecc", "src_port": 49726, "tcp_stream": 570, "udp_stream": null, "frame_number": 19784, "timestamp_epoch": "1533964963.001886000" }, { "kind": "tls_client_hello", "dst_ip": "54.209.46.223", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "odr.mookie1.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-39f56a298db15f6414ce638a", "src_port": 49722, "tcp_stream": 566, "udp_stream": null, "frame_number": 19804, "timestamp_epoch": "1533964963.040445000" }, { "kind": "tls_client_hello", "dst_ip": "54.209.46.223", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "odr.mookie1.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-34eed065ba6831bdb4d79f80", "src_port": 49723, "tcp_stream": 567, "udp_stream": null, "frame_number": 19805, "timestamp_epoch": "1533964963.041725000" }, { "kind": "tls_client_hello", "dst_ip": "104.254.150.179", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "m.adnxs.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-b9e169ca7c16c2e20d2d8168", "src_port": 49728, "tcp_stream": 573, "udp_stream": null, "frame_number": 19919, "timestamp_epoch": "1533964963.590918000" }, { "kind": "tls_client_hello", "dst_ip": "104.254.150.179", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "m.adnxs.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-69d7605da8977a21683a82b0", "src_port": 49729, "tcp_stream": 572, "udp_stream": null, "frame_number": 19920, "timestamp_epoch": "1533964963.591094000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.194.162", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pagead2.googlesyndication.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-a5266252e473ec8053c72e0a", "src_port": 49730, "tcp_stream": 574, "udp_stream": null, "frame_number": 19951, "timestamp_epoch": "1533964963.672103000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.194.162", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pagead2.googlesyndication.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-89145bc766d314f9378b52cb", "src_port": 49731, "tcp_stream": 575, "udp_stream": null, "frame_number": 19955, "timestamp_epoch": "1533964963.688975000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.194.162", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pagead2.googlesyndication.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-9e9610a74fa0ae47788107c6", "src_port": 49732, "tcp_stream": 576, "udp_stream": null, "frame_number": 19970, "timestamp_epoch": "1533964963.731363000" }, { "kind": "tls_client_hello", "dst_ip": "35.227.197.177", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pixel.tapad.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-de7ae50f168f7a3fe1b00418", "src_port": 49733, "tcp_stream": 577, "udp_stream": null, "frame_number": 20039, "timestamp_epoch": "1533964964.213934000" }, { "kind": "tls_client_hello", "dst_ip": "35.227.197.177", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pixel.tapad.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-c5442db6f8076a6ac83c36a1", "src_port": 49734, "tcp_stream": 578, "udp_stream": null, "frame_number": 20045, "timestamp_epoch": "1533964964.263207000" }, { "kind": "tls_client_hello", "dst_ip": "52.8.202.139", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "bcp.crwdcntrl.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-78ebf7bcafaf07feff80a077", "src_port": 49735, "tcp_stream": 579, "udp_stream": null, "frame_number": 20080, "timestamp_epoch": "1533964964.502301000" }, { "kind": "tls_client_hello", "dst_ip": "52.8.202.139", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "bcp.crwdcntrl.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-2126cb3e00f5fbb30feef6b6", "src_port": 49736, "tcp_stream": 580, "udp_stream": null, "frame_number": 20084, "timestamp_epoch": "1533964964.511697000" }, { "kind": "tls_client_hello", "dst_ip": "13.33.78.101", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "da4pli3l5vc0d.cloudfront.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-8f3315c345ceb9cd9179e9e7", "src_port": 49737, "tcp_stream": 581, "udp_stream": null, "frame_number": 20127, "timestamp_epoch": "1533964964.714903000" }, { "kind": "tls_client_hello", "dst_ip": "13.33.78.101", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "da4pli3l5vc0d.cloudfront.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-84e58985f5f652320362d86c", "src_port": 49738, "tcp_stream": 582, "udp_stream": null, "frame_number": 20131, "timestamp_epoch": "1533964964.723599000" }, { "kind": "tls_client_hello", "dst_ip": "192.229.210.158", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "small-video.edgecast.syn-cdn.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-0fedf41d01b206d630a1eb48", "src_port": 49739, "tcp_stream": 583, "udp_stream": null, "frame_number": 20139, "timestamp_epoch": "1533964964.765035000" }, { "kind": "tls_client_hello", "dst_ip": "192.229.210.158", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "small-video.edgecast.syn-cdn.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-3379aa86f6a750ef9a0e645e", "src_port": 49740, "tcp_stream": 584, "udp_stream": null, "frame_number": 20140, "timestamp_epoch": "1533964964.765162000" }, { "kind": "tls_client_hello", "dst_ip": "54.183.248.197", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "x.skimresources.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-c549fb9ec2b7870b5be58643", "src_port": 49741, "tcp_stream": 586, "udp_stream": null, "frame_number": 20285, "timestamp_epoch": "1533964965.248555000" }, { "kind": "tls_client_hello", "dst_ip": "63.251.252.12", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "loadm.exelator.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-75b300881e31b0ec963d3401", "src_port": 49747, "tcp_stream": 591, "udp_stream": null, "frame_number": 20299, "timestamp_epoch": "1533964965.249476000" }, { "kind": "tls_client_hello", "dst_ip": "63.251.252.12", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "loadm.exelator.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-42908ff56ea1d916b240becd", "src_port": 49748, "tcp_stream": 592, "udp_stream": null, "frame_number": 20300, "timestamp_epoch": "1533964965.249688000" }, { "kind": "tls_client_hello", "dst_ip": "54.183.248.197", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "x.skimresources.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-260468823ace4173f3a30b69", "src_port": 49743, "tcp_stream": 587, "udp_stream": null, "frame_number": 20301, "timestamp_epoch": "1533964965.249899000" }, { "kind": "tls_client_hello", "dst_ip": "54.191.20.146", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ml314.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-32a818248b863837b16b7fa6", "src_port": 49745, "tcp_stream": 589, "udp_stream": null, "frame_number": 20302, "timestamp_epoch": "1533964965.250141000" }, { "kind": "tls_client_hello", "dst_ip": "54.191.20.146", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ml314.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-302155cefa6ccf1eea312cd8", "src_port": 49746, "tcp_stream": 590, "udp_stream": null, "frame_number": 20343, "timestamp_epoch": "1533964965.302580000" }, { "kind": "tls_client_hello", "dst_ip": "156.154.202.36", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "aa.agkn.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-a488b5b023b5a5e667361436", "src_port": 49744, "tcp_stream": 588, "udp_stream": null, "frame_number": 20344, "timestamp_epoch": "1533964965.302742000" }, { "kind": "tls_client_hello", "dst_ip": "156.154.202.36", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "aa.agkn.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-d260293cf0a5a402a1a1361f", "src_port": 49742, "tcp_stream": 585, "udp_stream": null, "frame_number": 20348, "timestamp_epoch": "1533964965.303088000" }, { "kind": "tls_client_hello", "dst_ip": "107.178.254.65", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pippio.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-570a3d36c33ddde5d5a11eaa", "src_port": 49750, "tcp_stream": 594, "udp_stream": null, "frame_number": 20386, "timestamp_epoch": "1533964965.380525000" }, { "kind": "tls_client_hello", "dst_ip": "107.178.254.65", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pippio.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-700570a7cb75d0c6b0e50e29", "src_port": 49749, "tcp_stream": 593, "udp_stream": null, "frame_number": 20387, "timestamp_epoch": "1533964965.380735000" }, { "kind": "tls_client_hello", "dst_ip": "69.168.106.81", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "synacor.autoplay-plugins.static-origin.syn-cdn.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-d473b0471b42c21d9d79eb25", "src_port": 49751, "tcp_stream": 595, "udp_stream": null, "frame_number": 20746, "timestamp_epoch": "1533964966.367680000" }, { "kind": "tls_client_hello", "dst_ip": "69.168.106.81", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "synacor.autoplay-plugins.static-origin.syn-cdn.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-3aa8198b2944ee759ac177a4", "src_port": 49752, "tcp_stream": 596, "udp_stream": null, "frame_number": 20749, "timestamp_epoch": "1533964966.368072000" }, { "kind": "tls_client_hello", "dst_ip": "35.190.91.160", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "p.skimresources.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-2ad3ba5634c183b0c0fcafe9", "src_port": 49753, "tcp_stream": 597, "udp_stream": null, "frame_number": 20975, "timestamp_epoch": "1533964967.208417000" }, { "kind": "tls_client_hello", "dst_ip": "35.190.91.160", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "p.skimresources.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-5d16ec3d2cd34b892f8a1f50", "src_port": 49754, "tcp_stream": 598, "udp_stream": null, "frame_number": 20976, "timestamp_epoch": "1533964967.208418000" }, { "kind": "tls_client_hello", "dst_ip": "185.180.13.28", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "load77.exelator.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-9ce2653f39f0c20ffbf2c649", "src_port": 49756, "tcp_stream": 600, "udp_stream": null, "frame_number": 21428, "timestamp_epoch": "1533964968.672694000" }, { "kind": "tls_client_hello", "dst_ip": "185.180.13.28", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "load77.exelator.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-aa1ff43ab2d2bcaaa8065c98", "src_port": 49755, "tcp_stream": 599, "udp_stream": null, "frame_number": 21430, "timestamp_epoch": "1533964968.673327000" }, { "kind": "tls_client_hello", "dst_ip": "104.254.150.77", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ib.adnxs.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-3628e7a52b563ce3bad14291", "src_port": 49758, "tcp_stream": 602, "udp_stream": null, "frame_number": 21957, "timestamp_epoch": "1533964980.047151000" }, { "kind": "tls_client_hello", "dst_ip": "104.254.150.77", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ib.adnxs.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-a72c6180398b0905936a0f6a", "src_port": 49757, "tcp_stream": 601, "udp_stream": null, "frame_number": 21958, "timestamp_epoch": "1533964980.047155000" }, { "kind": "tls_client_hello", "dst_ip": "34.213.12.32", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "vid-io.springserve.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-e81cf136495fd552d9dbbb44", "src_port": 49759, "tcp_stream": 603, "udp_stream": null, "frame_number": 22011, "timestamp_epoch": "1533964981.293633000" }, { "kind": "tls_client_hello", "dst_ip": "104.254.150.77", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "lax1-ib.adnxs.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-dc1ccd19b9d366cc7c6f2409", "src_port": 49760, "tcp_stream": 604, "udp_stream": null, "frame_number": 22871, "timestamp_epoch": "1533964994.530205000" }, { "kind": "tls_client_hello", "dst_ip": "104.254.150.77", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "lax1-ib.adnxs.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-734ff2823e27bd46cad724bb", "src_port": 49761, "tcp_stream": 605, "udp_stream": null, "frame_number": 22875, "timestamp_epoch": "1533964994.535341000" }, { "kind": "tls_client_hello", "dst_ip": "104.254.150.69", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "secure.adnxs.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-d2a3e2f11a75e76dc6c10d03", "src_port": 49763, "tcp_stream": 606, "udp_stream": null, "frame_number": 22932, "timestamp_epoch": "1533964996.122063000" }, { "kind": "tls_client_hello", "dst_ip": "104.254.150.69", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "secure.adnxs.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-2a5c5b491d7a0d890557fdc2", "src_port": 49762, "tcp_stream": 607, "udp_stream": null, "frame_number": 22934, "timestamp_epoch": "1533964996.122233000" }, { "kind": "tls_client_hello", "dst_ip": "207.244.102.143", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "sync.aralego.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-38d41dce0613c76e7e114a75", "src_port": 49764, "tcp_stream": 608, "udp_stream": null, "frame_number": 22962, "timestamp_epoch": "1533964996.224007000" }, { "kind": "tls_client_hello", "dst_ip": "207.244.102.143", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "sync.aralego.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-71e09f2100f535e688d72c0d", "src_port": 49765, "tcp_stream": 609, "udp_stream": null, "frame_number": 22964, "timestamp_epoch": "1533964996.224362000" }, { "kind": "tls_client_hello", "dst_ip": "35.185.244.37", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "x.bidswitch.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-95888bcceee01c33a47b26ac", "src_port": 49767, "tcp_stream": 610, "udp_stream": null, "frame_number": 22977, "timestamp_epoch": "1533964996.316193000" }, { "kind": "tls_client_hello", "dst_ip": "35.185.244.37", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "x.bidswitch.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-467d85888879f3d66ff40eaf", "src_port": 49766, "tcp_stream": 611, "udp_stream": null, "frame_number": 22980, "timestamp_epoch": "1533964996.316528000" }, { "kind": "tls_client_hello", "dst_ip": "52.9.78.114", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "magnetic.t.domdex.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-0e6e113818edc536938139a0", "src_port": 49769, "tcp_stream": 613, "udp_stream": null, "frame_number": 23022, "timestamp_epoch": "1533964996.447720000" }, { "kind": "tls_client_hello", "dst_ip": "52.9.78.114", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "magnetic.t.domdex.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-842f79c85ba24d29be49253f", "src_port": 49768, "tcp_stream": 612, "udp_stream": null, "frame_number": 23025, "timestamp_epoch": "1533964996.448180000" }, { "kind": "tls_client_hello", "dst_ip": "34.211.69.152", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "rtb.gumgum.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-20febeb3ded79846f57cfdaa", "src_port": 49771, "tcp_stream": 615, "udp_stream": null, "frame_number": 23038, "timestamp_epoch": "1533964996.476011000" }, { "kind": "tls_client_hello", "dst_ip": "34.211.69.152", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "rtb.gumgum.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-e694a7b52024b0bf87c698f8", "src_port": 49770, "tcp_stream": 614, "udp_stream": null, "frame_number": 23044, "timestamp_epoch": "1533964996.477767000" }, { "kind": "tls_client_hello", "dst_ip": "52.39.151.69", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pm.w55c.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-c5b608953be69bfc5242d84c", "src_port": 49775, "tcp_stream": 619, "udp_stream": null, "frame_number": 23062, "timestamp_epoch": "1533964996.584481000" }, { "kind": "tls_client_hello", "dst_ip": "52.39.151.69", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pm.w55c.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-6921117a0495fbbbc448ce76", "src_port": 49774, "tcp_stream": 618, "udp_stream": null, "frame_number": 23069, "timestamp_epoch": "1533964996.585577000" }, { "kind": "tls_client_hello", "dst_ip": "4.78.226.233", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pmp.mxptint.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-e42f5b9b765073641e7896b5", "src_port": 49772, "tcp_stream": 616, "udp_stream": null, "frame_number": 23080, "timestamp_epoch": "1533964996.591113000" }, { "kind": "tls_client_hello", "dst_ip": "4.78.226.233", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pmp.mxptint.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-6f270302d9431985c3b6dd90", "src_port": 49773, "tcp_stream": 617, "udp_stream": null, "frame_number": 23084, "timestamp_epoch": "1533964996.603708000" }, { "kind": "tls_client_hello", "dst_ip": "209.58.136.30", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "px.adhigh.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-970831354b61a4c432e2c7b3", "src_port": 49777, "tcp_stream": 621, "udp_stream": null, "frame_number": 23116, "timestamp_epoch": "1533964996.711933000" }, { "kind": "tls_client_hello", "dst_ip": "209.58.136.30", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "px.adhigh.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-611c455cc93c87da41da2bc1", "src_port": 49776, "tcp_stream": 620, "udp_stream": null, "frame_number": 23118, "timestamp_epoch": "1533964996.712394000" }, { "kind": "tls_client_hello", "dst_ip": "52.74.108.147", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "dmp.brand-display.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-abd704a1d913a62f356b4d2b", "src_port": 49778, "tcp_stream": 622, "udp_stream": null, "frame_number": 23243, "timestamp_epoch": "1533964997.187628000" }, { "kind": "tls_client_hello", "dst_ip": "52.74.108.147", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "dmp.brand-display.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-4c4108e4ad0a136a523791d5", "src_port": 49779, "tcp_stream": 623, "udp_stream": null, "frame_number": 23263, "timestamp_epoch": "1533964997.192337000" }, { "kind": "tls_client_hello", "dst_ip": "151.101.41.108", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "vcdn.adnxs.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-c449319cf9f360ef0ecd08df", "src_port": 49781, "tcp_stream": 624, "udp_stream": null, "frame_number": 23271, "timestamp_epoch": "1533964997.212549000" }, { "kind": "tls_client_hello", "dst_ip": "151.101.41.108", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "vcdn.adnxs.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-0118da2131108c5921ff9be5", "src_port": 49780, "tcp_stream": 625, "udp_stream": null, "frame_number": 23272, "timestamp_epoch": "1533964997.212875000" }, { "kind": "tls_client_hello", "dst_ip": "104.254.150.77", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ib.adnxs.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-f1bd6e01cbfe6bdc2a1eb215", "src_port": 49782, "tcp_stream": 626, "udp_stream": null, "frame_number": 23283, "timestamp_epoch": "1533964997.231021000" }, { "kind": "tls_client_hello", "dst_ip": "104.254.150.77", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ib.adnxs.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-0b164688c87ef06fabe5f32a", "src_port": 49783, "tcp_stream": 627, "udp_stream": null, "frame_number": 23285, "timestamp_epoch": "1533964997.231199000" }, { "kind": "tls_client_hello", "dst_ip": "198.23.90.60", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "um.simpli.fi" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-b5103a489b2925d3db43a5d6", "src_port": 49785, "tcp_stream": 629, "udp_stream": null, "frame_number": 23296, "timestamp_epoch": "1533964997.291763000" }, { "kind": "tls_client_hello", "dst_ip": "198.23.90.60", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "um.simpli.fi" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-c6b15fb6a1e6d53100bbff30", "src_port": 49784, "tcp_stream": 628, "udp_stream": null, "frame_number": 23305, "timestamp_epoch": "1533964997.295515000" }, { "kind": "tls_client_hello", "dst_ip": "54.186.237.130", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "i.w55c.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-bbdc99617bbd04408029b4fa", "src_port": 49787, "tcp_stream": 631, "udp_stream": null, "frame_number": 23315, "timestamp_epoch": "1533964997.317123000" }, { "kind": "tls_client_hello", "dst_ip": "54.186.237.130", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "i.w55c.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-61959c872fd7a05e40a929aa", "src_port": 49786, "tcp_stream": 630, "udp_stream": null, "frame_number": 23316, "timestamp_epoch": "1533964997.317150000" }, { "kind": "tls_client_hello", "dst_ip": "185.167.164.37", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "c1.adform.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-bf0fb247dfd065829c945c54", "src_port": 49788, "tcp_stream": 632, "udp_stream": null, "frame_number": 23357, "timestamp_epoch": "1533964997.363620000" }, { "kind": "tls_client_hello", "dst_ip": "185.167.164.37", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "c1.adform.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-dee3e294de694124f4884639", "src_port": 49789, "tcp_stream": 633, "udp_stream": null, "frame_number": 23372, "timestamp_epoch": "1533964997.375633000" }, { "kind": "tls_client_hello", "dst_ip": "4.78.226.234", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "rbp.mxptint.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-ed40ddce029b2ab03a4b8f64", "src_port": 49793, "tcp_stream": 637, "udp_stream": null, "frame_number": 23394, "timestamp_epoch": "1533964997.397872000" }, { "kind": "tls_client_hello", "dst_ip": "4.78.226.234", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "rbp.mxptint.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-d055f440a3a654f5e708f72f", "src_port": 49792, "tcp_stream": 636, "udp_stream": null, "frame_number": 23395, "timestamp_epoch": "1533964997.397874000" }, { "kind": "tls_client_hello", "dst_ip": "69.174.248.224", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pixel-a.sitescout.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-5a4045a65b0b9fbeb135af10", "src_port": 49797, "tcp_stream": 641, "udp_stream": null, "frame_number": 23404, "timestamp_epoch": "1533964997.416681000" }, { "kind": "tls_client_hello", "dst_ip": "69.174.248.224", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pixel-a.sitescout.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-4b8230d0db0834ffcd2eb07c", "src_port": 49796, "tcp_stream": 640, "udp_stream": null, "frame_number": 23406, "timestamp_epoch": "1533964997.416898000" }, { "kind": "tls_client_hello", "dst_ip": "149.174.66.131", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "rub.pxl.ace.advertising.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-add1c9a9ae05f115d3aded47", "src_port": 49795, "tcp_stream": 638, "udp_stream": null, "frame_number": 23410, "timestamp_epoch": "1533964997.417319000" }, { "kind": "tls_client_hello", "dst_ip": "149.174.66.131", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "rub.pxl.ace.advertising.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-a5f1b5d821abad7546e20efe", "src_port": 49794, "tcp_stream": 639, "udp_stream": null, "frame_number": 23411, "timestamp_epoch": "1533964997.417469000" }, { "kind": "tls_client_hello", "dst_ip": "52.206.38.25", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "sync.ipredictive.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-1f1d329d47e9b7719cb94a2a", "src_port": 49790, "tcp_stream": 634, "udp_stream": null, "frame_number": 23420, "timestamp_epoch": "1533964997.428617000" }, { "kind": "tls_client_hello", "dst_ip": "52.206.38.25", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "sync.ipredictive.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-9c015d3e54731c64cb92b9ca", "src_port": 49791, "tcp_stream": 635, "udp_stream": null, "frame_number": 23422, "timestamp_epoch": "1533964997.428749000" }, { "kind": "tls_client_hello", "dst_ip": "8.39.36.143", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pixel.rubiconproject.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-55d8beb914b8566fd066708e", "src_port": 49798, "tcp_stream": 642, "udp_stream": null, "frame_number": 23558, "timestamp_epoch": "1533964997.703961000" }, { "kind": "tls_client_hello", "dst_ip": "8.39.36.143", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pixel.rubiconproject.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-70522aaf3220e6c046560be0", "src_port": 49799, "tcp_stream": 643, "udp_stream": null, "frame_number": 23559, "timestamp_epoch": "1533964997.704063000" }, { "kind": "tls_client_hello", "dst_ip": "8.39.36.143", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pixel.rubiconproject.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-ecf8bdec157edda83a571bf5", "src_port": 49800, "tcp_stream": 644, "udp_stream": null, "frame_number": 23590, "timestamp_epoch": "1533964997.751001000" }, { "kind": "tls_client_hello", "dst_ip": "74.119.117.94", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "dis.criteo.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-aa6e9d86f4ea58620715b4e5", "src_port": 49801, "tcp_stream": 645, "udp_stream": null, "frame_number": 23592, "timestamp_epoch": "1533964997.753641000" }, { "kind": "tls_client_hello", "dst_ip": "74.119.117.94", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "dis.criteo.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-5725a4cf03fa5146006e23f5", "src_port": 49802, "tcp_stream": 646, "udp_stream": null, "frame_number": 23601, "timestamp_epoch": "1533964997.759410000" }, { "kind": "tls_client_hello", "dst_ip": "8.39.36.143", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pixel.rubiconproject.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-532e2c050d3585330de3dba7", "src_port": 49805, "tcp_stream": 649, "udp_stream": null, "frame_number": 23627, "timestamp_epoch": "1533964997.805395000" }, { "kind": "tls_client_hello", "dst_ip": "8.39.36.143", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pixel.rubiconproject.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-9191cf31d33b409fe9c95269", "src_port": 49806, "tcp_stream": 650, "udp_stream": null, "frame_number": 23660, "timestamp_epoch": "1533964997.843178000" }, { "kind": "tls_client_hello", "dst_ip": "8.39.36.143", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pixel.rubiconproject.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-f3a17d90ec59e8ff7dcc8618", "src_port": 49809, "tcp_stream": 653, "udp_stream": null, "frame_number": 23664, "timestamp_epoch": "1533964997.845875000" }, { "kind": "tls_client_hello", "dst_ip": "54.69.70.7", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cms.quantserve.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-2996de1e22e95db823538189", "src_port": 49808, "tcp_stream": 652, "udp_stream": null, "frame_number": 23673, "timestamp_epoch": "1533964997.857707000" }, { "kind": "tls_client_hello", "dst_ip": "199.38.167.128", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "p.rfihub.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-d252f8ac7d9ff936fb4142ae", "src_port": 49804, "tcp_stream": 648, "udp_stream": null, "frame_number": 23675, "timestamp_epoch": "1533964997.858092000" }, { "kind": "tls_client_hello", "dst_ip": "54.69.70.7", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cms.quantserve.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-12e176cf477e01cc44dcd543", "src_port": 49807, "tcp_stream": 651, "udp_stream": null, "frame_number": 23676, "timestamp_epoch": "1533964997.858143000" }, { "kind": "tls_client_hello", "dst_ip": "199.38.167.128", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "p.rfihub.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-317ffa026d0a7272cc63042e", "src_port": 49803, "tcp_stream": 647, "udp_stream": null, "frame_number": 23677, "timestamp_epoch": "1533964997.858310000" }, { "kind": "tls_client_hello", "dst_ip": "23.54.21.179", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "t.wayfair.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-c884c076cc66bdd6482238d0", "src_port": 49814, "tcp_stream": 658, "udp_stream": null, "frame_number": 23702, "timestamp_epoch": "1533964997.907612000" }, { "kind": "tls_client_hello", "dst_ip": "23.54.21.179", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "t.wayfair.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-3cdf523d8b5a5ff8f5ed9b86", "src_port": 49815, "tcp_stream": 659, "udp_stream": null, "frame_number": 23705, "timestamp_epoch": "1533964997.908221000" }, { "kind": "tls_client_hello", "dst_ip": "52.20.63.23", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "t.mookie1.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-95d8498e657372d378485791", "src_port": 49810, "tcp_stream": 654, "udp_stream": null, "frame_number": 23717, "timestamp_epoch": "1533964997.934130000" }, { "kind": "tls_client_hello", "dst_ip": "52.20.63.23", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "t.mookie1.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-b861d64b60bad3e0b5927c9c", "src_port": 49811, "tcp_stream": 655, "udp_stream": null, "frame_number": 23731, "timestamp_epoch": "1533964997.937638000" }, { "kind": "tls_client_hello", "dst_ip": "54.196.242.147", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "e1.emxdgt.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-d0dc663124ae490c499e8c9a", "src_port": 49813, "tcp_stream": 657, "udp_stream": null, "frame_number": 23754, "timestamp_epoch": "1533964997.960598000" }, { "kind": "tls_client_hello", "dst_ip": "54.196.242.147", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "e1.emxdgt.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-31ea17724c15d894f0334601", "src_port": 49812, "tcp_stream": 656, "udp_stream": null, "frame_number": 23762, "timestamp_epoch": "1533964997.972200000" }, { "kind": "tls_client_hello", "dst_ip": "52.21.201.75", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ad.360yield.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-3c0091a84bb15f80848f8a28", "src_port": 49819, "tcp_stream": 663, "udp_stream": null, "frame_number": 23812, "timestamp_epoch": "1533964998.060581000" }, { "kind": "tls_client_hello", "dst_ip": "52.21.201.75", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ad.360yield.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-6f84f8e034689b0044c5d81c", "src_port": 49818, "tcp_stream": 662, "udp_stream": null, "frame_number": 23818, "timestamp_epoch": "1533964998.062358000" }, { "kind": "tls_client_hello", "dst_ip": "37.157.2.234", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cm.adform.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-1feace0f76f77e43bfff49e0", "src_port": 49816, "tcp_stream": 660, "udp_stream": null, "frame_number": 23834, "timestamp_epoch": "1533964998.080510000" }, { "kind": "tls_client_hello", "dst_ip": "37.157.2.234", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cm.adform.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-6ad8193f8a4021bcf4596c21", "src_port": 49817, "tcp_stream": 661, "udp_stream": null, "frame_number": 23835, "timestamp_epoch": "1533964998.080847000" }, { "kind": "tls_client_hello", "dst_ip": "8.39.36.172", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "token.rubiconproject.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-9edd52abd92b0fc3ed7cc154", "src_port": 49823, "tcp_stream": 667, "udp_stream": null, "frame_number": 24033, "timestamp_epoch": "1533964999.451299000" }, { "kind": "tls_client_hello", "dst_ip": "8.39.36.172", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "token.rubiconproject.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-8361f541073b466af89b588e", "src_port": 49822, "tcp_stream": 666, "udp_stream": null, "frame_number": 24034, "timestamp_epoch": "1533964999.451579000" }, { "kind": "tls_client_hello", "dst_ip": "54.191.223.36", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "r.nexac.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-7f64a3b101e8439c1ab9bd5d", "src_port": 49824, "tcp_stream": 668, "udp_stream": null, "frame_number": 24069, "timestamp_epoch": "1533964999.556954000" }, { "kind": "tls_client_hello", "dst_ip": "54.191.223.36", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "r.nexac.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-3c367df29e036b32e31e1ea0", "src_port": 49825, "tcp_stream": 669, "udp_stream": null, "frame_number": 24070, "timestamp_epoch": "1533964999.557035000" }, { "kind": "tls_client_hello", "dst_ip": "23.55.114.34", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "su.addthis.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-f768f925e916203016ba3da8", "src_port": 49829, "tcp_stream": 672, "udp_stream": null, "frame_number": 24083, "timestamp_epoch": "1533964999.565656000" }, { "kind": "tls_client_hello", "dst_ip": "104.110.128.239", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tags.bluekai.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-f2418713ef204221cbb51ffb", "src_port": 49831, "tcp_stream": 675, "udp_stream": null, "frame_number": 24084, "timestamp_epoch": "1533964999.566031000" }, { "kind": "tls_client_hello", "dst_ip": "23.55.114.34", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "su.addthis.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-ff4cf933352677f55ac3ec35", "src_port": 49828, "tcp_stream": 673, "udp_stream": null, "frame_number": 24088, "timestamp_epoch": "1533964999.566369000" }, { "kind": "tls_client_hello", "dst_ip": "104.110.128.239", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tags.bluekai.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-a674d5fcef2e542274465823", "src_port": 49830, "tcp_stream": 674, "udp_stream": null, "frame_number": 24089, "timestamp_epoch": "1533964999.566541000" }, { "kind": "tls_client_hello", "dst_ip": "54.84.105.44", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "thrtle.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-475ef32efbafcca5273b45b3", "src_port": 49826, "tcp_stream": 670, "udp_stream": null, "frame_number": 24101, "timestamp_epoch": "1533964999.588590000" }, { "kind": "tls_client_hello", "dst_ip": "54.84.105.44", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "thrtle.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-66946ddd253f1526d61e5787", "src_port": 49827, "tcp_stream": 671, "udp_stream": null, "frame_number": 24107, "timestamp_epoch": "1533964999.608486000" }, { "kind": "tls_client_hello", "dst_ip": "52.52.136.196", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "sync.crwdcntrl.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-2265c9c1a1b6ebc5b87b8062", "src_port": 49832, "tcp_stream": 676, "udp_stream": null, "frame_number": 24245, "timestamp_epoch": "1533965002.158999000" }, { "kind": "tls_client_hello", "dst_ip": "52.52.136.196", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "sync.crwdcntrl.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-985c87fe3fcdf0c4b31282eb", "src_port": 49833, "tcp_stream": 677, "udp_stream": null, "frame_number": 24246, "timestamp_epoch": "1533965002.159159000" }, { "kind": "tls_client_hello", "dst_ip": "34.213.12.32", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "vid-io.springserve.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-caec4bf2fabff854f94a0525", "src_port": 49834, "tcp_stream": 678, "udp_stream": null, "frame_number": 24295, "timestamp_epoch": "1533965002.762043000" }, { "kind": "tls_client_hello", "dst_ip": "104.254.150.77", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ib.adnxs.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-fd3ca3d0b1bc3e9f58690bb1", "src_port": 49836, "tcp_stream": 680, "udp_stream": null, "frame_number": 24416, "timestamp_epoch": "1533965015.155537000" }, { "kind": "tls_client_hello", "dst_ip": "104.254.150.77", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ib.adnxs.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-65246396534a6439614c4448", "src_port": 49835, "tcp_stream": 679, "udp_stream": null, "frame_number": 24418, "timestamp_epoch": "1533965015.155692000" }, { "kind": "tls_client_hello", "dst_ip": "34.213.12.32", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "vid-io.springserve.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-07b00261e3fa3e9576938db6", "src_port": 49837, "tcp_stream": 681, "udp_stream": null, "frame_number": 24464, "timestamp_epoch": "1533965016.446820000" }, { "kind": "tls_client_hello", "dst_ip": "192.229.210.158", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "small-video.edgecast.syn-cdn.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-7a5e03b9a49a96f1a4665728", "src_port": 49838, "tcp_stream": 682, "udp_stream": null, "frame_number": 24588, "timestamp_epoch": "1533965020.346497000" }, { "kind": "tls_client_hello", "dst_ip": "192.229.210.158", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "small-video.edgecast.syn-cdn.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-7c5a5cd99ab3193503d56087", "src_port": 49839, "tcp_stream": 683, "udp_stream": null, "frame_number": 24589, "timestamp_epoch": "1533965020.346498000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.2", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ade.googlesyndication.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-c825606c6609f4a969385713", "src_port": 49841, "tcp_stream": 685, "udp_stream": null, "frame_number": 25293, "timestamp_epoch": "1533965023.576293000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.2", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ade.googlesyndication.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-d243f00b5b0af6350ccd28f3", "src_port": 49840, "tcp_stream": 684, "udp_stream": null, "frame_number": 25294, "timestamp_epoch": "1533965023.576308000" }, { "kind": "tls_client_hello", "dst_ip": "104.254.150.77", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "lax1-ib.adnxs.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-beece1473ec248f011a1bfb8", "src_port": 49842, "tcp_stream": 686, "udp_stream": null, "frame_number": 26228, "timestamp_epoch": "1533965030.656483000" }, { "kind": "tls_client_hello", "dst_ip": "104.254.150.77", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "lax1-ib.adnxs.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-3476fdee02de3b4849d9bc71", "src_port": 49843, "tcp_stream": 687, "udp_stream": null, "frame_number": 26229, "timestamp_epoch": "1533965030.656484000" }, { "kind": "tls_client_hello", "dst_ip": "104.254.150.69", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "secure.adnxs.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-f3ceef80ec3440148bb08399", "src_port": 49844, "tcp_stream": 688, "udp_stream": null, "frame_number": 26303, "timestamp_epoch": "1533965032.363879000" }, { "kind": "tls_client_hello", "dst_ip": "104.254.150.69", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "secure.adnxs.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-99ecad93048fc3b2e39667e3", "src_port": 49845, "tcp_stream": 689, "udp_stream": null, "frame_number": 26306, "timestamp_epoch": "1533965032.364251000" }, { "kind": "tls_client_hello", "dst_ip": "207.244.102.143", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "sync.aralego.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-e86dd3a0b182add5d080d08d", "src_port": 49847, "tcp_stream": 691, "udp_stream": null, "frame_number": 26336, "timestamp_epoch": "1533965032.448005000" }, { "kind": "tls_client_hello", "dst_ip": "207.244.102.143", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "sync.aralego.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-8a0b02e89a26ba5be66fbae8", "src_port": 49846, "tcp_stream": 690, "udp_stream": null, "frame_number": 26340, "timestamp_epoch": "1533965032.448472000" }, { "kind": "tls_client_hello", "dst_ip": "69.194.244.11", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ad.turn.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-02a5666409c6849a1d565764", "src_port": 49848, "tcp_stream": 692, "udp_stream": null, "frame_number": 26354, "timestamp_epoch": "1533965032.538900000" }, { "kind": "tls_client_hello", "dst_ip": "69.194.244.11", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ad.turn.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-557fa5fe4f661574cd50cc76", "src_port": 49849, "tcp_stream": 693, "udp_stream": null, "frame_number": 26356, "timestamp_epoch": "1533965032.542361000" }, { "kind": "tls_client_hello", "dst_ip": "185.167.164.37", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "c1.adform.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-4dcfca9702148acbb54d9b6d", "src_port": 49850, "tcp_stream": 694, "udp_stream": null, "frame_number": 26437, "timestamp_epoch": "1533965032.719353000" }, { "kind": "tls_client_hello", "dst_ip": "185.167.164.37", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "c1.adform.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-49ad9b9b6e88b7680c567bc3", "src_port": 49851, "tcp_stream": 695, "udp_stream": null, "frame_number": 26443, "timestamp_epoch": "1533965032.721397000" }, { "kind": "tls_client_hello", "dst_ip": "104.36.113.17", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "image2.pubmatic.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-5e95f060a4301d1557169f08", "src_port": 49853, "tcp_stream": 697, "udp_stream": null, "frame_number": 26444, "timestamp_epoch": "1533965032.721529000" }, { "kind": "tls_client_hello", "dst_ip": "104.36.113.17", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "image2.pubmatic.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-448a7714436369eb215e745f", "src_port": 49852, "tcp_stream": 696, "udp_stream": null, "frame_number": 26449, "timestamp_epoch": "1533965032.722110000" }, { "kind": "tls_client_hello", "dst_ip": "104.24.246.16", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cookie.brealtime.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-0e02beb6c2a947e8e3cf5451", "src_port": 49856, "tcp_stream": 700, "udp_stream": null, "frame_number": 26466, "timestamp_epoch": "1533965032.790959000" }, { "kind": "tls_client_hello", "dst_ip": "104.24.246.16", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cookie.brealtime.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-b1c6af058829e63026aa8704", "src_port": 49857, "tcp_stream": 701, "udp_stream": null, "frame_number": 26469, "timestamp_epoch": "1533965032.792859000" }, { "kind": "tls_client_hello", "dst_ip": "52.42.116.214", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "match.prod.bidr.io" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-0ec71d745766fd7f9cefb0ae", "src_port": 49855, "tcp_stream": 699, "udp_stream": null, "frame_number": 26470, "timestamp_epoch": "1533965032.792962000" }, { "kind": "tls_client_hello", "dst_ip": "52.42.116.214", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "match.prod.bidr.io" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-fb2b41d0d254491b8eb760cb", "src_port": 49854, "tcp_stream": 698, "udp_stream": null, "frame_number": 26472, "timestamp_epoch": "1533965032.793141000" }, { "kind": "tls_client_hello", "dst_ip": "23.73.231.65", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "px.owneriq.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-05b31113ea7c1194a239acf1", "src_port": 49858, "tcp_stream": 702, "udp_stream": null, "frame_number": 26473, "timestamp_epoch": "1533965032.793305000" }, { "kind": "tls_client_hello", "dst_ip": "23.73.231.65", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "px.owneriq.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-95fc2fee4e3009140ae5c978", "src_port": 49859, "tcp_stream": 703, "udp_stream": null, "frame_number": 26475, "timestamp_epoch": "1533965032.793308000" }, { "kind": "tls_client_hello", "dst_ip": "151.101.0.166", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "bh.contextweb.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-614711c66c3783995aab69ee", "src_port": 49861, "tcp_stream": 705, "udp_stream": null, "frame_number": 26476, "timestamp_epoch": "1533965032.793471000" }, { "kind": "tls_client_hello", "dst_ip": "151.101.0.166", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "bh.contextweb.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-5a518e2b60cb84fe9fb62baa", "src_port": 49860, "tcp_stream": 704, "udp_stream": null, "frame_number": 26479, "timestamp_epoch": "1533965032.793850000" }, { "kind": "tls_client_hello", "dst_ip": "152.195.14.112", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "adserver.adtech.advertising.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-77fa38cd2b9bd19b3f70b89b", "src_port": 49863, "tcp_stream": 707, "udp_stream": null, "frame_number": 26670, "timestamp_epoch": "1533965033.324564000" }, { "kind": "tls_client_hello", "dst_ip": "152.195.14.112", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "adserver.adtech.advertising.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-cf3f4ebfb4208e0a71d894fd", "src_port": 49862, "tcp_stream": 706, "udp_stream": null, "frame_number": 26672, "timestamp_epoch": "1533965033.324943000" }, { "kind": "tls_client_hello", "dst_ip": "104.36.113.17", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "simage2.pubmatic.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-ba291f067afad0cbb445a828", "src_port": 49864, "tcp_stream": 708, "udp_stream": null, "frame_number": 26676, "timestamp_epoch": "1533965033.341346000" }, { "kind": "tls_client_hello", "dst_ip": "199.38.167.128", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "p.rfihub.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-075287678daef88bd6b89455", "src_port": 49865, "tcp_stream": 709, "udp_stream": null, "frame_number": 26748, "timestamp_epoch": "1533965033.510056000" }, { "kind": "tls_client_hello", "dst_ip": "199.38.167.128", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "p.rfihub.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-51d71edf1fd51c0b496d74ef", "src_port": 49866, "tcp_stream": 710, "udp_stream": null, "frame_number": 26749, "timestamp_epoch": "1533965033.510057000" }, { "kind": "tls_client_hello", "dst_ip": "35.190.74.53", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pix.impdesk.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-2e37ad3c38b0b62bfc0b776d", "src_port": 49867, "tcp_stream": 711, "udp_stream": null, "frame_number": 26756, "timestamp_epoch": "1533965033.528947000" }, { "kind": "tls_client_hello", "dst_ip": "35.190.74.53", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pix.impdesk.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-215c05805727665b3cd7ccba", "src_port": 49868, "tcp_stream": 712, "udp_stream": null, "frame_number": 26757, "timestamp_epoch": "1533965033.528949000" }, { "kind": "tls_client_hello", "dst_ip": "34.236.230.194", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "track.eyeviewads.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-455f0213e9f4c9e4aa085f03", "src_port": 49869, "tcp_stream": 713, "udp_stream": null, "frame_number": 26766, "timestamp_epoch": "1533965033.590350000" }, { "kind": "tls_client_hello", "dst_ip": "52.11.229.48", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "sync.tidaltv.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-c1f093e684c559fbf7cb533d", "src_port": 49873, "tcp_stream": 717, "udp_stream": null, "frame_number": 26779, "timestamp_epoch": "1533965033.599995000" }, { "kind": "tls_client_hello", "dst_ip": "52.11.229.48", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "sync.tidaltv.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-b18efe828578119ffcffee0d", "src_port": 49874, "tcp_stream": 718, "udp_stream": null, "frame_number": 26780, "timestamp_epoch": "1533965033.600087000" }, { "kind": "tls_client_hello", "dst_ip": "54.236.177.89", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "sync.extend.tv" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-66a1bbd6b78cf9de6a4e2343", "src_port": 49871, "tcp_stream": 715, "udp_stream": null, "frame_number": 26787, "timestamp_epoch": "1533965033.600626000" }, { "kind": "tls_client_hello", "dst_ip": "34.236.230.194", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "track.eyeviewads.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-6599aa2bcc7cfacbaab59a3a", "src_port": 49870, "tcp_stream": 714, "udp_stream": null, "frame_number": 26791, "timestamp_epoch": "1533965033.601028000" }, { "kind": "tls_client_hello", "dst_ip": "54.236.177.89", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "sync.extend.tv" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-2c46373454bb9ef0306b6c4f", "src_port": 49872, "tcp_stream": 716, "udp_stream": null, "frame_number": 26792, "timestamp_epoch": "1533965033.601127000" }, { "kind": "tls_client_hello", "dst_ip": "205.180.87.204", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "rubicon-match.dotomi.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-30b72b137798a5908cce71be", "src_port": 49875, "tcp_stream": 719, "udp_stream": null, "frame_number": 26857, "timestamp_epoch": "1533965033.755397000" }, { "kind": "tls_client_hello", "dst_ip": "205.180.87.204", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "rubicon-match.dotomi.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-d6830d0128a6e90ef99ac011", "src_port": 49876, "tcp_stream": 720, "udp_stream": null, "frame_number": 26858, "timestamp_epoch": "1533965033.755512000" }, { "kind": "tls_client_hello", "dst_ip": "72.5.64.63", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "rp.gwallet.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-f1f8c5961a549015602c8e73", "src_port": 49878, "tcp_stream": 722, "udp_stream": null, "frame_number": 26878, "timestamp_epoch": "1533965033.770456000" }, { "kind": "tls_client_hello", "dst_ip": "72.5.64.63", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "rp.gwallet.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-f1bb7372e9254c13acfc6500", "src_port": 49877, "tcp_stream": 721, "udp_stream": null, "frame_number": 26880, "timestamp_epoch": "1533965033.771149000" }, { "kind": "tls_client_hello", "dst_ip": "185.167.164.39", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "a1.adform.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-39d0afc9fa2cc5115fa488ad", "src_port": 49880, "tcp_stream": 724, "udp_stream": null, "frame_number": 27001, "timestamp_epoch": "1533965034.057886000" }, { "kind": "tls_client_hello", "dst_ip": "185.167.164.39", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "a1.adform.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-efc93c7e40880e4dc1a3fed1", "src_port": 49879, "tcp_stream": 723, "udp_stream": null, "frame_number": 27008, "timestamp_epoch": "1533965034.073971000" }, { "kind": "tls_client_hello", "dst_ip": "52.203.231.138", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pixeltrack.eyeviewads.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-d83c1fef2db3d8548dd3da7f", "src_port": 49881, "tcp_stream": 725, "udp_stream": null, "frame_number": 27059, "timestamp_epoch": "1533965034.290246000" }, { "kind": "tls_client_hello", "dst_ip": "52.203.231.138", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pixeltrack.eyeviewads.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-6c0dc71bb656b79ff7d80536", "src_port": 49882, "tcp_stream": 726, "udp_stream": null, "frame_number": 27065, "timestamp_epoch": "1533965034.293084000" }, { "kind": "tls_client_hello", "dst_ip": "104.254.150.77", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ib.adnxs.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-9ec73fd44bca8fb62c218c40", "src_port": 49885, "tcp_stream": 729, "udp_stream": null, "frame_number": 27185, "timestamp_epoch": "1533965034.923961000" }, { "kind": "tls_client_hello", "dst_ip": "104.254.150.77", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ib.adnxs.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-bb6a2fa0b90c44802b139b83", "src_port": 49886, "tcp_stream": 730, "udp_stream": null, "frame_number": 27186, "timestamp_epoch": "1533965034.924117000" }, { "kind": "tls_client_hello", "dst_ip": "109.232.197.110", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "mm.melia.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-1d8e6f6ef548d5dc9bb24c1b", "src_port": 49884, "tcp_stream": 727, "udp_stream": null, "frame_number": 27200, "timestamp_epoch": "1533965034.944923000" }, { "kind": "tls_client_hello", "dst_ip": "109.232.197.110", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "mm.melia.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-459986241754139ce8af2d8b", "src_port": 49883, "tcp_stream": 728, "udp_stream": null, "frame_number": 27202, "timestamp_epoch": "1533965034.944925000" }, { "kind": "tls_client_hello", "dst_ip": "104.254.150.77", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ib.adnxs.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-bcc3433050d4a085e3f65a3e", "src_port": 49889, "tcp_stream": 733, "udp_stream": null, "frame_number": 27212, "timestamp_epoch": "1533965034.983960000" }, { "kind": "tls_client_hello", "dst_ip": "185.167.164.37", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "a1.seadform.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-d3b700add6d02f55160d871f", "src_port": 49888, "tcp_stream": 732, "udp_stream": null, "frame_number": 27225, "timestamp_epoch": "1533965034.998139000" }, { "kind": "tls_client_hello", "dst_ip": "185.167.164.37", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "a1.seadform.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-066dc3656bf119b92cb0f3d1", "src_port": 49887, "tcp_stream": 731, "udp_stream": null, "frame_number": 27231, "timestamp_epoch": "1533965035.004157000" }, { "kind": "tls_client_hello", "dst_ip": "151.101.2.49", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "sync-tm.everesttech.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-ba5b27b35b5975081730e877", "src_port": 49891, "tcp_stream": 735, "udp_stream": null, "frame_number": 27313, "timestamp_epoch": "1533965035.371926000" }, { "kind": "tls_client_hello", "dst_ip": "151.101.2.49", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "sync-tm.everesttech.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-de4f54f835b50eacfac2403d", "src_port": 49890, "tcp_stream": 734, "udp_stream": null, "frame_number": 27315, "timestamp_epoch": "1533965035.374382000" }, { "kind": "tls_client_hello", "dst_ip": "54.241.31.242", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "s.thebrighttag.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-30aba29a453641487631d5b2", "src_port": 49894, "tcp_stream": 738, "udp_stream": null, "frame_number": 27366, "timestamp_epoch": "1533965035.499245000" }, { "kind": "tls_client_hello", "dst_ip": "54.241.31.242", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "s.thebrighttag.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-ef97368537d1560673df51d9", "src_port": 49895, "tcp_stream": 739, "udp_stream": null, "frame_number": 27369, "timestamp_epoch": "1533965035.499724000" }, { "kind": "tls_client_hello", "dst_ip": "23.54.22.27", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "dsum-sec.casalemedia.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-a96508d563736177d2003562", "src_port": 49897, "tcp_stream": 741, "udp_stream": null, "frame_number": 27376, "timestamp_epoch": "1533965035.517921000" }, { "kind": "tls_client_hello", "dst_ip": "23.54.22.27", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "dsum-sec.casalemedia.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-1f58984c93f8df872057f627", "src_port": 49896, "tcp_stream": 740, "udp_stream": null, "frame_number": 27377, "timestamp_epoch": "1533965035.518005000" }, { "kind": "tls_client_hello", "dst_ip": "34.236.123.105", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "appnexus-partners.tremorhub.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-d8c960d4f2c3c646f91b0d99", "src_port": 49893, "tcp_stream": 736, "udp_stream": null, "frame_number": 27388, "timestamp_epoch": "1533965035.527917000" }, { "kind": "tls_client_hello", "dst_ip": "54.193.113.6", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "jadserve.postrelease.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-e6ca05ba6dbb2f3f3ce054e2", "src_port": 49901, "tcp_stream": 745, "udp_stream": null, "frame_number": 27389, "timestamp_epoch": "1533965035.528115000" }, { "kind": "tls_client_hello", "dst_ip": "54.193.113.6", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "jadserve.postrelease.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-6d7b5a542d62b22b1f43bd11", "src_port": 49902, "tcp_stream": 746, "udp_stream": null, "frame_number": 27390, "timestamp_epoch": "1533965035.528277000" }, { "kind": "tls_client_hello", "dst_ip": "34.236.123.105", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "appnexus-partners.tremorhub.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-f073be859f2824679e97063a", "src_port": 49892, "tcp_stream": 737, "udp_stream": null, "frame_number": 27391, "timestamp_epoch": "1533965035.528278000" }, { "kind": "tls_client_hello", "dst_ip": "38.106.34.105", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ads.stickyadstv.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-3e01af194c084cb5ca35d85b", "src_port": 49904, "tcp_stream": 749, "udp_stream": null, "frame_number": 27403, "timestamp_epoch": "1533965035.568002000" }, { "kind": "tls_client_hello", "dst_ip": "38.106.34.105", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ads.stickyadstv.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-ac72cf07b9cd865fed5e0dc1", "src_port": 49905, "tcp_stream": 748, "udp_stream": null, "frame_number": 27404, "timestamp_epoch": "1533965035.568078000" }, { "kind": "tls_client_hello", "dst_ip": "52.22.112.153", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "eb2.3lift.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-47e851b844859ce80f141871", "src_port": 49898, "tcp_stream": 742, "udp_stream": null, "frame_number": 27436, "timestamp_epoch": "1533965035.590273000" }, { "kind": "tls_client_hello", "dst_ip": "52.22.112.153", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "eb2.3lift.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-5a4a9fb66f7b24489d197633", "src_port": 49899, "tcp_stream": 743, "udp_stream": null, "frame_number": 27442, "timestamp_epoch": "1533965035.599216000" }, { "kind": "tls_client_hello", "dst_ip": "52.58.174.155", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "dh.serving-sys.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-c95d821840f9e968cb1ba836", "src_port": 49903, "tcp_stream": 747, "udp_stream": null, "frame_number": 27512, "timestamp_epoch": "1533965035.687150000" }, { "kind": "tls_client_hello", "dst_ip": "52.58.174.155", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "dh.serving-sys.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-849acfbc4eed40475c40d9b3", "src_port": 49900, "tcp_stream": 744, "udp_stream": null, "frame_number": 27514, "timestamp_epoch": "1533965035.687423000" }, { "kind": "tls_client_hello", "dst_ip": "104.110.128.239", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "stags.bluekai.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-6d0e1cc2719d6583624c12b2", "src_port": 49908, "tcp_stream": 752, "udp_stream": null, "frame_number": 27530, "timestamp_epoch": "1533965035.693095000" }, { "kind": "tls_client_hello", "dst_ip": "104.110.128.239", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "stags.bluekai.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-c46ccaa59ba4f5fd7c5b8c1d", "src_port": 49909, "tcp_stream": 753, "udp_stream": null, "frame_number": 27540, "timestamp_epoch": "1533965035.697280000" }, { "kind": "tls_client_hello", "dst_ip": "74.6.34.27", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pr-bh.ybp.yahoo.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-376ecb0f5b73db9c16c776bd", "src_port": 49907, "tcp_stream": 751, "udp_stream": null, "frame_number": 27559, "timestamp_epoch": "1533965035.723614000" }, { "kind": "tls_client_hello", "dst_ip": "74.6.34.27", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pr-bh.ybp.yahoo.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-25ef8090f35cc9b7fb25965e", "src_port": 49906, "tcp_stream": 750, "udp_stream": null, "frame_number": 27560, "timestamp_epoch": "1533965035.723615000" }, { "kind": "tls_client_hello", "dst_ip": "35.186.202.217", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "prod.y-medialink.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-0530c5f7ea7094ff754b4368", "src_port": 49914, "tcp_stream": 758, "udp_stream": null, "frame_number": 27621, "timestamp_epoch": "1533965035.782912000" }, { "kind": "tls_client_hello", "dst_ip": "35.186.202.217", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "prod.y-medialink.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-7d8eac0e5e928b3d67eff8ca", "src_port": 49913, "tcp_stream": 757, "udp_stream": null, "frame_number": 27626, "timestamp_epoch": "1533965035.783476000" }, { "kind": "tls_client_hello", "dst_ip": "54.148.146.218", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "e.nexac.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-76542debc4d2b727fa5af703", "src_port": 49910, "tcp_stream": 754, "udp_stream": null, "frame_number": 27635, "timestamp_epoch": "1533965035.790889000" }, { "kind": "tls_client_hello", "dst_ip": "54.148.146.218", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "e.nexac.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-a3c9bbbd48b68c441e068879", "src_port": 49915, "tcp_stream": 759, "udp_stream": null, "frame_number": 27640, "timestamp_epoch": "1533965035.799446000" }, { "kind": "tls_client_hello", "dst_ip": "205.180.87.204", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "apnx-match.dotomi.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-0693c7005ccde9b10e85d950", "src_port": 49921, "tcp_stream": 765, "udp_stream": null, "frame_number": 27656, "timestamp_epoch": "1533965035.831325000" }, { "kind": "tls_client_hello", "dst_ip": "205.180.87.204", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "apnx-match.dotomi.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-e81f2d1f43f976a8cd9eef67", "src_port": 49923, "tcp_stream": 767, "udp_stream": null, "frame_number": 27657, "timestamp_epoch": "1533965035.831578000" }, { "kind": "tls_client_hello", "dst_ip": "38.106.10.132", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pxl.connexity.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-5915179c7c7b5cef2d05e82f", "src_port": 49925, "tcp_stream": 769, "udp_stream": null, "frame_number": 27669, "timestamp_epoch": "1533965035.841137000" }, { "kind": "tls_client_hello", "dst_ip": "38.106.10.132", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pxl.connexity.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-b92daf20dec2112741f5b8de", "src_port": 49924, "tcp_stream": 768, "udp_stream": null, "frame_number": 27677, "timestamp_epoch": "1533965035.846302000" }, { "kind": "tls_client_hello", "dst_ip": "34.237.234.13", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "melia.sp1.convertro.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-d9a6666ddb4ce26302efc8a0", "src_port": 49916, "tcp_stream": 760, "udp_stream": null, "frame_number": 27686, "timestamp_epoch": "1533965035.849773000" }, { "kind": "tls_client_hello", "dst_ip": "34.237.234.13", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "melia.sp1.convertro.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-bd6cc812fb3b6558ac3ad50d", "src_port": 49917, "tcp_stream": 761, "udp_stream": null, "frame_number": 27687, "timestamp_epoch": "1533965035.849996000" }, { "kind": "tls_client_hello", "dst_ip": "34.198.191.149", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "sync.teads.tv" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-3cb7b8dfbef2b28ba7f3f9af", "src_port": 49918, "tcp_stream": 762, "udp_stream": null, "frame_number": 27715, "timestamp_epoch": "1533965035.911213000" }, { "kind": "tls_client_hello", "dst_ip": "34.198.191.149", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "sync.teads.tv" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-68993303873bf6135a4513ae", "src_port": 49919, "tcp_stream": 763, "udp_stream": null, "frame_number": 27723, "timestamp_epoch": "1533965035.926535000" }, { "kind": "tls_client_hello", "dst_ip": "185.86.137.43", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "rtb-csync.smartadserver.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-f8c17362d65e9585393fabd9", "src_port": 49911, "tcp_stream": 755, "udp_stream": null, "frame_number": 27777, "timestamp_epoch": "1533965035.957742000" }, { "kind": "tls_client_hello", "dst_ip": "185.86.137.43", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "rtb-csync.smartadserver.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-27b0974e088d6529c6dad868", "src_port": 49912, "tcp_stream": 756, "udp_stream": null, "frame_number": 27789, "timestamp_epoch": "1533965035.964944000" }, { "kind": "tls_client_hello", "dst_ip": "5.39.44.195", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "adventori.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-fd162faaa3a1c1e1635c749e", "src_port": 49922, "tcp_stream": 766, "udp_stream": null, "frame_number": 27799, "timestamp_epoch": "1533965035.970037000" }, { "kind": "tls_client_hello", "dst_ip": "5.39.44.195", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "adventori.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-64b88ef058a9f76a1319a91b", "src_port": 49920, "tcp_stream": 764, "udp_stream": null, "frame_number": 27801, "timestamp_epoch": "1533965035.970486000" }, { "kind": "tls_client_hello", "dst_ip": "54.187.167.76", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "x.dlx.addthis.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-3681c716d915fca5fa1dde5e", "src_port": 49926, "tcp_stream": 770, "udp_stream": null, "frame_number": 27948, "timestamp_epoch": "1533965036.402477000" }, { "kind": "tls_client_hello", "dst_ip": "54.187.167.76", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "x.dlx.addthis.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-dd0c7d7091b586e3cb609c7a", "src_port": 49927, "tcp_stream": 771, "udp_stream": null, "frame_number": 27949, "timestamp_epoch": "1533965036.402479000" }, { "kind": "tls_client_hello", "dst_ip": "34.213.12.32", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "vid-io.springserve.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-6e9e369ac621b4a52152351a", "src_port": 49928, "tcp_stream": 772, "udp_stream": null, "frame_number": 27956, "timestamp_epoch": "1533965036.405195000" }, { "kind": "tls_client_hello", "dst_ip": "104.254.150.77", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ib.adnxs.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-d9fecc425a5ffb6a41a025b2", "src_port": 49934, "tcp_stream": 778, "udp_stream": null, "frame_number": 28211, "timestamp_epoch": "1533965055.159104000" }, { "kind": "tls_client_hello", "dst_ip": "104.254.150.77", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ib.adnxs.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-36a5007d2cbb1e53fd1b2249", "src_port": 49933, "tcp_stream": 777, "udp_stream": null, "frame_number": 28213, "timestamp_epoch": "1533965055.159396000" }, { "kind": "tls_client_hello", "dst_ip": "34.213.12.32", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "vid-io.springserve.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-e0e49f7c89e7e7d40351bfaf", "src_port": 49935, "tcp_stream": 779, "udp_stream": null, "frame_number": 28264, "timestamp_epoch": "1533965056.460554000" }, { "kind": "tls_client_hello", "dst_ip": "104.254.150.77", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ib.adnxs.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-0416c531eaa458927d263646", "src_port": 49936, "tcp_stream": 780, "udp_stream": null, "frame_number": 28461, "timestamp_epoch": "1533965075.835447000" }, { "kind": "tls_client_hello", "dst_ip": "104.254.150.77", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ib.adnxs.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-8d6e4bae3b6f766066eb8153", "src_port": 49937, "tcp_stream": 781, "udp_stream": null, "frame_number": 28465, "timestamp_epoch": "1533965075.842549000" }, { "kind": "tls_client_hello", "dst_ip": "34.213.12.32", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "vid-io.springserve.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-01c8a6d46e2268b3722ac7d0", "src_port": 49938, "tcp_stream": 782, "udp_stream": null, "frame_number": 28501, "timestamp_epoch": "1533965076.803944000" }, { "kind": "tls_client_hello", "dst_ip": "104.254.150.77", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ib.adnxs.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-e0c5a13829d9f46e7475d8a1", "src_port": 49939, "tcp_stream": 783, "udp_stream": null, "frame_number": 28596, "timestamp_epoch": "1533965090.094137000" }, { "kind": "tls_client_hello", "dst_ip": "104.254.150.77", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ib.adnxs.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-825e779b30d92f4dc6cd6987", "src_port": 49940, "tcp_stream": 784, "udp_stream": null, "frame_number": 28600, "timestamp_epoch": "1533965090.097679000" }, { "kind": "tls_client_hello", "dst_ip": "34.213.12.32", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "vid-io.springserve.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-0f5e1c1a03cec01390f79b19", "src_port": 49941, "tcp_stream": 785, "udp_stream": null, "frame_number": 28646, "timestamp_epoch": "1533965091.432884000" }, { "kind": "tls_client_hello", "dst_ip": "192.229.210.158", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "small-video.edgecast.syn-cdn.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-22236bf35da1eb4dcc734e8e", "src_port": 49945, "tcp_stream": 788, "udp_stream": null, "frame_number": 28739, "timestamp_epoch": "1533965094.680368000" }, { "kind": "tls_client_hello", "dst_ip": "192.229.210.158", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "small-video.edgecast.syn-cdn.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-c09d7d23e4797b8b2c5b25b7", "src_port": 49944, "tcp_stream": 789, "udp_stream": null, "frame_number": 28740, "timestamp_epoch": "1533965094.680431000" }, { "kind": "tls_client_hello", "dst_ip": "13.33.78.101", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "da4pli3l5vc0d.cloudfront.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-ac4aa3ac421635060e509397", "src_port": 49942, "tcp_stream": 786, "udp_stream": null, "frame_number": 28749, "timestamp_epoch": "1533965094.697438000" }, { "kind": "tls_client_hello", "dst_ip": "13.33.78.101", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "da4pli3l5vc0d.cloudfront.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-c53501ece4105a1d704f9e3a", "src_port": 49943, "tcp_stream": 787, "udp_stream": null, "frame_number": 28753, "timestamp_epoch": "1533965094.701744000" }, { "kind": "tls_client_hello", "dst_ip": "104.254.150.77", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "lax1-ib.adnxs.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-521d2831f99ea336b84fd1ad", "src_port": 49946, "tcp_stream": 790, "udp_stream": null, "frame_number": 28758, "timestamp_epoch": "1533965094.736269000" }, { "kind": "tls_client_hello", "dst_ip": "104.254.150.77", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "lax1-ib.adnxs.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-ca01e8b7a456cec9f3b46637", "src_port": 49947, "tcp_stream": 791, "udp_stream": null, "frame_number": 28761, "timestamp_epoch": "1533965094.736604000" }, { "kind": "tls_client_hello", "dst_ip": "185.167.164.39", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "a1.adform.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-f98cbfefa01c3e3f45118fdb", "src_port": 49948, "tcp_stream": 792, "udp_stream": null, "frame_number": 29613, "timestamp_epoch": "1533965096.865848000" }, { "kind": "tls_client_hello", "dst_ip": "185.167.164.39", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "a1.adform.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-9b12eb65cb6dc384aef605bb", "src_port": 49949, "tcp_stream": 793, "udp_stream": null, "frame_number": 29617, "timestamp_epoch": "1533965096.882289000" }, { "kind": "tls_client_hello", "dst_ip": "52.44.165.199", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "uat-net.technoratimedia.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-a0ce53b4c9afba808dbe7155", "src_port": 49951, "tcp_stream": 794, "udp_stream": null, "frame_number": 29645, "timestamp_epoch": "1533965096.936583000" }, { "kind": "tls_client_hello", "dst_ip": "52.44.165.199", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "uat-net.technoratimedia.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-9f56a4597457f140c395be84", "src_port": 49950, "tcp_stream": 795, "udp_stream": null, "frame_number": 29655, "timestamp_epoch": "1533965096.962190000" }, { "kind": "tls_client_hello", "dst_ip": "54.183.95.126", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pixel.advertising.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-892ae5cba2af50e22a7811c1", "src_port": 49963, "tcp_stream": 807, "udp_stream": null, "frame_number": 29803, "timestamp_epoch": "1533965097.615870000" }, { "kind": "tls_client_hello", "dst_ip": "104.254.150.69", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "secure.adnxs.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-3795b9ef67892737ef903cef", "src_port": 49953, "tcp_stream": 797, "udp_stream": null, "frame_number": 29805, "timestamp_epoch": "1533965097.616034000" }, { "kind": "tls_client_hello", "dst_ip": "54.183.95.126", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pixel.advertising.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-8b63628bd3e30bd0ed4d6adb", "src_port": 49962, "tcp_stream": 806, "udp_stream": null, "frame_number": 29810, "timestamp_epoch": "1533965097.616243000" }, { "kind": "tls_client_hello", "dst_ip": "104.254.150.69", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "secure.adnxs.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-b47c83e1a253666a6431b598", "src_port": 49952, "tcp_stream": 796, "udp_stream": null, "frame_number": 29815, "timestamp_epoch": "1533965097.616746000" }, { "kind": "tls_client_hello", "dst_ip": "52.26.87.58", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "sync.springserve.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-438021f77fb9dcc36f119c03", "src_port": 49954, "tcp_stream": 798, "udp_stream": null, "frame_number": 29816, "timestamp_epoch": "1533965097.616748000" }, { "kind": "tls_client_hello", "dst_ip": "104.36.113.23", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "image6.pubmatic.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-ce4b6f225fa9c33a126524c8", "src_port": 49965, "tcp_stream": 808, "udp_stream": null, "frame_number": 29818, "timestamp_epoch": "1533965097.616749000" }, { "kind": "tls_client_hello", "dst_ip": "52.26.87.58", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "sync.springserve.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-9491929f37d2689165df0cbe", "src_port": 49955, "tcp_stream": 799, "udp_stream": null, "frame_number": 29829, "timestamp_epoch": "1533965097.622782000" }, { "kind": "tls_client_hello", "dst_ip": "54.186.116.83", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "match.adsrvr.org" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-85c32a78fab069eae3ff88ee", "src_port": 49961, "tcp_stream": 805, "udp_stream": null, "frame_number": 29830, "timestamp_epoch": "1533965097.622965000" }, { "kind": "tls_client_hello", "dst_ip": "54.186.116.83", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "match.adsrvr.org" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-8566575d47d7bd6fe05ce160", "src_port": 49960, "tcp_stream": 804, "udp_stream": null, "frame_number": 29833, "timestamp_epoch": "1533965097.623193000" }, { "kind": "tls_client_hello", "dst_ip": "104.36.113.23", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "image6.pubmatic.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-69a4bcb7ede3694e5320d94a", "src_port": 49964, "tcp_stream": 809, "udp_stream": null, "frame_number": 29835, "timestamp_epoch": "1533965097.623442000" }, { "kind": "tls_client_hello", "dst_ip": "8.41.222.241", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "sync.1rx.io" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-f04dcb8880bcbbf9037af246", "src_port": 49956, "tcp_stream": 800, "udp_stream": null, "frame_number": 29920, "timestamp_epoch": "1533965097.843316000" }, { "kind": "tls_client_hello", "dst_ip": "8.41.222.241", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "sync.1rx.io" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-341834cdf6185302defa64d3", "src_port": 49957, "tcp_stream": 801, "udp_stream": null, "frame_number": 29921, "timestamp_epoch": "1533965097.843521000" }, { "kind": "tls_client_hello", "dst_ip": "207.244.102.143", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "sync.aralego.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-87d7828c32d6161d1d4b08d6", "src_port": 49958, "tcp_stream": 802, "udp_stream": null, "frame_number": 29929, "timestamp_epoch": "1533965097.843912000" }, { "kind": "tls_client_hello", "dst_ip": "208.185.50.80", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pixel-us-east.rubiconproject.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-6236626e4394db0286aecf6a", "src_port": 49966, "tcp_stream": 810, "udp_stream": null, "frame_number": 30257, "timestamp_epoch": "1533965098.377029000" }, { "kind": "tls_client_hello", "dst_ip": "208.185.50.80", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pixel-us-east.rubiconproject.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-ad32d659fe8ae18edc5b50f0", "src_port": 49967, "tcp_stream": 811, "udp_stream": null, "frame_number": 30258, "timestamp_epoch": "1533965098.377030000" }, { "kind": "tls_client_hello", "dst_ip": "52.9.78.114", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "magnetic.t.domdex.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-b73ad7c53216d8c95a7a2385", "src_port": 49969, "tcp_stream": 813, "udp_stream": null, "frame_number": 30621, "timestamp_epoch": "1533965099.024703000" }, { "kind": "tls_client_hello", "dst_ip": "52.9.78.114", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "magnetic.t.domdex.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-4df453efcc52ce5c57f98976", "src_port": 49968, "tcp_stream": 812, "udp_stream": null, "frame_number": 30623, "timestamp_epoch": "1533965099.024779000" }, { "kind": "tls_client_hello", "dst_ip": "204.11.109.68", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "a.tribalfusion.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-1c2ac203596f9ada79a91685", "src_port": 49973, "tcp_stream": 816, "udp_stream": null, "frame_number": 30631, "timestamp_epoch": "1533965099.029671000" }, { "kind": "tls_client_hello", "dst_ip": "204.11.109.68", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "a.tribalfusion.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-316f82f41eb7d8da2addb2f9", "src_port": 49972, "tcp_stream": 817, "udp_stream": null, "frame_number": 30642, "timestamp_epoch": "1533965099.044869000" }, { "kind": "tls_client_hello", "dst_ip": "54.69.70.7", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cms.quantserve.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-1d3e3a4e6661df29f3341820", "src_port": 49971, "tcp_stream": 815, "udp_stream": null, "frame_number": 30646, "timestamp_epoch": "1533965099.045323000" }, { "kind": "tls_client_hello", "dst_ip": "54.69.70.7", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cms.quantserve.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-7949a641d34625f0ccba62eb", "src_port": 49970, "tcp_stream": 814, "udp_stream": null, "frame_number": 30654, "timestamp_epoch": "1533965099.046221000" }, { "kind": "tls_client_hello", "dst_ip": "151.101.0.166", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "bh.contextweb.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-19fdc0851d09dafd81d48b76", "src_port": 49976, "tcp_stream": 821, "udp_stream": null, "frame_number": 30658, "timestamp_epoch": "1533965099.046863000" }, { "kind": "tls_client_hello", "dst_ip": "151.101.0.166", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "bh.contextweb.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-48109541f5f6382bfb71acd3", "src_port": 49977, "tcp_stream": 820, "udp_stream": null, "frame_number": 30659, "timestamp_epoch": "1533965099.046897000" }, { "kind": "tls_client_hello", "dst_ip": "52.11.229.48", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "sync.tidaltv.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-8448b9a926c8e551fb50bdb0", "src_port": 49974, "tcp_stream": 819, "udp_stream": null, "frame_number": 30670, "timestamp_epoch": "1533965099.047943000" }, { "kind": "tls_client_hello", "dst_ip": "52.11.229.48", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "sync.tidaltv.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-fa77193d2124731342a3454f", "src_port": 49975, "tcp_stream": 818, "udp_stream": null, "frame_number": 30675, "timestamp_epoch": "1533965099.048530000" }, { "kind": "tls_client_hello", "dst_ip": "104.36.113.17", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "simage2.pubmatic.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-665c89571749a7aa695f2830", "src_port": 49980, "tcp_stream": 824, "udp_stream": null, "frame_number": 30791, "timestamp_epoch": "1533965099.271843000" }, { "kind": "tls_client_hello", "dst_ip": "104.36.113.17", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "simage2.pubmatic.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-279614fc77094c96a4468313", "src_port": 49981, "tcp_stream": 825, "udp_stream": null, "frame_number": 30797, "timestamp_epoch": "1533965099.273256000" }, { "kind": "tls_client_hello", "dst_ip": "52.206.38.25", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "sync.ipredictive.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-e00b085bfb41845b04afaf30", "src_port": 49979, "tcp_stream": 822, "udp_stream": null, "frame_number": 30826, "timestamp_epoch": "1533965099.301400000" }, { "kind": "tls_client_hello", "dst_ip": "52.206.38.25", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "sync.ipredictive.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-43cafd0f9b8a3c65c5eba251", "src_port": 49978, "tcp_stream": 823, "udp_stream": null, "frame_number": 30827, "timestamp_epoch": "1533965099.301617000" }, { "kind": "tls_client_hello", "dst_ip": "52.44.44.54", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "p.adsymptotic.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-0d837c2e88349399134d3663", "src_port": 49982, "tcp_stream": 826, "udp_stream": null, "frame_number": 30836, "timestamp_epoch": "1533965099.324080000" }, { "kind": "tls_client_hello", "dst_ip": "52.44.44.54", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "p.adsymptotic.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-70daa82802e6a5ac6166d2a1", "src_port": 49983, "tcp_stream": 827, "udp_stream": null, "frame_number": 30855, "timestamp_epoch": "1533965099.357388000" }, { "kind": "tls_client_hello", "dst_ip": "64.38.119.27", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "bttrack.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-fc2a8d3bc2a09b2366be607e", "src_port": 49985, "tcp_stream": 829, "udp_stream": null, "frame_number": 30979, "timestamp_epoch": "1533965099.657732000" }, { "kind": "tls_client_hello", "dst_ip": "64.38.119.27", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "bttrack.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-ab6c0790875581af2f6581cd", "src_port": 49984, "tcp_stream": 828, "udp_stream": null, "frame_number": 30991, "timestamp_epoch": "1533965099.664719000" }, { "kind": "tls_client_hello", "dst_ip": "52.8.226.99", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ads.creative-serving.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-982af53599aac927cb5dd55b", "src_port": 49989, "tcp_stream": 833, "udp_stream": null, "frame_number": 31026, "timestamp_epoch": "1533965099.746688000" }, { "kind": "tls_client_hello", "dst_ip": "52.8.226.99", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ads.creative-serving.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-0bd0b29015c06f7c4c160fbf", "src_port": 49988, "tcp_stream": 832, "udp_stream": null, "frame_number": 31035, "timestamp_epoch": "1533965099.754724000" }, { "kind": "tls_client_hello", "dst_ip": "34.234.149.11", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "px.powerlinks.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-c019d2bd1f08218968897d12", "src_port": 49986, "tcp_stream": 830, "udp_stream": null, "frame_number": 31064, "timestamp_epoch": "1533965099.788712000" }, { "kind": "tls_client_hello", "dst_ip": "34.234.149.11", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "px.powerlinks.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-484a3453efc1c8e5ab4af8f0", "src_port": 49987, "tcp_stream": 831, "udp_stream": null, "frame_number": 31065, "timestamp_epoch": "1533965099.788714000" }, { "kind": "tls_client_hello", "dst_ip": "216.200.232.221", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "sync.mathtag.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-b340cac453a09707584aa320", "src_port": 49991, "tcp_stream": 834, "udp_stream": null, "frame_number": 31082, "timestamp_epoch": "1533965099.810576000" }, { "kind": "tls_client_hello", "dst_ip": "216.200.232.221", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "sync.mathtag.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-e147a82f0f9a6df13ce6264f", "src_port": 49990, "tcp_stream": 835, "udp_stream": null, "frame_number": 31084, "timestamp_epoch": "1533965099.810884000" }, { "kind": "tls_client_hello", "dst_ip": "52.9.59.235", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "match.rundsp.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-065d4ba63004f941a073de85", "src_port": 49996, "tcp_stream": 840, "udp_stream": null, "frame_number": 31175, "timestamp_epoch": "1533965100.006057000" }, { "kind": "tls_client_hello", "dst_ip": "216.52.31.73", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cm.adgrx.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-a39a34a7a78fb9ecaf6c46bb", "src_port": 49994, "tcp_stream": 838, "udp_stream": null, "frame_number": 31187, "timestamp_epoch": "1533965100.008452000" }, { "kind": "tls_client_hello", "dst_ip": "216.52.31.73", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cm.adgrx.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-0e7d5b8ba3675a54d13d5414", "src_port": 49995, "tcp_stream": 839, "udp_stream": null, "frame_number": 31191, "timestamp_epoch": "1533965100.008832000" }, { "kind": "tls_client_hello", "dst_ip": "52.9.59.235", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "match.rundsp.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-194feef0e06db4640b3066fe", "src_port": 49997, "tcp_stream": 841, "udp_stream": null, "frame_number": 31192, "timestamp_epoch": "1533965100.009068000" }, { "kind": "tls_client_hello", "dst_ip": "74.217.250.126", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "match.bnmla.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-5da7e3d8daf4b39828582d7a", "src_port": 49992, "tcp_stream": 836, "udp_stream": null, "frame_number": 31209, "timestamp_epoch": "1533965100.029072000" }, { "kind": "tls_client_hello", "dst_ip": "74.217.250.126", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "match.bnmla.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-4e50f3d0b15ba28eda5add3e", "src_port": 49993, "tcp_stream": 837, "udp_stream": null, "frame_number": 31211, "timestamp_epoch": "1533965100.029197000" }, { "kind": "tls_client_hello", "dst_ip": "52.44.165.199", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "uat-net.technoratimedia.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-35f58e27cdf2630ee8952907", "src_port": 49998, "tcp_stream": 842, "udp_stream": null, "frame_number": 31402, "timestamp_epoch": "1533965100.369048000" }, { "kind": "tls_client_hello", "dst_ip": "35.227.197.177", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pixel.tapad.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-565e565cb46534f85b8ba572", "src_port": 49999, "tcp_stream": 843, "udp_stream": null, "frame_number": 31583, "timestamp_epoch": "1533965100.689333000" }, { "kind": "tls_client_hello", "dst_ip": "35.227.197.177", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pixel.tapad.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-10434e6e2b2420e47d9fbbf1", "src_port": 50000, "tcp_stream": 844, "udp_stream": null, "frame_number": 31585, "timestamp_epoch": "1533965100.689530000" }, { "kind": "tls_client_hello", "dst_ip": "8.39.36.143", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pixel.rubiconproject.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-410075f53ca83c042027b2af", "src_port": 50002, "tcp_stream": 846, "udp_stream": null, "frame_number": 31586, "timestamp_epoch": "1533965100.689701000" }, { "kind": "tls_client_hello", "dst_ip": "8.39.36.143", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pixel.rubiconproject.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-c2603b795175e2a8c50e3634", "src_port": 50001, "tcp_stream": 845, "udp_stream": null, "frame_number": 31588, "timestamp_epoch": "1533965100.689703000" }, { "kind": "tls_client_hello", "dst_ip": "8.39.36.143", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pixel.rubiconproject.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-51c3d89dc440f9edd16cb167", "src_port": 50003, "tcp_stream": 847, "udp_stream": null, "frame_number": 31601, "timestamp_epoch": "1533965100.693842000" }, { "kind": "tls_client_hello", "dst_ip": "8.39.36.143", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pixel.rubiconproject.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-d3a77599d92b69d4de03ab5f", "src_port": 50004, "tcp_stream": 848, "udp_stream": null, "frame_number": 31602, "timestamp_epoch": "1533965100.693894000" }, { "kind": "tls_client_hello", "dst_ip": "23.73.231.65", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "px.owneriq.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-7fa465d194aae804b130e8f2", "src_port": 50008, "tcp_stream": 852, "udp_stream": null, "frame_number": 31651, "timestamp_epoch": "1533965100.791005000" }, { "kind": "tls_client_hello", "dst_ip": "23.8.170.84", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "contextual.media.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-545dd77af20503ad86bcb335", "src_port": 50005, "tcp_stream": 849, "udp_stream": null, "frame_number": 31660, "timestamp_epoch": "1533965100.791749000" }, { "kind": "tls_client_hello", "dst_ip": "23.8.170.84", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "contextual.media.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-a852f2149c2db0a24834e65f", "src_port": 50006, "tcp_stream": 850, "udp_stream": null, "frame_number": 31661, "timestamp_epoch": "1533965100.791899000" }, { "kind": "tls_client_hello", "dst_ip": "23.73.231.65", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "px.owneriq.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-fbb13e8121d69db9ae05f054", "src_port": 50009, "tcp_stream": 853, "udp_stream": null, "frame_number": 31666, "timestamp_epoch": "1533965100.795540000" }, { "kind": "tls_client_hello", "dst_ip": "8.39.36.143", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pixel.rubiconproject.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-e94d86528f4cd7a97ffe2229", "src_port": 50007, "tcp_stream": 851, "udp_stream": null, "frame_number": 31667, "timestamp_epoch": "1533965100.795642000" }, { "kind": "tls_client_hello", "dst_ip": "8.39.36.143", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pixel.rubiconproject.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-9efd95effd812ea293bf9547", "src_port": 50011, "tcp_stream": 855, "udp_stream": null, "frame_number": 31697, "timestamp_epoch": "1533965100.808279000" }, { "kind": "tls_client_hello", "dst_ip": "104.36.113.17", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "simage2.pubmatic.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-380d6f8dff3ee3c38dc7401b", "src_port": 50010, "tcp_stream": 854, "udp_stream": null, "frame_number": 31701, "timestamp_epoch": "1533965100.810915000" }, { "kind": "tls_client_hello", "dst_ip": "104.36.113.24", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "simage4.pubmatic.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-c90674af30bb46d441d08079", "src_port": 50012, "tcp_stream": 856, "udp_stream": null, "frame_number": 31729, "timestamp_epoch": "1533965100.860099000" }, { "kind": "tls_client_hello", "dst_ip": "107.178.242.85", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "sync.ligadx.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-6b18cd9b67e74ff02b8ee150", "src_port": 50015, "tcp_stream": 859, "udp_stream": null, "frame_number": 31772, "timestamp_epoch": "1533965100.889802000" }, { "kind": "tls_client_hello", "dst_ip": "104.36.113.24", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "simage4.pubmatic.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-8ac563f5f10e851c78ac1709", "src_port": 50013, "tcp_stream": 857, "udp_stream": null, "frame_number": 31774, "timestamp_epoch": "1533965100.889903000" }, { "kind": "tls_client_hello", "dst_ip": "209.191.163.209", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ce.lijit.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-a7f0b70f2358852d5d60f972", "src_port": 50019, "tcp_stream": 862, "udp_stream": null, "frame_number": 31788, "timestamp_epoch": "1533965100.899662000" }, { "kind": "tls_client_hello", "dst_ip": "151.101.2.2", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "trc.taboola.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-8afcbcf7bb82f9b124eade64", "src_port": 50021, "tcp_stream": 865, "udp_stream": null, "frame_number": 31800, "timestamp_epoch": "1533965100.912658000" }, { "kind": "tls_client_hello", "dst_ip": "209.191.163.209", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ce.lijit.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-5337328d0f488607a49c3c72", "src_port": 50017, "tcp_stream": 861, "udp_stream": null, "frame_number": 31801, "timestamp_epoch": "1533965100.912659000" }, { "kind": "tls_client_hello", "dst_ip": "107.178.242.85", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "sync.ligadx.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-083e0fe4d3b13b6070a82739", "src_port": 50018, "tcp_stream": 863, "udp_stream": null, "frame_number": 31804, "timestamp_epoch": "1533965100.914146000" }, { "kind": "tls_client_hello", "dst_ip": "151.101.2.2", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "trc.taboola.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-db452eaab7dce2b492e480d9", "src_port": 50020, "tcp_stream": 864, "udp_stream": null, "frame_number": 31806, "timestamp_epoch": "1533965100.914287000" }, { "kind": "tls_client_hello", "dst_ip": "70.42.132.5", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ebdr3.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-68c7fd001999d72934d48507", "src_port": 50025, "tcp_stream": 869, "udp_stream": null, "frame_number": 31819, "timestamp_epoch": "1533965100.951618000" }, { "kind": "tls_client_hello", "dst_ip": "70.42.132.5", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ebdr3.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-16d39589779b74a8edef8fa6", "src_port": 50024, "tcp_stream": 868, "udp_stream": null, "frame_number": 31826, "timestamp_epoch": "1533965100.952361000" }, { "kind": "tls_client_hello", "dst_ip": "173.239.42.221", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "dsp.adkernel.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-7284f76d82ea7a2533bab81f", "src_port": 50014, "tcp_stream": 858, "udp_stream": null, "frame_number": 31835, "timestamp_epoch": "1533965100.980563000" }, { "kind": "tls_client_hello", "dst_ip": "173.239.42.221", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "dsp.adkernel.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-29386e779509f12581821094", "src_port": 50016, "tcp_stream": 860, "udp_stream": null, "frame_number": 31838, "timestamp_epoch": "1533965100.980923000" }, { "kind": "tls_client_hello", "dst_ip": "52.201.177.113", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "match.sharethrough.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-d218c15a4ed4affd34405b3f", "src_port": 50027, "tcp_stream": 871, "udp_stream": null, "frame_number": 31846, "timestamp_epoch": "1533965101.016609000" }, { "kind": "tls_client_hello", "dst_ip": "52.201.177.113", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "match.sharethrough.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-50cfa4051fb16e14843a3c9b", "src_port": 50026, "tcp_stream": 870, "udp_stream": null, "frame_number": 31847, "timestamp_epoch": "1533965101.016612000" }, { "kind": "tls_client_hello", "dst_ip": "54.217.217.143", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ad.sxp.smartclip.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-b23d885a8d54de2869a66a1f", "src_port": 50023, "tcp_stream": 867, "udp_stream": null, "frame_number": 31863, "timestamp_epoch": "1533965101.066755000" }, { "kind": "tls_client_hello", "dst_ip": "54.217.217.143", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ad.sxp.smartclip.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-aa1e04950992ee7d0d9bdd5b", "src_port": 50022, "tcp_stream": 866, "udp_stream": null, "frame_number": 31866, "timestamp_epoch": "1533965101.066759000" }, { "kind": "tls_client_hello", "dst_ip": "63.251.253.231", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ads.lfstmedia.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-19104ebb776215401b9415e8", "src_port": 50029, "tcp_stream": 873, "udp_stream": null, "frame_number": 31960, "timestamp_epoch": "1533965101.211552000" }, { "kind": "tls_client_hello", "dst_ip": "63.251.253.231", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ads.lfstmedia.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-772e08d0caa60820148106df", "src_port": 50028, "tcp_stream": 872, "udp_stream": null, "frame_number": 31962, "timestamp_epoch": "1533965101.211676000" }, { "kind": "tls_client_hello", "dst_ip": "104.36.113.17", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "image2.pubmatic.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-b47a93fc66263e6b0371bf6d", "src_port": 50031, "tcp_stream": 875, "udp_stream": null, "frame_number": 32100, "timestamp_epoch": "1533965101.564817000" }, { "kind": "tls_client_hello", "dst_ip": "104.36.113.17", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "image2.pubmatic.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-734a32b98618ff5d844c3f3a", "src_port": 50030, "tcp_stream": 874, "udp_stream": null, "frame_number": 32102, "timestamp_epoch": "1533965101.569346000" }, { "kind": "tls_client_hello", "dst_ip": "151.101.2.49", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "match.taboola.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-0a3e12447eb9dc416a41b279", "src_port": 50032, "tcp_stream": 876, "udp_stream": null, "frame_number": 32170, "timestamp_epoch": "1533965101.852145000" }, { "kind": "tls_client_hello", "dst_ip": "151.101.2.49", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "match.taboola.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-4f027377504436a20ae226e0", "src_port": 50033, "tcp_stream": 877, "udp_stream": null, "frame_number": 32174, "timestamp_epoch": "1533965101.879907000" }, { "kind": "tls_client_hello", "dst_ip": "207.244.102.143", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "sync.aralego.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-2ea7209ffc9ca31b4e3d559e", "src_port": 49959, "tcp_stream": 803, "udp_stream": null, "frame_number": 32200, "timestamp_epoch": "1533965101.975590000" }, { "kind": "tls_client_hello", "dst_ip": "64.125.223.109", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pixel-sc2.adsymptotic.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-2c39ba1e4fdf93bde6c3c743", "src_port": 50034, "tcp_stream": 878, "udp_stream": null, "frame_number": 32226, "timestamp_epoch": "1533965102.240261000" }, { "kind": "tls_client_hello", "dst_ip": "64.125.223.109", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pixel-sc2.adsymptotic.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-272798b565cbd8863daf5e7a", "src_port": 50035, "tcp_stream": 879, "udp_stream": null, "frame_number": 32227, "timestamp_epoch": "1533965102.240348000" }, { "kind": "tls_client_hello", "dst_ip": "52.8.202.139", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "bcp.crwdcntrl.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-2037a07f69d82200c16c4208", "src_port": 50036, "tcp_stream": 880, "udp_stream": null, "frame_number": 32283, "timestamp_epoch": "1533965106.594419000" }, { "kind": "tls_client_hello", "dst_ip": "52.8.202.139", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "bcp.crwdcntrl.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-b774c40b9b0fc240fdc3d30d", "src_port": 50037, "tcp_stream": 881, "udp_stream": null, "frame_number": 32285, "timestamp_epoch": "1533965106.594543000" }, { "kind": "tls_client_hello", "dst_ip": "104.254.150.77", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ib.adnxs.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-206494fc976e40c32ea4f322", "src_port": 50039, "tcp_stream": 883, "udp_stream": null, "frame_number": 32375, "timestamp_epoch": "1533965110.082151000" }, { "kind": "tls_client_hello", "dst_ip": "34.213.12.32", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "vid-io.springserve.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-ec15d023f0e079019ea7fd19", "src_port": 50040, "tcp_stream": 884, "udp_stream": null, "frame_number": 32429, "timestamp_epoch": "1533965111.411023000" }, { "kind": "tls_client_hello", "dst_ip": "104.254.150.77", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ib.adnxs.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-46e502dc56c39a18777b125a", "src_port": 50042, "tcp_stream": 886, "udp_stream": null, "frame_number": 32570, "timestamp_epoch": "1533965130.566357000" }, { "kind": "tls_client_hello", "dst_ip": "104.254.150.77", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ib.adnxs.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-6e7e721ac6602db892da2096", "src_port": 50041, "tcp_stream": 885, "udp_stream": null, "frame_number": 32572, "timestamp_epoch": "1533965130.566596000" }, { "kind": "tls_client_hello", "dst_ip": "34.213.12.32", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "vid-io.springserve.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-6369829144b3e6ed8a726e94", "src_port": 50043, "tcp_stream": 887, "udp_stream": null, "frame_number": 32608, "timestamp_epoch": "1533965131.843881000" }, { "kind": "tls_client_hello", "dst_ip": "74.125.195.154", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "bid.g.doubleclick.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-659ccff6fc3006d5c58a9757", "src_port": 50044, "tcp_stream": 888, "udp_stream": null, "frame_number": 32660, "timestamp_epoch": "1533965134.316392000" }, { "kind": "tls_client_hello", "dst_ip": "74.125.195.154", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "bid.g.doubleclick.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-985d395242978c0089dd74b1", "src_port": 50045, "tcp_stream": 889, "udp_stream": null, "frame_number": 32664, "timestamp_epoch": "1533965134.321488000" }, { "kind": "tls_client_hello", "dst_ip": "52.24.61.237", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "rtr.innovid.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-65f3ce9863a7a9e3805fdadb", "src_port": 50047, "tcp_stream": 891, "udp_stream": null, "frame_number": 32710, "timestamp_epoch": "1533965134.952080000" }, { "kind": "tls_client_hello", "dst_ip": "52.24.61.237", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "rtr.innovid.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-bdcfa2418922c189457d08c8", "src_port": 50046, "tcp_stream": 890, "udp_stream": null, "frame_number": 32711, "timestamp_epoch": "1533965134.952249000" }, { "kind": "tls_client_hello", "dst_ip": "23.54.21.240", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "s-static.innovid.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-06b7cb3a8199491baa4327ab", "src_port": 50048, "tcp_stream": 892, "udp_stream": null, "frame_number": 32745, "timestamp_epoch": "1533965135.491616000" }, { "kind": "tls_client_hello", "dst_ip": "23.54.21.240", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "s-static.innovid.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-39b43ee744443a8170f89c2d", "src_port": 50049, "tcp_stream": 893, "udp_stream": null, "frame_number": 32747, "timestamp_epoch": "1533965135.491714000" }, { "kind": "tls_client_hello", "dst_ip": "23.54.20.74", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cdn.doubleverify.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-7b171db6d0a0597f2ea3debf", "src_port": 50052, "tcp_stream": 896, "udp_stream": null, "frame_number": 32852, "timestamp_epoch": "1533965136.154989000" }, { "kind": "tls_client_hello", "dst_ip": "23.54.20.74", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cdn.doubleverify.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-4ed079037a89f3e77581755b", "src_port": 50053, "tcp_stream": 897, "udp_stream": null, "frame_number": 32856, "timestamp_epoch": "1533965136.162089000" }, { "kind": "tls_client_hello", "dst_ip": "18.218.6.11", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "s.innovid.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-6b590938ddd55d0e43d8917d", "src_port": 50050, "tcp_stream": 894, "udp_stream": null, "frame_number": 32878, "timestamp_epoch": "1533965136.227907000" }, { "kind": "tls_client_hello", "dst_ip": "18.218.6.11", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "s.innovid.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-1aca1c6fc5e20efdbfcd10f7", "src_port": 50051, "tcp_stream": 895, "udp_stream": null, "frame_number": 32880, "timestamp_epoch": "1533965136.228296000" }, { "kind": "tls_client_hello", "dst_ip": "23.54.20.74", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cdn3.doubleverify.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-e5f9eaec24d17e6783de7301", "src_port": 50054, "tcp_stream": 898, "udp_stream": null, "frame_number": 32960, "timestamp_epoch": "1533965136.671813000" }, { "kind": "tls_client_hello", "dst_ip": "23.54.20.74", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cdn3.doubleverify.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-99fe9847b909336cc59cfc15", "src_port": 50055, "tcp_stream": 899, "udp_stream": null, "frame_number": 32968, "timestamp_epoch": "1533965136.717908000" }, { "kind": "tls_client_hello", "dst_ip": "63.251.109.87", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "rtb0.doubleverify.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-a88c8f400d941ad0084bde0a", "src_port": 50056, "tcp_stream": 900, "udp_stream": null, "frame_number": 32982, "timestamp_epoch": "1533965136.734297000" }, { "kind": "tls_client_hello", "dst_ip": "63.251.109.87", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "rtb0.doubleverify.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-1e3311d52a8bdbdb2e71de0a", "src_port": 50057, "tcp_stream": 901, "udp_stream": null, "frame_number": 32984, "timestamp_epoch": "1533965136.734621000" }, { "kind": "tls_client_hello", "dst_ip": "52.33.44.132", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ag.innovid.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-8b1ceeb5b04a584152cf65b6", "src_port": 50058, "tcp_stream": 902, "udp_stream": null, "frame_number": 33021, "timestamp_epoch": "1533965136.873817000" }, { "kind": "tls_client_hello", "dst_ip": "52.33.44.132", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ag.innovid.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-2febc5d302b8773cd1669e30", "src_port": 50059, "tcp_stream": 903, "udp_stream": null, "frame_number": 33027, "timestamp_epoch": "1533965136.880761000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.194.162", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "googleads.g.doubleclick.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-736a7a43fdb2c91a17c2914d", "src_port": 50060, "tcp_stream": 904, "udp_stream": null, "frame_number": 33061, "timestamp_epoch": "1533965136.994395000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.194.162", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "googleads.g.doubleclick.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-a8456829751c85b8deabf65e", "src_port": 50061, "tcp_stream": 905, "udp_stream": null, "frame_number": 33063, "timestamp_epoch": "1533965136.995440000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.1", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tpc.googlesyndication.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-477119c5862d47f55d363c42", "src_port": 50063, "tcp_stream": 906, "udp_stream": null, "frame_number": 33110, "timestamp_epoch": "1533965137.166579000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.1", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tpc.googlesyndication.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-dba8cd86320540290c1a242a", "src_port": 50062, "tcp_stream": 907, "udp_stream": null, "frame_number": 33118, "timestamp_epoch": "1533965137.186092000" }, { "kind": "tls_client_hello", "dst_ip": "63.251.109.87", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tps702.doubleverify.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-173f7d550266f80bf33ee5f8", "src_port": 50064, "tcp_stream": 908, "udp_stream": null, "frame_number": 33119, "timestamp_epoch": "1533965137.186096000" }, { "kind": "tls_client_hello", "dst_ip": "63.251.109.87", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tps702.doubleverify.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-e200d1b72e73069484175fc6", "src_port": 50067, "tcp_stream": 911, "udp_stream": null, "frame_number": 33132, "timestamp_epoch": "1533965137.203286000" }, { "kind": "tls_client_hello", "dst_ip": "63.251.109.87", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tps702.doubleverify.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-be213ca1d280aa9217afe55e", "src_port": 50066, "tcp_stream": 910, "udp_stream": null, "frame_number": 33133, "timestamp_epoch": "1533965137.203289000" }, { "kind": "tls_client_hello", "dst_ip": "63.251.109.87", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tps702.doubleverify.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-6ba7c869ab3d01f1ffa35869", "src_port": 50065, "tcp_stream": 909, "udp_stream": null, "frame_number": 33135, "timestamp_epoch": "1533965137.203629000" }, { "kind": "tls_client_hello", "dst_ip": "63.251.109.87", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tps702.doubleverify.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-6b4cd5a68928919b277f5a4c", "src_port": 50069, "tcp_stream": 913, "udp_stream": null, "frame_number": 33136, "timestamp_epoch": "1533965137.203720000" }, { "kind": "tls_client_hello", "dst_ip": "63.251.109.87", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tps702.doubleverify.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-68c93eba42c1d62a6bf94d3b", "src_port": 50068, "tcp_stream": 912, "udp_stream": null, "frame_number": 33139, "timestamp_epoch": "1533965137.203985000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.194.162", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "googleads.g.doubleclick.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-d6b084ff7f5e49a23e7f8d13", "src_port": 50070, "tcp_stream": 914, "udp_stream": null, "frame_number": 33252, "timestamp_epoch": "1533965137.379124000" }, { "kind": "tls_client_hello", "dst_ip": "63.251.109.87", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tps702.doubleverify.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-ee7168328d4c843dcde7ee8e", "src_port": 50071, "tcp_stream": 915, "udp_stream": null, "frame_number": 33350, "timestamp_epoch": "1533965137.611935000" }, { "kind": "tls_client_hello", "dst_ip": "63.251.109.87", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tps702.doubleverify.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-316dcffdae05075916118fba", "src_port": 50072, "tcp_stream": 916, "udp_stream": null, "frame_number": 33358, "timestamp_epoch": "1533965137.615961000" }, { "kind": "tls_client_hello", "dst_ip": "63.251.109.87", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tps.doubleverify.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-f5f62aa342fcc9a77ec39cbd", "src_port": 50073, "tcp_stream": 917, "udp_stream": null, "frame_number": 33386, "timestamp_epoch": "1533965137.996576000" }, { "kind": "tls_client_hello", "dst_ip": "63.251.109.87", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tps.doubleverify.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-fdea90873133b9d23a27a274", "src_port": 50074, "tcp_stream": 918, "udp_stream": null, "frame_number": 33388, "timestamp_epoch": "1533965137.996654000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.2", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ade.googlesyndication.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-556e7be5f1f0f27e3f3d4d5a", "src_port": 50075, "tcp_stream": 919, "udp_stream": null, "frame_number": 33424, "timestamp_epoch": "1533965142.863003000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.2", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ade.googlesyndication.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-4c19b0d53406d2e7caa4c71f", "src_port": 50076, "tcp_stream": 920, "udp_stream": null, "frame_number": 33426, "timestamp_epoch": "1533965142.863666000" }, { "kind": "tls_client_hello", "dst_ip": "104.254.150.77", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ib.adnxs.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-db1ad7caf1ed0ceb3ba7aa14", "src_port": 50077, "tcp_stream": 921, "udp_stream": null, "frame_number": 33506, "timestamp_epoch": "1533965151.545702000" }, { "kind": "tls_client_hello", "dst_ip": "104.254.150.77", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ib.adnxs.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-edbb0579e9805ecdaad232ac", "src_port": 50078, "tcp_stream": 922, "udp_stream": null, "frame_number": 33507, "timestamp_epoch": "1533965151.545764000" }, { "kind": "tls_client_hello", "dst_ip": "34.213.12.32", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "vid-io.springserve.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-f2ebbee8dfc570bff0f1502d", "src_port": 50079, "tcp_stream": 923, "udp_stream": null, "frame_number": 33544, "timestamp_epoch": "1533965152.660854000" }, { "kind": "tls_client_hello", "dst_ip": "104.254.150.77", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "lax1-ib.adnxs.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-261013e6c9d6882f2ed25f6c", "src_port": 50081, "tcp_stream": 925, "udp_stream": null, "frame_number": 33597, "timestamp_epoch": "1533965155.480314000" }, { "kind": "tls_client_hello", "dst_ip": "104.254.150.77", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "lax1-ib.adnxs.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-d218c920fbb760ba69ca5680", "src_port": 50080, "tcp_stream": 924, "udp_stream": null, "frame_number": 33601, "timestamp_epoch": "1533965155.481900000" }, { "kind": "tls_client_hello", "dst_ip": "13.33.78.101", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "da4pli3l5vc0d.cloudfront.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-088d52504431eb1bd4392393", "src_port": 50083, "tcp_stream": 927, "udp_stream": null, "frame_number": 33665, "timestamp_epoch": "1533965157.318244000" }, { "kind": "tls_client_hello", "dst_ip": "13.33.78.101", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "da4pli3l5vc0d.cloudfront.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-7618dd504b3e47b4c3e63008", "src_port": 50082, "tcp_stream": 926, "udp_stream": null, "frame_number": 33671, "timestamp_epoch": "1533965157.319578000" }, { "kind": "tls_client_hello", "dst_ip": "192.229.210.158", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "small-video.edgecast.syn-cdn.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-2d8f1104d0c2899a990e7739", "src_port": 50085, "tcp_stream": 929, "udp_stream": null, "frame_number": 33675, "timestamp_epoch": "1533965157.342011000" }, { "kind": "tls_client_hello", "dst_ip": "192.229.210.158", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "small-video.edgecast.syn-cdn.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-be646fe8dedd0d16dad654be", "src_port": 50084, "tcp_stream": 928, "udp_stream": null, "frame_number": 33683, "timestamp_epoch": "1533965157.342873000" }, { "kind": "tls_client_hello", "dst_ip": "104.254.150.69", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "secure.adnxs.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-3defeab61360eb47a00e6d61", "src_port": 50086, "tcp_stream": 930, "udp_stream": null, "frame_number": 33738, "timestamp_epoch": "1533965157.462503000" }, { "kind": "tls_client_hello", "dst_ip": "104.254.150.69", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "secure.adnxs.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-0991ea0fb3a924f6393b21c5", "src_port": 50087, "tcp_stream": 931, "udp_stream": null, "frame_number": 33739, "timestamp_epoch": "1533965157.462612000" }, { "kind": "tls_client_hello", "dst_ip": "207.244.102.143", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "sync.aralego.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-3d9dd2038f6fbd488f31368f", "src_port": 50089, "tcp_stream": 932, "udp_stream": null, "frame_number": 33796, "timestamp_epoch": "1533965157.589684000" }, { "kind": "tls_client_hello", "dst_ip": "207.244.102.143", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "sync.aralego.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-1bf4ae9927b09d8fc9a019c2", "src_port": 50088, "tcp_stream": 933, "udp_stream": null, "frame_number": 33798, "timestamp_epoch": "1533965157.590054000" }, { "kind": "tls_client_hello", "dst_ip": "72.5.64.63", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "rp.gwallet.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-7bf3e2013c6b8d264c3551a2", "src_port": 50091, "tcp_stream": 935, "udp_stream": null, "frame_number": 33905, "timestamp_epoch": "1533965157.828358000" }, { "kind": "tls_client_hello", "dst_ip": "72.5.64.63", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "rp.gwallet.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-329cffd6a56dcf1db4aecd3f", "src_port": 50090, "tcp_stream": 934, "udp_stream": null, "frame_number": 33906, "timestamp_epoch": "1533965157.828453000" }, { "kind": "tls_client_hello", "dst_ip": "98.136.101.121", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ads.yahoo.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-ef950a0d55e6d88c9964060c", "src_port": 50093, "tcp_stream": 938, "udp_stream": null, "frame_number": 33913, "timestamp_epoch": "1533965157.843534000" }, { "kind": "tls_client_hello", "dst_ip": "74.6.34.27", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pr-bh.ybp.yahoo.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-32cecc7baec172784cef9b05", "src_port": 50094, "tcp_stream": 937, "udp_stream": null, "frame_number": 33914, "timestamp_epoch": "1533965157.843657000" }, { "kind": "tls_client_hello", "dst_ip": "74.6.34.27", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pr-bh.ybp.yahoo.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-8182cc2c46f24da7e22734ed", "src_port": 50092, "tcp_stream": 936, "udp_stream": null, "frame_number": 33921, "timestamp_epoch": "1533965157.844645000" }, { "kind": "tls_client_hello", "dst_ip": "98.136.101.121", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ads.yahoo.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-02eebdc86d4ef5db04cac9b5", "src_port": 50095, "tcp_stream": 939, "udp_stream": null, "frame_number": 33928, "timestamp_epoch": "1533965157.852767000" }, { "kind": "tls_client_hello", "dst_ip": "162.210.199.69", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "b1sync.zemanta.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-e13fb8f86f04f048e250333f", "src_port": 50096, "tcp_stream": 940, "udp_stream": null, "frame_number": 33999, "timestamp_epoch": "1533965157.918564000" }, { "kind": "tls_client_hello", "dst_ip": "162.210.199.69", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "b1sync.zemanta.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-b362507159f739c7127ea00d", "src_port": 50097, "tcp_stream": 941, "udp_stream": null, "frame_number": 34002, "timestamp_epoch": "1533965157.918784000" }, { "kind": "tls_client_hello", "dst_ip": "35.186.239.238", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cm.eyereturn.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-486a00bb0c56addca779569c", "src_port": 50098, "tcp_stream": 942, "udp_stream": null, "frame_number": 34027, "timestamp_epoch": "1533965157.936377000" }, { "kind": "tls_client_hello", "dst_ip": "35.186.239.238", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cm.eyereturn.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-e26c53c97b8d2999a5863a95", "src_port": 50099, "tcp_stream": 943, "udp_stream": null, "frame_number": 34028, "timestamp_epoch": "1533965157.936486000" }, { "kind": "tls_client_hello", "dst_ip": "52.4.175.160", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "rtb.adentifi.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-1cd0e9e0df8e15b7bbb072ee", "src_port": 50101, "tcp_stream": 945, "udp_stream": null, "frame_number": 34262, "timestamp_epoch": "1533965158.190158000" }, { "kind": "tls_client_hello", "dst_ip": "52.4.175.160", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "rtb.adentifi.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-09aabf4603e38e1868b9a48c", "src_port": 50100, "tcp_stream": 944, "udp_stream": null, "frame_number": 34270, "timestamp_epoch": "1533965158.203148000" }, { "kind": "tls_client_hello", "dst_ip": "185.167.164.39", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "a1.adform.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-7b54d9cd68f4183d72279173", "src_port": 50103, "tcp_stream": 947, "udp_stream": null, "frame_number": 34722, "timestamp_epoch": "1533965158.851379000" }, { "kind": "tls_client_hello", "dst_ip": "185.167.164.39", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "a1.adform.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-85d7eec1060d2dfbc2632f53", "src_port": 50102, "tcp_stream": 946, "udp_stream": null, "frame_number": 34726, "timestamp_epoch": "1533965158.851787000" }, { "kind": "tls_client_hello", "dst_ip": "104.36.113.24", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "image4.pubmatic.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-a6ac4e35da9f8d66d6e375b0", "src_port": 50104, "tcp_stream": 948, "udp_stream": null, "frame_number": 34889, "timestamp_epoch": "1533965159.091676000" }, { "kind": "tls_client_hello", "dst_ip": "104.36.113.24", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "image4.pubmatic.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-79cc35b4f0d2d9add2dadf63", "src_port": 50105, "tcp_stream": 949, "udp_stream": null, "frame_number": 34891, "timestamp_epoch": "1533965159.091883000" }, { "kind": "tls_client_hello", "dst_ip": "109.232.197.110", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "mm.melia.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-34f8606f0a59428a5cf925ee", "src_port": 50106, "tcp_stream": 950, "udp_stream": null, "frame_number": 35467, "timestamp_epoch": "1533965160.181369000" }, { "kind": "tls_client_hello", "dst_ip": "109.232.197.110", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "mm.melia.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-94f654b31d2ab6f5ba96a689", "src_port": 50107, "tcp_stream": 951, "udp_stream": null, "frame_number": 35471, "timestamp_epoch": "1533965160.192710000" }, { "kind": "tls_client_hello", "dst_ip": "185.167.166.41", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "s2.adform.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-d77d78f6c43281899b473ce2", "src_port": 50109, "tcp_stream": 953, "udp_stream": null, "frame_number": 35507, "timestamp_epoch": "1533965160.284050000" }, { "kind": "tls_client_hello", "dst_ip": "185.167.166.41", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "s2.adform.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-0253dc7fa6368d9ac1a9a77e", "src_port": 50108, "tcp_stream": 952, "udp_stream": null, "frame_number": 35509, "timestamp_epoch": "1533965160.284262000" }, { "kind": "tls_client_hello", "dst_ip": "52.42.116.214", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "match.prod.bidr.io" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-40073672eb4d6585e6b7c48f", "src_port": 50112, "tcp_stream": 956, "udp_stream": null, "frame_number": 35547, "timestamp_epoch": "1533965160.371639000" }, { "kind": "tls_client_hello", "dst_ip": "52.42.116.214", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "match.prod.bidr.io" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-6207d2bc00972f87b591b69e", "src_port": 50113, "tcp_stream": 957, "udp_stream": null, "frame_number": 35548, "timestamp_epoch": "1533965160.371822000" }, { "kind": "tls_client_hello", "dst_ip": "52.206.38.25", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "sync.ipredictive.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-355e0ada623990279f91777c", "src_port": 50110, "tcp_stream": 954, "udp_stream": null, "frame_number": 35577, "timestamp_epoch": "1533965160.397970000" }, { "kind": "tls_client_hello", "dst_ip": "52.206.38.25", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "sync.ipredictive.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-2de26c14d580bb003b6975cd", "src_port": 50111, "tcp_stream": 955, "udp_stream": null, "frame_number": 35578, "timestamp_epoch": "1533965160.398032000" }, { "kind": "tls_client_hello", "dst_ip": "35.201.123.46", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "delivery.h.switchadhub.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-9ed4da433ceafca8775d9ff9", "src_port": 50117, "tcp_stream": 961, "udp_stream": null, "frame_number": 35583, "timestamp_epoch": "1533965160.404895000" }, { "kind": "tls_client_hello", "dst_ip": "35.201.123.46", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "delivery.h.switchadhub.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-951b6674ccde15e43d2f4f39", "src_port": 50120, "tcp_stream": 964, "udp_stream": null, "frame_number": 35587, "timestamp_epoch": "1533965160.424069000" }, { "kind": "tls_client_hello", "dst_ip": "18.218.60.224", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "sync.adotmob.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-8e0949055587d62631e6fa3d", "src_port": 50122, "tcp_stream": 966, "udp_stream": null, "frame_number": 35619, "timestamp_epoch": "1533965160.477153000" }, { "kind": "tls_client_hello", "dst_ip": "18.218.60.224", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "sync.adotmob.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-608fa12670f3fc0e6c84606a", "src_port": 50123, "tcp_stream": 967, "udp_stream": null, "frame_number": 35623, "timestamp_epoch": "1533965160.478568000" }, { "kind": "tls_client_hello", "dst_ip": "23.20.36.175", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pre-usermatch.targeting.unrulymedia.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-46c5db4a9ee91c267ec3bbea", "src_port": 50126, "tcp_stream": 970, "udp_stream": null, "frame_number": 35635, "timestamp_epoch": "1533965160.493902000" }, { "kind": "tls_client_hello", "dst_ip": "54.92.93.205", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cs.adingo.jp" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-d106516e619715ad49605fd0", "src_port": 50115, "tcp_stream": 959, "udp_stream": null, "frame_number": 35639, "timestamp_epoch": "1533965160.501178000" }, { "kind": "tls_client_hello", "dst_ip": "23.20.36.175", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pre-usermatch.targeting.unrulymedia.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-a2c065002f64ab39badaa55b", "src_port": 50127, "tcp_stream": 971, "udp_stream": null, "frame_number": 35643, "timestamp_epoch": "1533965160.503041000" }, { "kind": "tls_client_hello", "dst_ip": "54.92.93.205", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cs.adingo.jp" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-bf97a545c8dadfda7f0b57a0", "src_port": 50114, "tcp_stream": 958, "udp_stream": null, "frame_number": 35655, "timestamp_epoch": "1533965160.512260000" }, { "kind": "tls_client_hello", "dst_ip": "213.155.156.164", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "d5p.de17a.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-1fd3c24412f6692dcf78922f", "src_port": 50118, "tcp_stream": 962, "udp_stream": null, "frame_number": 35688, "timestamp_epoch": "1533965160.566666000" }, { "kind": "tls_client_hello", "dst_ip": "213.155.156.164", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "d5p.de17a.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-aef52dd2e29edfab788905b3", "src_port": 50116, "tcp_stream": 960, "udp_stream": null, "frame_number": 35689, "timestamp_epoch": "1533965160.566812000" }, { "kind": "tls_client_hello", "dst_ip": "85.114.159.93", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "dsp.adfarm1.adition.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-3ae9a41597a5c5c861c8067b", "src_port": 50119, "tcp_stream": 963, "udp_stream": null, "frame_number": 35706, "timestamp_epoch": "1533965160.580828000" }, { "kind": "tls_client_hello", "dst_ip": "52.211.165.177", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "synchroscript.deliveryengine.adswizz.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-d72020258eb46005244427e8", "src_port": 50125, "tcp_stream": 969, "udp_stream": null, "frame_number": 35709, "timestamp_epoch": "1533965160.581392000" }, { "kind": "tls_client_hello", "dst_ip": "85.114.159.93", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "dsp.adfarm1.adition.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-a81b889f73699ab1dfe41862", "src_port": 50121, "tcp_stream": 965, "udp_stream": null, "frame_number": 35714, "timestamp_epoch": "1533965160.600800000" }, { "kind": "tls_client_hello", "dst_ip": "52.211.165.177", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "synchroscript.deliveryengine.adswizz.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-863d4c22ef47c7484518e53d", "src_port": 50124, "tcp_stream": 968, "udp_stream": null, "frame_number": 35730, "timestamp_epoch": "1533965160.668665000" }, { "kind": "tls_client_hello", "dst_ip": "34.237.234.13", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "melia.sp1.convertro.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-66b7960732eddf1503081bf0", "src_port": 50128, "tcp_stream": 973, "udp_stream": null, "frame_number": 35831, "timestamp_epoch": "1533965160.970333000" }, { "kind": "tls_client_hello", "dst_ip": "34.237.234.13", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "melia.sp1.convertro.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-9ba26d7bf7d24f414f4c7451", "src_port": 50129, "tcp_stream": 972, "udp_stream": null, "frame_number": 35832, "timestamp_epoch": "1533965160.970589000" }, { "kind": "tls_client_hello", "dst_ip": "104.254.150.77", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ib.adnxs.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-016c176b04fd037a8667fbb0", "src_port": 50130, "tcp_stream": 974, "udp_stream": null, "frame_number": 36067, "timestamp_epoch": "1533965173.345481000" }, { "kind": "tls_client_hello", "dst_ip": "104.254.150.77", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ib.adnxs.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-0b5fa95e0e3f6a170d614508", "src_port": 50131, "tcp_stream": 975, "udp_stream": null, "frame_number": 36071, "timestamp_epoch": "1533965173.357474000" }, { "kind": "tls_client_hello", "dst_ip": "34.213.12.32", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "vid-io.springserve.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-9fa8ed0f41e6e569aa3ffc53", "src_port": 50132, "tcp_stream": 976, "udp_stream": null, "frame_number": 36112, "timestamp_epoch": "1533965174.416273000" }, { "kind": "tls_client_hello", "dst_ip": "104.254.150.77", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ib.adnxs.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-dbe890b8085addca4cecef82", "src_port": 50133, "tcp_stream": 977, "udp_stream": null, "frame_number": 36236, "timestamp_epoch": "1533965193.928525000" }, { "kind": "tls_client_hello", "dst_ip": "104.254.150.77", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ib.adnxs.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-fc61a4230fe8982653b9cef9", "src_port": 50134, "tcp_stream": 978, "udp_stream": null, "frame_number": 36237, "timestamp_epoch": "1533965193.928527000" }, { "kind": "tls_client_hello", "dst_ip": "34.213.12.32", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "vid-io.springserve.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-7140460982522bc4016e6b5d", "src_port": 50135, "tcp_stream": 979, "udp_stream": null, "frame_number": 36276, "timestamp_epoch": "1533965195.109749000" }, { "kind": "tls_client_hello", "dst_ip": "104.254.150.77", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ib.adnxs.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-1eb6f779180b70760ff055f3", "src_port": 50137, "tcp_stream": 981, "udp_stream": null, "frame_number": 36866, "timestamp_epoch": "1533965213.743705000" }, { "kind": "tls_client_hello", "dst_ip": "104.254.150.77", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ib.adnxs.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-93b672eff185a984ddf7cf2a", "src_port": 50136, "tcp_stream": 980, "udp_stream": null, "frame_number": 36868, "timestamp_epoch": "1533965213.743780000" }, { "kind": "tls_client_hello", "dst_ip": "13.33.78.101", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "da4pli3l5vc0d.cloudfront.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-e22f7a866c19d1ae70baca48", "src_port": 50139, "tcp_stream": 984, "udp_stream": null, "frame_number": 37020, "timestamp_epoch": "1533965220.199143000" }, { "kind": "tls_client_hello", "dst_ip": "13.33.78.101", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "da4pli3l5vc0d.cloudfront.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-506deb890bfaeba23a0e0b74", "src_port": 50140, "tcp_stream": 983, "udp_stream": null, "frame_number": 37021, "timestamp_epoch": "1533965220.199145000" }, { "kind": "tls_client_hello", "dst_ip": "192.229.210.158", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "small-video.edgecast.syn-cdn.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-721a23b34a80d49ba48a85f2", "src_port": 50141, "tcp_stream": 985, "udp_stream": null, "frame_number": 37134, "timestamp_epoch": "1533965226.489331000" }, { "kind": "tls_client_hello", "dst_ip": "192.229.210.158", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "small-video.edgecast.syn-cdn.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-204531bf21da0cc79c50f98d", "src_port": 50142, "tcp_stream": 986, "udp_stream": null, "frame_number": 37135, "timestamp_epoch": "1533965226.489332000" }, { "kind": "tls_client_hello", "dst_ip": "104.254.150.77", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ib.adnxs.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-feb65798a3c1abf75e6de100", "src_port": 50143, "tcp_stream": 987, "udp_stream": null, "frame_number": 38599, "timestamp_epoch": "1533965234.479818000" }, { "kind": "tls_client_hello", "dst_ip": "104.254.150.77", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ib.adnxs.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-02cf2fe5297a31ccc522bc15", "src_port": 50144, "tcp_stream": 988, "udp_stream": null, "frame_number": 38601, "timestamp_epoch": "1533965234.479897000" }, { "kind": "tls_client_hello", "dst_ip": "34.213.12.32", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "vid-io.springserve.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-d52e914ad1432d42479d3d33", "src_port": 50145, "tcp_stream": 989, "udp_stream": null, "frame_number": 38643, "timestamp_epoch": "1533965235.986415000" }, { "kind": "tls_client_hello", "dst_ip": "74.125.195.154", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "bid.g.doubleclick.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-fd2574566ee62e2e6eef9493", "src_port": 50146, "tcp_stream": 994, "udp_stream": null, "frame_number": 38696, "timestamp_epoch": "1533965238.697191000" }, { "kind": "tls_client_hello", "dst_ip": "74.125.195.154", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "bid.g.doubleclick.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-70df1fe235bae8d38209726c", "src_port": 50147, "tcp_stream": 995, "udp_stream": null, "frame_number": 38698, "timestamp_epoch": "1533965238.697273000" }, { "kind": "tls_client_hello", "dst_ip": "52.24.61.237", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "rtr.innovid.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-152f60016689e742b7bbdce7", "src_port": 50148, "tcp_stream": 996, "udp_stream": null, "frame_number": 38738, "timestamp_epoch": "1533965239.228582000" }, { "kind": "tls_client_hello", "dst_ip": "52.24.61.237", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "rtr.innovid.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-dc740a9f3b1a534b420c271a", "src_port": 50149, "tcp_stream": 997, "udp_stream": null, "frame_number": 38739, "timestamp_epoch": "1533965239.228584000" }, { "kind": "tls_client_hello", "dst_ip": "18.218.6.11", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "s.innovid.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-d37649b35b5c1f963f12a908", "src_port": 50151, "tcp_stream": 999, "udp_stream": null, "frame_number": 38768, "timestamp_epoch": "1533965239.786732000" }, { "kind": "tls_client_hello", "dst_ip": "18.218.6.11", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "s.innovid.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-2cd9d80903cd411c100f2da2", "src_port": 50150, "tcp_stream": 998, "udp_stream": null, "frame_number": 38770, "timestamp_epoch": "1533965239.786944000" }, { "kind": "tls_client_hello", "dst_ip": "63.251.109.87", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "rtb0.doubleverify.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-e2ab238f19538e5ce6820e1d", "src_port": 50152, "tcp_stream": 1000, "udp_stream": null, "frame_number": 38774, "timestamp_epoch": "1533965239.837286000" }, { "kind": "tls_client_hello", "dst_ip": "63.251.109.87", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "rtb0.doubleverify.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-05183b882f030cc622c8e975", "src_port": 50153, "tcp_stream": 1001, "udp_stream": null, "frame_number": 38778, "timestamp_epoch": "1533965239.842811000" }, { "kind": "tls_client_hello", "dst_ip": "63.251.109.87", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tps700.doubleverify.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-5a2b2945c84cc1e51d9d1b17", "src_port": 50154, "tcp_stream": 1002, "udp_stream": null, "frame_number": 38818, "timestamp_epoch": "1533965240.283333000" }, { "kind": "tls_client_hello", "dst_ip": "63.251.109.87", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tps700.doubleverify.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-da08d3abad50b7278886c74f", "src_port": 50155, "tcp_stream": 1003, "udp_stream": null, "frame_number": 38824, "timestamp_epoch": "1533965240.296201000" }, { "kind": "tls_client_hello", "dst_ip": "63.251.109.87", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tps700.doubleverify.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-23c78dda572d25cb71bf1d5d", "src_port": 50156, "tcp_stream": 1004, "udp_stream": null, "frame_number": 38830, "timestamp_epoch": "1533965240.322685000" }, { "kind": "tls_client_hello", "dst_ip": "63.251.109.87", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tps700.doubleverify.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-37ce33a73341c83eaecf0813", "src_port": 50157, "tcp_stream": 1005, "udp_stream": null, "frame_number": 38850, "timestamp_epoch": "1533965240.367062000" }, { "kind": "tls_client_hello", "dst_ip": "52.33.44.132", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ag.innovid.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-aae8ee4419e8a4a7f6574138", "src_port": 50158, "tcp_stream": 1006, "udp_stream": null, "frame_number": 38861, "timestamp_epoch": "1533965240.375708000" }, { "kind": "tls_client_hello", "dst_ip": "52.33.44.132", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ag.innovid.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-ac4a3e10ad764bfd0c687b7a", "src_port": 50159, "tcp_stream": 1007, "udp_stream": null, "frame_number": 38864, "timestamp_epoch": "1533965240.375840000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.194.162", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "googleads.g.doubleclick.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-973eae82c7f1463f791dc941", "src_port": 50160, "tcp_stream": 1009, "udp_stream": null, "frame_number": 38925, "timestamp_epoch": "1533965240.537262000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.194.162", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "googleads.g.doubleclick.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-6c1bc01af948ea14d3a65c92", "src_port": 50161, "tcp_stream": 1010, "udp_stream": null, "frame_number": 38933, "timestamp_epoch": "1533965240.538141000" }, { "kind": "tls_client_hello", "dst_ip": "63.251.109.87", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tps700.doubleverify.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-a4aee6068dde62861a33e4ba", "src_port": 50162, "tcp_stream": 1011, "udp_stream": null, "frame_number": 38972, "timestamp_epoch": "1533965240.702883000" }, { "kind": "tls_client_hello", "dst_ip": "63.251.109.87", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tps700.doubleverify.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-408e30afd647c0f3a7a65ef1", "src_port": 50163, "tcp_stream": 1012, "udp_stream": null, "frame_number": 38974, "timestamp_epoch": "1533965240.703207000" }, { "kind": "tls_client_hello", "dst_ip": "23.54.20.74", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cdn.doubleverify.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-69428a506477a01f1eca2ecc", "src_port": 50166, "tcp_stream": 1014, "udp_stream": null, "frame_number": 38980, "timestamp_epoch": "1533965240.725595000" }, { "kind": "tls_client_hello", "dst_ip": "23.54.20.74", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cdn.doubleverify.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-cc06961ccaa1c5ceca4c7f7c", "src_port": 50165, "tcp_stream": 1015, "udp_stream": null, "frame_number": 38982, "timestamp_epoch": "1533965240.725799000" }, { "kind": "tls_client_hello", "dst_ip": "63.251.109.87", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tps700.doubleverify.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-5b7cff94c554715cb03fcc2f", "src_port": 50164, "tcp_stream": 1013, "udp_stream": null, "frame_number": 38986, "timestamp_epoch": "1533965240.732190000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.1", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tpc.googlesyndication.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-977349ea64f3b67155e38b9f", "src_port": 50167, "tcp_stream": 1016, "udp_stream": null, "frame_number": 39042, "timestamp_epoch": "1533965240.902415000" }, { "kind": "tls_client_hello", "dst_ip": "63.251.109.87", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tps700.doubleverify.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-455ff7a8bb8ea6b5800023f9", "src_port": 50169, "tcp_stream": 1018, "udp_stream": null, "frame_number": 39046, "timestamp_epoch": "1533965240.915990000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.1", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tpc.googlesyndication.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-f66538571cd36ca6e22ead69", "src_port": 50168, "tcp_stream": 1017, "udp_stream": null, "frame_number": 39050, "timestamp_epoch": "1533965240.916740000" }, { "kind": "tls_client_hello", "dst_ip": "63.251.109.87", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tps700.doubleverify.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-c308a6b8cc06ba543a7e32d6", "src_port": 50170, "tcp_stream": 1019, "udp_stream": null, "frame_number": 39090, "timestamp_epoch": "1533965241.033400000" }, { "kind": "tls_client_hello", "dst_ip": "63.251.109.87", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tps700.doubleverify.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-cbc789115ac60234431ecc4d", "src_port": 50171, "tcp_stream": 1020, "udp_stream": null, "frame_number": 39136, "timestamp_epoch": "1533965241.351114000" }, { "kind": "tls_client_hello", "dst_ip": "185.167.166.41", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "s2.adform.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-7702b1db6e58a05ce7c17406", "src_port": 50175, "tcp_stream": 1024, "udp_stream": null, "frame_number": 39169, "timestamp_epoch": "1533965245.870184000" }, { "kind": "tls_client_hello", "dst_ip": "185.167.166.41", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "s2.adform.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-a34a6d5c4e7369aed53ad889", "src_port": 50174, "tcp_stream": 1025, "udp_stream": null, "frame_number": 39173, "timestamp_epoch": "1533965245.872744000" }, { "kind": "tls_client_hello", "dst_ip": "136.243.25.70", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pp.lp4.io" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-c807927ae36360efaeb8c938", "src_port": 50172, "tcp_stream": 1022, "udp_stream": null, "frame_number": 39177, "timestamp_epoch": "1533965245.889150000" }, { "kind": "tls_client_hello", "dst_ip": "136.243.25.70", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pp.lp4.io" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-458cc4e7dba1be417f93b055", "src_port": 50173, "tcp_stream": 1023, "udp_stream": null, "frame_number": 39181, "timestamp_epoch": "1533965245.895481000" }, { "kind": "tls_client_hello", "dst_ip": "185.167.164.39", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "a1.adform.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-600dce30d85b373b25f4ddec", "src_port": 50176, "tcp_stream": 1026, "udp_stream": null, "frame_number": 39185, "timestamp_epoch": "1533965245.934643000" }, { "kind": "tls_client_hello", "dst_ip": "185.167.164.39", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "a1.adform.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-6c77dacf6c0cbc3ee272c95e", "src_port": 50177, "tcp_stream": 1027, "udp_stream": null, "frame_number": 39201, "timestamp_epoch": "1533965245.953287000" }, { "kind": "tls_client_hello", "dst_ip": "104.254.150.77", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "lax1-ib.adnxs.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-7d052acba3f15276236f282b", "src_port": 50179, "tcp_stream": 1029, "udp_stream": null, "frame_number": 39311, "timestamp_epoch": "1533965246.774368000" }, { "kind": "tls_client_hello", "dst_ip": "104.254.150.77", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "lax1-ib.adnxs.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-92611da22fd4a41c5a61408b", "src_port": 50178, "tcp_stream": 1028, "udp_stream": null, "frame_number": 39313, "timestamp_epoch": "1533965246.774457000" }, { "kind": "tls_client_hello", "dst_ip": "23.54.23.55", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "px.moatads.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-2609a8025993223c4d873bdf", "src_port": 50182, "tcp_stream": 1032, "udp_stream": null, "frame_number": 39345, "timestamp_epoch": "1533965247.222636000" }, { "kind": "tls_client_hello", "dst_ip": "23.54.23.55", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "px.moatads.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-d1f06099400ed5991d596f6d", "src_port": 50181, "tcp_stream": 1031, "udp_stream": null, "frame_number": 39348, "timestamp_epoch": "1533965247.223208000" }, { "kind": "tls_client_hello", "dst_ip": "136.243.42.249", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "stat.media" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-4f6a28afdc6664367c19fb3c", "src_port": 50180, "tcp_stream": 1030, "udp_stream": null, "frame_number": 39352, "timestamp_epoch": "1533965247.228409000" }, { "kind": "tls_client_hello", "dst_ip": "87.250.251.37", "fields": { "tls.handshake.ja3": "1d095e68489d3c535297cd8dffb06cb9", "tls.handshake.extensions_server_name": "pop.yandex.com" }, "src_ip": "192.168.1.95", "dst_port": 995, "event_id": "evt-6ad0acbaa565124f9c215dc9", "src_port": 50204, "tcp_stream": 1056, "udp_stream": null, "frame_number": 39818, "timestamp_epoch": "1533965567.875578000" }, { "kind": "tls_client_hello", "dst_ip": "93.158.134.38", "fields": { "tls.handshake.ja3": "1d095e68489d3c535297cd8dffb06cb9", "tls.handshake.extensions_server_name": "smtp.yandex.com" }, "src_ip": "192.168.1.95", "dst_port": 465, "event_id": "evt-a840ee76a41567b1c6e751c8", "src_port": 50207, "tcp_stream": 1059, "udp_stream": null, "frame_number": 39908, "timestamp_epoch": "1533965606.395386000" }, { "kind": "tls_client_hello", "dst_ip": "151.236.85.22", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "phototass1.cdnvideo.ru" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-9944c7a15fd1d9d6e82e6202", "src_port": 50227, "tcp_stream": 1079, "udp_stream": null, "frame_number": 40292, "timestamp_epoch": "1533965770.800076000" }, { "kind": "tls_client_hello", "dst_ip": "91.216.130.22", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cdn2.tass.ru" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-4a34818ed3677f4c5bf0715a", "src_port": 50232, "tcp_stream": 1084, "udp_stream": null, "frame_number": 40305, "timestamp_epoch": "1533965770.800734000" }, { "kind": "tls_client_hello", "dst_ip": "151.236.85.22", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "phototass1.cdnvideo.ru" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-ccf71c472ce4a6653cbb459a", "src_port": 50228, "tcp_stream": 1080, "udp_stream": null, "frame_number": 40306, "timestamp_epoch": "1533965770.800953000" }, { "kind": "tls_client_hello", "dst_ip": "151.236.85.22", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "phototass1.cdnvideo.ru" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-a0c612338575b159a3582043", "src_port": 50230, "tcp_stream": 1082, "udp_stream": null, "frame_number": 40309, "timestamp_epoch": "1533965770.801360000" }, { "kind": "tls_client_hello", "dst_ip": "151.236.85.22", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "phototass1.cdnvideo.ru" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-c4a00cc2eebf5c9aa36b5264", "src_port": 50229, "tcp_stream": 1081, "udp_stream": null, "frame_number": 40310, "timestamp_epoch": "1533965770.801362000" }, { "kind": "tls_client_hello", "dst_ip": "151.236.85.22", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "phototass1.cdnvideo.ru" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-e22b86dc0d4cd15ef769a5a9", "src_port": 50226, "tcp_stream": 1078, "udp_stream": null, "frame_number": 40312, "timestamp_epoch": "1533965770.801500000" }, { "kind": "tls_client_hello", "dst_ip": "151.236.85.22", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "phototass1.cdnvideo.ru" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-0b669f6fc53e03fe8c26c00e", "src_port": 50231, "tcp_stream": 1083, "udp_stream": null, "frame_number": 40315, "timestamp_epoch": "1533965770.802257000" }, { "kind": "tls_client_hello", "dst_ip": "91.216.130.22", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cdn2.tass.ru" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-d899949b9649bcca4d4ad4cc", "src_port": 50233, "tcp_stream": 1085, "udp_stream": null, "frame_number": 40317, "timestamp_epoch": "1533965770.802376000" }, { "kind": "tls_client_hello", "dst_ip": "91.216.130.22", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cdn2.tass.ru" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-23ee28b42f0f6fffe51eeae0", "src_port": 50234, "tcp_stream": 1086, "udp_stream": null, "frame_number": 40318, "timestamp_epoch": "1533965770.802377000" }, { "kind": "tls_client_hello", "dst_ip": "91.216.130.22", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cdn2.tass.ru" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-90515d168dba50b5b4541180", "src_port": 50236, "tcp_stream": 1088, "udp_stream": null, "frame_number": 40329, "timestamp_epoch": "1533965770.808469000" }, { "kind": "tls_client_hello", "dst_ip": "91.216.130.22", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cdn2.tass.ru" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-449cea7e92a34378f9bb1874", "src_port": 50237, "tcp_stream": 1089, "udp_stream": null, "frame_number": 40337, "timestamp_epoch": "1533965770.810276000" }, { "kind": "tls_client_hello", "dst_ip": "109.201.156.81", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "phototass2.cdnvideo.ru" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-fef996d0edc0fa12dfffe613", "src_port": 50261, "tcp_stream": 1113, "udp_stream": null, "frame_number": 40353, "timestamp_epoch": "1533965770.815158000" }, { "kind": "tls_client_hello", "dst_ip": "109.201.156.81", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "phototass2.cdnvideo.ru" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-47c43c843accb0a82ff1f8aa", "src_port": 50260, "tcp_stream": 1112, "udp_stream": null, "frame_number": 40364, "timestamp_epoch": "1533965770.816261000" }, { "kind": "tls_client_hello", "dst_ip": "151.236.120.42", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "phototass4.cdnvideo.ru" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-13a5b58eb69ac4780d1fc1b5", "src_port": 50238, "tcp_stream": 1090, "udp_stream": null, "frame_number": 40370, "timestamp_epoch": "1533965770.816625000" }, { "kind": "tls_client_hello", "dst_ip": "151.236.98.22", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "phototass3.cdnvideo.ru" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-c3a2123d9fce7fe51aa3e415", "src_port": 50240, "tcp_stream": 1092, "udp_stream": null, "frame_number": 40373, "timestamp_epoch": "1533965770.817168000" }, { "kind": "tls_client_hello", "dst_ip": "109.201.156.81", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "phototass2.cdnvideo.ru" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-66355423f2869b6ca3daf6cb", "src_port": 50257, "tcp_stream": 1109, "udp_stream": null, "frame_number": 40375, "timestamp_epoch": "1533965770.817366000" }, { "kind": "tls_client_hello", "dst_ip": "109.201.156.81", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "phototass2.cdnvideo.ru" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-9a56e879d6ad3957dfd3ae80", "src_port": 50256, "tcp_stream": 1108, "udp_stream": null, "frame_number": 40385, "timestamp_epoch": "1533965770.819837000" }, { "kind": "tls_client_hello", "dst_ip": "109.201.156.81", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "phototass2.cdnvideo.ru" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-9ae4f7e65a53548f2127c379", "src_port": 50259, "tcp_stream": 1111, "udp_stream": null, "frame_number": 40387, "timestamp_epoch": "1533965770.819971000" }, { "kind": "tls_client_hello", "dst_ip": "151.236.120.42", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "phototass4.cdnvideo.ru" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-3294a1eeb93ced9566ffeb2b", "src_port": 50241, "tcp_stream": 1093, "udp_stream": null, "frame_number": 40389, "timestamp_epoch": "1533965770.820237000" }, { "kind": "tls_client_hello", "dst_ip": "109.201.156.81", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "phototass2.cdnvideo.ru" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-8f7d0a5f914a613611fd8b11", "src_port": 50258, "tcp_stream": 1110, "udp_stream": null, "frame_number": 40395, "timestamp_epoch": "1533965770.822836000" }, { "kind": "tls_client_hello", "dst_ip": "91.216.130.22", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cdn2.tass.ru" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-e49d2029c2402a7cf5985a8b", "src_port": 50235, "tcp_stream": 1087, "udp_stream": null, "frame_number": 40405, "timestamp_epoch": "1533965770.823596000" }, { "kind": "tls_client_hello", "dst_ip": "151.236.98.22", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "phototass3.cdnvideo.ru" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-6b87582e61a954ae2936d2db", "src_port": 50239, "tcp_stream": 1091, "udp_stream": null, "frame_number": 40406, "timestamp_epoch": "1533965770.823673000" }, { "kind": "tls_client_hello", "dst_ip": "151.236.98.22", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "phototass3.cdnvideo.ru" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-f7e28ae7b4cb01441a93c637", "src_port": 50242, "tcp_stream": 1094, "udp_stream": null, "frame_number": 40409, "timestamp_epoch": "1533965770.823885000" }, { "kind": "tls_client_hello", "dst_ip": "151.236.120.42", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "phototass4.cdnvideo.ru" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-6cf5081b37ccd17eb677f2e2", "src_port": 50243, "tcp_stream": 1095, "udp_stream": null, "frame_number": 40415, "timestamp_epoch": "1533965770.825183000" }, { "kind": "tls_client_hello", "dst_ip": "151.236.120.42", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "phototass4.cdnvideo.ru" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-99044b2a45aa894bae090b73", "src_port": 50244, "tcp_stream": 1096, "udp_stream": null, "frame_number": 40417, "timestamp_epoch": "1533965770.825184000" }, { "kind": "tls_client_hello", "dst_ip": "91.216.130.21", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cdn1.tass.ru" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-ddc186dd71cb3bd2265a38b3", "src_port": 50245, "tcp_stream": 1097, "udp_stream": null, "frame_number": 40425, "timestamp_epoch": "1533965770.853120000" }, { "kind": "tls_client_hello", "dst_ip": "151.236.120.42", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "phototass4.cdnvideo.ru" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-2dd1c84b15d2f9758e58da78", "src_port": 50247, "tcp_stream": 1100, "udp_stream": null, "frame_number": 40426, "timestamp_epoch": "1533965770.853341000" }, { "kind": "tls_client_hello", "dst_ip": "151.236.98.22", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "phototass3.cdnvideo.ru" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-d4d5d1b31659524fb210b30e", "src_port": 50248, "tcp_stream": 1099, "udp_stream": null, "frame_number": 40428, "timestamp_epoch": "1533965770.853344000" }, { "kind": "tls_client_hello", "dst_ip": "151.236.120.42", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "phototass4.cdnvideo.ru" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-886641f24cd584b912da8fce", "src_port": 50249, "tcp_stream": 1102, "udp_stream": null, "frame_number": 40435, "timestamp_epoch": "1533965770.856913000" }, { "kind": "tls_client_hello", "dst_ip": "91.216.130.21", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cdn1.tass.ru" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-0d7301884087fbbdafbfca0e", "src_port": 50255, "tcp_stream": 1107, "udp_stream": null, "frame_number": 40437, "timestamp_epoch": "1533965770.856915000" }, { "kind": "tls_client_hello", "dst_ip": "151.236.98.22", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "phototass3.cdnvideo.ru" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-9d2d7d12b53a82f92e91b292", "src_port": 50251, "tcp_stream": 1103, "udp_stream": null, "frame_number": 40443, "timestamp_epoch": "1533965770.857708000" }, { "kind": "tls_client_hello", "dst_ip": "91.216.130.21", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cdn1.tass.ru" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-20169da24ef7010cb7241c67", "src_port": 50246, "tcp_stream": 1098, "udp_stream": null, "frame_number": 40445, "timestamp_epoch": "1533965770.857931000" }, { "kind": "tls_client_hello", "dst_ip": "91.216.130.21", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cdn1.tass.ru" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-be6f50992574c89557292ee6", "src_port": 50254, "tcp_stream": 1106, "udp_stream": null, "frame_number": 40449, "timestamp_epoch": "1533965770.860090000" }, { "kind": "tls_client_hello", "dst_ip": "91.216.130.21", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cdn1.tass.ru" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-c8e5b690a6bff578966d01c9", "src_port": 50252, "tcp_stream": 1105, "udp_stream": null, "frame_number": 40453, "timestamp_epoch": "1533965770.862012000" }, { "kind": "tls_client_hello", "dst_ip": "91.216.130.21", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cdn1.tass.ru" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-4811395f1dd66867ed0f117a", "src_port": 50250, "tcp_stream": 1101, "udp_stream": null, "frame_number": 40457, "timestamp_epoch": "1533965770.865615000" }, { "kind": "tls_client_hello", "dst_ip": "151.236.98.22", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "phototass3.cdnvideo.ru" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-7f65e9172f129e065dccac9f", "src_port": 50253, "tcp_stream": 1104, "udp_stream": null, "frame_number": 40461, "timestamp_epoch": "1533965770.869297000" }, { "kind": "tls_client_hello", "dst_ip": "151.236.85.22", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "phototass1.cdnvideo.ru" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-6fcbbb1534bd3dbeeb50586d", "src_port": 50265, "tcp_stream": 1114, "udp_stream": null, "frame_number": 40914, "timestamp_epoch": "1533965773.665198000" }, { "kind": "tls_client_hello", "dst_ip": "151.236.120.42", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "phototass4.cdnvideo.ru" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-8891e78beee343dbea2a6da5", "src_port": 50269, "tcp_stream": 1121, "udp_stream": null, "frame_number": 40953, "timestamp_epoch": "1533965773.747076000" }, { "kind": "tls_client_hello", "dst_ip": "91.216.130.22", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cdn2.tass.ru" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-940de797f6d75ffe656c181e", "src_port": 50263, "tcp_stream": 1118, "udp_stream": null, "frame_number": 40955, "timestamp_epoch": "1533965773.747177000" }, { "kind": "tls_client_hello", "dst_ip": "91.216.130.22", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cdn2.tass.ru" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-72fee0e2224eaf48e751b121", "src_port": 50264, "tcp_stream": 1115, "udp_stream": null, "frame_number": 40957, "timestamp_epoch": "1533965773.747380000" }, { "kind": "tls_client_hello", "dst_ip": "91.216.130.21", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cdn1.tass.ru" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-34a4b10c35e31a3a1b2acf9f", "src_port": 50262, "tcp_stream": 1116, "udp_stream": null, "frame_number": 40959, "timestamp_epoch": "1533965773.747726000" }, { "kind": "tls_client_hello", "dst_ip": "151.236.98.22", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "phototass3.cdnvideo.ru" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-5fa4267acd4b07c254e27e30", "src_port": 50266, "tcp_stream": 1117, "udp_stream": null, "frame_number": 40960, "timestamp_epoch": "1533965773.747852000" }, { "kind": "tls_client_hello", "dst_ip": "151.236.120.42", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "phototass4.cdnvideo.ru" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-23eafab99c9e4d1d3350d75e", "src_port": 50268, "tcp_stream": 1120, "udp_stream": null, "frame_number": 40963, "timestamp_epoch": "1533965773.747990000" }, { "kind": "tls_client_hello", "dst_ip": "151.236.98.22", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "phototass3.cdnvideo.ru" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-2877be767f08ac57023ed3c1", "src_port": 50267, "tcp_stream": 1119, "udp_stream": null, "frame_number": 40965, "timestamp_epoch": "1533965773.748243000" }, { "kind": "tls_client_hello", "dst_ip": "151.236.120.42", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "phototass4.cdnvideo.ru" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-9c066cd17eef5a603e57db40", "src_port": 50271, "tcp_stream": 1123, "udp_stream": null, "frame_number": 41110, "timestamp_epoch": "1533965774.062728000" }, { "kind": "tls_client_hello", "dst_ip": "151.236.120.42", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "phototass4.cdnvideo.ru" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-8ab051f2dd7d63ce57495e8f", "src_port": 50270, "tcp_stream": 1122, "udp_stream": null, "frame_number": 41124, "timestamp_epoch": "1533965774.074652000" }, { "kind": "tls_client_hello", "dst_ip": "151.236.98.22", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "phototass3.cdnvideo.ru" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-37559d6f9982bb5c43056526", "src_port": 50272, "tcp_stream": 1124, "udp_stream": null, "frame_number": 41160, "timestamp_epoch": "1533965772.399229000" }, { "kind": "tls_client_hello", "dst_ip": "91.216.130.22", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cdn2.tass.ru" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-35139c395e62e0451649176f", "src_port": 50273, "tcp_stream": 1125, "udp_stream": null, "frame_number": 41162, "timestamp_epoch": "1533965772.399571000" }, { "kind": "tls_client_hello", "dst_ip": "151.236.98.22", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "phototass3.cdnvideo.ru" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-8efab99de359b3cfe7a01b47", "src_port": 50274, "tcp_stream": 1126, "udp_stream": null, "frame_number": 41164, "timestamp_epoch": "1533965772.399573000" }, { "kind": "tls_client_hello", "dst_ip": "151.236.98.22", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "phototass3.cdnvideo.ru" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-14783d3552e07832cdb2465a", "src_port": 50276, "tcp_stream": 1127, "udp_stream": null, "frame_number": 41306, "timestamp_epoch": "1533965772.815075000" }, { "kind": "tls_client_hello", "dst_ip": "151.236.120.42", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "phototass4.cdnvideo.ru" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-ab4ee494108b83ba4c6911ff", "src_port": 50277, "tcp_stream": 1128, "udp_stream": null, "frame_number": 41308, "timestamp_epoch": "1533965772.815243000" }, { "kind": "tls_client_hello", "dst_ip": "151.236.120.42", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "phototass4.cdnvideo.ru" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-cd852cd358654336db01b45e", "src_port": 50275, "tcp_stream": 1129, "udp_stream": null, "frame_number": 41316, "timestamp_epoch": "1533965772.824220000" }, { "kind": "tls_client_hello", "dst_ip": "93.158.134.90", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "an.yandex.ru" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-effe482b643ff0071d371e73", "src_port": 50290, "tcp_stream": 1142, "udp_stream": null, "frame_number": 43734, "timestamp_epoch": "1533965783.300133000" }, { "kind": "tls_client_hello", "dst_ip": "93.158.134.90", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "an.yandex.ru" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-01e5087e2b5ab1eea1415024", "src_port": 50289, "tcp_stream": 1141, "udp_stream": null, "frame_number": 43738, "timestamp_epoch": "1533965783.307821000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.194.162", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "adservice.google.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-b0da15f66fd8fa5fe52b4ee2", "src_port": 50304, "tcp_stream": 1156, "udp_stream": null, "frame_number": 43919, "timestamp_epoch": "1533965783.792386000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.194.162", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "adservice.google.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-b05cb69b477512ccd71f0afe", "src_port": 50303, "tcp_stream": 1155, "udp_stream": null, "frame_number": 43925, "timestamp_epoch": "1533965783.794083000" }, { "kind": "tls_client_hello", "dst_ip": "93.158.134.119", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "mc.yandex.ru" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-97fcb27d01355687f161f6bf", "src_port": 50301, "tcp_stream": 1153, "udp_stream": null, "frame_number": 43935, "timestamp_epoch": "1533965783.795303000" }, { "kind": "tls_client_hello", "dst_ip": "93.158.134.119", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "mc.yandex.ru" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-96262b7acf180cd8e3c802e9", "src_port": 50302, "tcp_stream": 1154, "udp_stream": null, "frame_number": 43937, "timestamp_epoch": "1533965783.795464000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.2", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "securepubads.g.doubleclick.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-26e648c79c0dd8c754d4a16d", "src_port": 50310, "tcp_stream": 1162, "udp_stream": null, "frame_number": 44040, "timestamp_epoch": "1533965784.020377000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.2", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "securepubads.g.doubleclick.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-09475c136f5fabe7c63a6383", "src_port": 50307, "tcp_stream": 1159, "udp_stream": null, "frame_number": 44058, "timestamp_epoch": "1533965784.025460000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.2", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "securepubads.g.doubleclick.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-999008e10241096b9422539b", "src_port": 50306, "tcp_stream": 1158, "udp_stream": null, "frame_number": 44060, "timestamp_epoch": "1533965784.025677000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.2", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "securepubads.g.doubleclick.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-d43c80a4fb7289437eaf2706", "src_port": 50305, "tcp_stream": 1157, "udp_stream": null, "frame_number": 44061, "timestamp_epoch": "1533965784.025785000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.2", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "securepubads.g.doubleclick.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-50265ed9adc4ef2bfd44bddc", "src_port": 50309, "tcp_stream": 1161, "udp_stream": null, "frame_number": 44063, "timestamp_epoch": "1533965784.025864000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.2", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "securepubads.g.doubleclick.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-ddb07c0ae8032921315bbf63", "src_port": 50308, "tcp_stream": 1160, "udp_stream": null, "frame_number": 44065, "timestamp_epoch": "1533965784.025952000" }, { "kind": "tls_client_hello", "dst_ip": "192.229.163.25", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "platform.twitter.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-d190b6ac54db712f1e520656", "src_port": 50311, "tcp_stream": 1163, "udp_stream": null, "frame_number": 44150, "timestamp_epoch": "1533965784.337315000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.2", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "securepubads.g.doubleclick.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-b27d7bfaf23c97bf401580c3", "src_port": 50312, "tcp_stream": 1164, "udp_stream": null, "frame_number": 44265, "timestamp_epoch": "1533965784.616928000" }, { "kind": "tls_client_hello", "dst_ip": "157.240.11.22", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "staticxx.facebook.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-611ae8c661fa3340643035e9", "src_port": 50316, "tcp_stream": 1168, "udp_stream": null, "frame_number": 44338, "timestamp_epoch": "1533965784.993306000" }, { "kind": "tls_client_hello", "dst_ip": "157.240.11.22", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "staticxx.facebook.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-8f5aa9cc21cf6fcba5dd2cdc", "src_port": 50317, "tcp_stream": 1169, "udp_stream": null, "frame_number": 44341, "timestamp_epoch": "1533965784.994092000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.14", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "www.google-analytics.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-9f5088468c3c9b8b123eec88", "src_port": 50320, "tcp_stream": 1172, "udp_stream": null, "frame_number": 44348, "timestamp_epoch": "1533965785.003892000" }, { "kind": "tls_client_hello", "dst_ip": "142.93.61.37", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cdn.onthe.io" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-dea958f8db91e9d1128d22dd", "src_port": 50315, "tcp_stream": 1167, "udp_stream": null, "frame_number": 44352, "timestamp_epoch": "1533965785.008624000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.14", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "www.youtube.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-2d2ea1fc78ee2b14a1335f0a", "src_port": 50322, "tcp_stream": 1174, "udp_stream": null, "frame_number": 44356, "timestamp_epoch": "1533965785.009008000" }, { "kind": "tls_client_hello", "dst_ip": "142.93.61.37", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cdn.onthe.io" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-6363840516f66fb89c5b6849", "src_port": 50318, "tcp_stream": 1170, "udp_stream": null, "frame_number": 44364, "timestamp_epoch": "1533965785.009620000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.14", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "www.youtube.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-b3fa3418fc301cee5f1e8776", "src_port": 50319, "tcp_stream": 1173, "udp_stream": null, "frame_number": 44366, "timestamp_epoch": "1533965785.009849000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.14", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "www.google-analytics.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-c2fb4ff6ee968fdd2db91594", "src_port": 50321, "tcp_stream": 1171, "udp_stream": null, "frame_number": 44368, "timestamp_epoch": "1533965785.010072000" }, { "kind": "tls_client_hello", "dst_ip": "199.59.149.201", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "syndication.twitter.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-cba0aabdcdfc27941a0083f0", "src_port": 50324, "tcp_stream": 1176, "udp_stream": null, "frame_number": 44622, "timestamp_epoch": "1533965785.932997000" }, { "kind": "tls_client_hello", "dst_ip": "199.59.149.201", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "syndication.twitter.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-6b90b85ba6d3e235a1f1a473", "src_port": 50323, "tcp_stream": 1175, "udp_stream": null, "frame_number": 44626, "timestamp_epoch": "1533965785.935461000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.1", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tpc.googlesyndication.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-e3dcfe18a0b163bb0555f6bf", "src_port": 50327, "tcp_stream": 1179, "udp_stream": null, "frame_number": 44710, "timestamp_epoch": "1533965786.046910000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.1", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tpc.googlesyndication.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-bca4d893fd921f3d107ce32b", "src_port": 50325, "tcp_stream": 1177, "udp_stream": null, "frame_number": 44716, "timestamp_epoch": "1533965786.047696000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.1", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tpc.googlesyndication.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-be774dd0c43026a596d04083", "src_port": 50326, "tcp_stream": 1178, "udp_stream": null, "frame_number": 44718, "timestamp_epoch": "1533965786.047800000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.1", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tpc.googlesyndication.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-0aac068ea285632fa6f83c47", "src_port": 50333, "tcp_stream": 1185, "udp_stream": null, "frame_number": 44726, "timestamp_epoch": "1533965786.084904000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.1", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tpc.googlesyndication.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-df279ffee316ef1f8f03f90d", "src_port": 50332, "tcp_stream": 1184, "udp_stream": null, "frame_number": 44730, "timestamp_epoch": "1533965786.085797000" }, { "kind": "tls_client_hello", "dst_ip": "151.236.120.42", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "phototass4.cdnvideo.ru" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-dde8b89914ed8fca5e2890c3", "src_port": 50328, "tcp_stream": 1180, "udp_stream": null, "frame_number": 44814, "timestamp_epoch": "1533965786.361271000" }, { "kind": "tls_client_hello", "dst_ip": "151.236.98.22", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "phototass3.cdnvideo.ru" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-08fdcd3c6fb6020c3d70085f", "src_port": 50330, "tcp_stream": 1182, "udp_stream": null, "frame_number": 44816, "timestamp_epoch": "1533965786.361520000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.1", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tpc.googlesyndication.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-463966351ee677a40d64f107", "src_port": 50337, "tcp_stream": 1189, "udp_stream": null, "frame_number": 44818, "timestamp_epoch": "1533965786.361740000" }, { "kind": "tls_client_hello", "dst_ip": "151.236.98.22", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "phototass3.cdnvideo.ru" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-216605ef57dc9d56de1d2cd4", "src_port": 50331, "tcp_stream": 1183, "udp_stream": null, "frame_number": 44820, "timestamp_epoch": "1533965786.361841000" }, { "kind": "tls_client_hello", "dst_ip": "151.236.120.42", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "phototass4.cdnvideo.ru" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-7ab739fba762af5b7efe96ea", "src_port": 50329, "tcp_stream": 1181, "udp_stream": null, "frame_number": 44822, "timestamp_epoch": "1533965786.362580000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.14", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "www.google-analytics.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-d140da7f174f69944a4ff5dc", "src_port": 50340, "tcp_stream": 1192, "udp_stream": null, "frame_number": 45082, "timestamp_epoch": "1533965786.819879000" }, { "kind": "tls_client_hello", "dst_ip": "74.125.195.155", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "stats.g.doubleclick.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-3e047fedec1b090c1c25f2e0", "src_port": 50341, "tcp_stream": 1193, "udp_stream": null, "frame_number": 45285, "timestamp_epoch": "1533965787.316948000" }, { "kind": "tls_client_hello", "dst_ip": "74.125.195.155", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "stats.g.doubleclick.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-40cfefb52fe2c604b2ae3974", "src_port": 50342, "tcp_stream": 1194, "udp_stream": null, "frame_number": 45288, "timestamp_epoch": "1533965787.317460000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.14", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "s.ytimg.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-1ea8b5d0d3ab3630cd5ce767", "src_port": 50343, "tcp_stream": 1195, "udp_stream": null, "frame_number": 45296, "timestamp_epoch": "1533965787.326751000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.14", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "s.ytimg.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-dc6e4c3ad2894442d8200265", "src_port": 50344, "tcp_stream": 1196, "udp_stream": null, "frame_number": 45308, "timestamp_epoch": "1533965787.331292000" }, { "kind": "tls_client_hello", "dst_ip": "74.125.195.155", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "stats.g.doubleclick.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-fef130b2986f57dde7b1166f", "src_port": 50347, "tcp_stream": 1199, "udp_stream": null, "frame_number": 45475, "timestamp_epoch": "1533965787.976322000" }, { "kind": "tls_client_hello", "dst_ip": "136.243.151.13", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tt.onthe.io" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-3cd33b7105682de1d5432092", "src_port": 50348, "tcp_stream": 1201, "udp_stream": null, "frame_number": 45586, "timestamp_epoch": "1533965788.247122000" }, { "kind": "tls_client_hello", "dst_ip": "136.243.151.13", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tt.onthe.io" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-1f1a98520e3972597417caa4", "src_port": 50349, "tcp_stream": 1200, "udp_stream": null, "frame_number": 45594, "timestamp_epoch": "1533965788.250586000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.194.162", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pagead2.googlesyndication.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-2d425e48804be5d3e7c99a86", "src_port": 50350, "tcp_stream": 1202, "udp_stream": null, "frame_number": 45662, "timestamp_epoch": "1533965788.445447000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.194.162", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pagead2.googlesyndication.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-322f72243afdcd32a298776f", "src_port": 50351, "tcp_stream": 1203, "udp_stream": null, "frame_number": 45828, "timestamp_epoch": "1533965789.057761000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.194.162", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pagead2.googlesyndication.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-3795dda3bf3da8be6126b140", "src_port": 50352, "tcp_stream": 1204, "udp_stream": null, "frame_number": 45833, "timestamp_epoch": "1533965789.082723000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.194.162", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "googleads.g.doubleclick.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-81831c1d0cbf659eca9255e9", "src_port": 50354, "tcp_stream": 1206, "udp_stream": null, "frame_number": 45901, "timestamp_epoch": "1533965789.195222000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.194.162", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "googleads.g.doubleclick.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-e3714f26cf0766e737fc51f6", "src_port": 50353, "tcp_stream": 1205, "udp_stream": null, "frame_number": 45903, "timestamp_epoch": "1533965789.195689000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.194.162", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pagead2.googlesyndication.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-a36e67b85f38d01f6d388539", "src_port": 50357, "tcp_stream": 1209, "udp_stream": null, "frame_number": 45920, "timestamp_epoch": "1533965789.225632000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.4", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "www.google.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-6cf9e7dd41962abe8cddb216", "src_port": 50358, "tcp_stream": 1210, "udp_stream": null, "frame_number": 45939, "timestamp_epoch": "1533965789.321805000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.6.66", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cm.g.doubleclick.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-496cc4b43cd7a6ff987fa3fa", "src_port": 50359, "tcp_stream": 1211, "udp_stream": null, "frame_number": 46067, "timestamp_epoch": "1533965789.689201000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.6.66", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cm.g.doubleclick.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-0b4fb9474c60e31ce94fb098", "src_port": 50360, "tcp_stream": 1212, "udp_stream": null, "frame_number": 46069, "timestamp_epoch": "1533965789.689556000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.6.66", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cm.g.doubleclick.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-16be60f8130a9c9f9bec35a9", "src_port": 50361, "tcp_stream": 1213, "udp_stream": null, "frame_number": 46073, "timestamp_epoch": "1533965789.693703000" }, { "kind": "tls_client_hello", "dst_ip": "74.6.34.27", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pr-bh.ybp.yahoo.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-99b864226001a2d2a24f97ee", "src_port": 50363, "tcp_stream": 1215, "udp_stream": null, "frame_number": 46091, "timestamp_epoch": "1533965789.730636000" }, { "kind": "tls_client_hello", "dst_ip": "74.6.34.27", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pr-bh.ybp.yahoo.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-72f0581743f8b3311ba6cb8c", "src_port": 50362, "tcp_stream": 1214, "udp_stream": null, "frame_number": 46092, "timestamp_epoch": "1533965789.730637000" }, { "kind": "tls_client_hello", "dst_ip": "23.108.108.218", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "px.adhigh.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-8c4a69e2c38dd639f15df1da", "src_port": 50367, "tcp_stream": 1218, "udp_stream": null, "frame_number": 46103, "timestamp_epoch": "1533965789.758127000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.4", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "www.google.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-717ba06822d600018eb26294", "src_port": 50365, "tcp_stream": 1217, "udp_stream": null, "frame_number": 46105, "timestamp_epoch": "1533965789.758615000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.4", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "www.google.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-6061ae2f10f3b4f95f6b0ca1", "src_port": 50364, "tcp_stream": 1216, "udp_stream": null, "frame_number": 46107, "timestamp_epoch": "1533965789.759079000" }, { "kind": "tls_client_hello", "dst_ip": "23.108.108.218", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "px.adhigh.net" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-9aae98c56245b2014f07fd03", "src_port": 50366, "tcp_stream": 1219, "udp_stream": null, "frame_number": 46108, "timestamp_epoch": "1533965789.759136000" }, { "kind": "tls_client_hello", "dst_ip": "52.9.78.114", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "magnetic.t.domdex.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-cefd2415e946b350bcf5ae84", "src_port": 50368, "tcp_stream": 1220, "udp_stream": null, "frame_number": 46125, "timestamp_epoch": "1533965789.789220000" }, { "kind": "tls_client_hello", "dst_ip": "52.9.78.114", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "magnetic.t.domdex.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-6d1aa65e57d14ed228a2c49b", "src_port": 50369, "tcp_stream": 1221, "udp_stream": null, "frame_number": 46126, "timestamp_epoch": "1533965789.789332000" }, { "kind": "tls_client_hello", "dst_ip": "109.201.156.81", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "phototass2.cdnvideo.ru" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-a9dc7ceec3cf5e8bd18302fd", "src_port": 50370, "tcp_stream": 1222, "udp_stream": null, "frame_number": 46510, "timestamp_epoch": "1533965791.526188000" }, { "kind": "tls_client_hello", "dst_ip": "109.201.156.81", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "phototass2.cdnvideo.ru" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-0dd8e70115bcfe3854fcae52", "src_port": 50371, "tcp_stream": 1223, "udp_stream": null, "frame_number": 46514, "timestamp_epoch": "1533965791.527564000" }, { "kind": "tls_client_hello", "dst_ip": "151.236.85.22", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "phototass1.cdnvideo.ru" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-d804b4f273513d0f2e8400db", "src_port": 50373, "tcp_stream": 1225, "udp_stream": null, "frame_number": 46559, "timestamp_epoch": "1533965791.712865000" }, { "kind": "tls_client_hello", "dst_ip": "151.236.85.22", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "phototass1.cdnvideo.ru" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-d3cf6e16f4f11b17c85801a7", "src_port": 50372, "tcp_stream": 1224, "udp_stream": null, "frame_number": 46560, "timestamp_epoch": "1533965791.712866000" }, { "kind": "tls_client_hello", "dst_ip": "185.99.9.117", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "relap.io" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-0d8f158d15bd7b5bf9961ffb", "src_port": 50374, "tcp_stream": 1226, "udp_stream": null, "frame_number": 46565, "timestamp_epoch": "1533965791.718122000" }, { "kind": "tls_client_hello", "dst_ip": "185.99.9.117", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "relap.io" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-0ad43654100af9561444ff09", "src_port": 50375, "tcp_stream": 1227, "udp_stream": null, "frame_number": 46571, "timestamp_epoch": "1533965791.730140000" }, { "kind": "tls_client_hello", "dst_ip": "72.21.81.200", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "iecvlist.microsoft.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-1811d5985935e17e28b81ea7", "src_port": 50377, "tcp_stream": 1230, "udp_stream": null, "frame_number": 46926, "timestamp_epoch": "1533965798.889723000" }, { "kind": "tls_client_hello", "dst_ip": "72.21.81.200", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "iecvlist.microsoft.com" }, "src_ip": "192.168.1.95", "dst_port": 443, "event_id": "evt-e864097418faa7b975ae1a24", "src_port": 50378, "tcp_stream": 1229, "udp_stream": null, "frame_number": 46927, "timestamp_epoch": "1533965798.889852000" } ], "unclassified_tcp": [], "directory_service": [ { "kind": "directory_service", "dst_ip": "192.168.1.6", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-a4c79e3ec733e9b9bdc9a86b", "src_port": null, "tcp_stream": 5, "udp_stream": null, "frame_number": 83, "timestamp_epoch": "1533964509.288970000" }, { "kind": "directory_service", "dst_ip": "192.168.1.95", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-09c393afa58b5882bdee8771", "src_port": null, "tcp_stream": 5, "udp_stream": null, "frame_number": 84, "timestamp_epoch": "1533964509.289255000" }, { "kind": "directory_service", "dst_ip": "192.168.1.6", "fields": { "ldap.protocolOp": "0" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-b8497f24f13c1b69cb4b4899", "src_port": null, "tcp_stream": 5, "udp_stream": null, "frame_number": 96, "timestamp_epoch": "1533964509.292603000" }, { "kind": "directory_service", "dst_ip": "192.168.1.95", "fields": { "ldap.protocolOp": "1" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-ebaa52a80c3084a98fb9f967", "src_port": null, "tcp_stream": 5, "udp_stream": null, "frame_number": 98, "timestamp_epoch": "1533964509.293214000" }, { "kind": "directory_service", "dst_ip": "192.168.1.6", "fields": { "ldap.protocolOp": "2" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-00d015fd154950e172af6a1b", "src_port": null, "tcp_stream": 5, "udp_stream": null, "frame_number": 99, "timestamp_epoch": "1533964509.295044000" }, { "kind": "directory_service", "dst_ip": "192.168.1.6", "fields": { "drsuapi.opnum": "0" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-9671321ad1606786e64f47ae", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 165, "timestamp_epoch": "1533964509.620535000" }, { "kind": "directory_service", "dst_ip": "192.168.1.95", "fields": { "drsuapi.opnum": "0" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-1084db0b67daeec05c4325d8", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 166, "timestamp_epoch": "1533964509.620754000" }, { "kind": "directory_service", "dst_ip": "192.168.1.6", "fields": { "drsuapi.opnum": "12" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-6b780dc584652afa1e224356", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 167, "timestamp_epoch": "1533964509.620952000" }, { "kind": "directory_service", "dst_ip": "192.168.1.95", "fields": { "drsuapi.opnum": "12" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-90ed019c45d02097198498bc", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 168, "timestamp_epoch": "1533964509.621271000" }, { "kind": "directory_service", "dst_ip": "192.168.1.6", "fields": { "drsuapi.opnum": "12" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-3b1b8bfaca34f3fe09bdb253", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 169, "timestamp_epoch": "1533964509.621511000" }, { "kind": "directory_service", "dst_ip": "192.168.1.95", "fields": { "drsuapi.opnum": "12" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-693acba8038ee825859dc747", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 170, "timestamp_epoch": "1533964509.621780000" }, { "kind": "directory_service", "dst_ip": "192.168.1.6", "fields": { "drsuapi.opnum": "1" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-cdedf06d3b6390f6605f4466", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 171, "timestamp_epoch": "1533964509.622050000" }, { "kind": "directory_service", "dst_ip": "192.168.1.95", "fields": { "drsuapi.opnum": "1" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-bb4efe316c0be416877a0f94", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 172, "timestamp_epoch": "1533964509.622205000" }, { "kind": "directory_service", "dst_ip": "192.168.1.6", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-b7b42ea109e52ae8e451796c", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 186, "timestamp_epoch": "1533964510.593774000" }, { "kind": "directory_service", "dst_ip": "192.168.1.95", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-58bc25372df795264adbd74f", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 187, "timestamp_epoch": "1533964510.594193000" }, { "kind": "directory_service", "dst_ip": "192.168.1.6", "fields": { "ldap.protocolOp": "0" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-e9bdfa6c161f3e68f1c5dc15", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 189, "timestamp_epoch": "1533964510.595028000" }, { "kind": "directory_service", "dst_ip": "192.168.1.95", "fields": { "ldap.protocolOp": "1" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-89105e80a51d798946b2b72c", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 191, "timestamp_epoch": "1533964510.595761000" }, { "kind": "directory_service", "dst_ip": "192.168.1.6", "fields": { "ldap.filter": "1", "ldap.baseObject": "DC=sputnikhouse,DC=org", "ldap.protocolOp": "3" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-4d28a106c01b777c08077a27", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 202, "timestamp_epoch": "1533964510.605118000" }, { "kind": "directory_service", "dst_ip": "192.168.1.95", "fields": { "ldap.protocolOp": "4,19,19,19,5" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-3b8ae9814d0f4b6719c4d148", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 203, "timestamp_epoch": "1533964510.605457000" }, { "kind": "directory_service", "dst_ip": "192.168.1.6", "fields": { "ldap.protocolOp": "0" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-bc8082852c0582a36b9cc971", "src_port": null, "tcp_stream": 16, "udp_stream": null, "frame_number": 223, "timestamp_epoch": "1533964510.609304000" }, { "kind": "directory_service", "dst_ip": "192.168.1.95", "fields": { "ldap.protocolOp": "1" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-8a49644ccd0ae71699a89b85", "src_port": null, "tcp_stream": 16, "udp_stream": null, "frame_number": 228, "timestamp_epoch": "1533964510.610220000" }, { "kind": "directory_service", "dst_ip": "192.168.1.6", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-17bb1b61b9a7c1127ef8d424", "src_port": null, "tcp_stream": 16, "udp_stream": null, "frame_number": 229, "timestamp_epoch": "1533964510.610678000" }, { "kind": "directory_service", "dst_ip": "192.168.1.95", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-089142847aa032b2beb30952", "src_port": null, "tcp_stream": 16, "udp_stream": null, "frame_number": 230, "timestamp_epoch": "1533964510.610839000" }, { "kind": "directory_service", "dst_ip": "192.168.1.6", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=sputnikhouse,DC=org", "ldap.protocolOp": "3" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-1ebce7498ea8a3577a2bc979", "src_port": null, "tcp_stream": 16, "udp_stream": null, "frame_number": 231, "timestamp_epoch": "1533964510.611062000" }, { "kind": "directory_service", "dst_ip": "192.168.1.95", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-6a1599060782b73ad4fce407", "src_port": null, "tcp_stream": 16, "udp_stream": null, "frame_number": 232, "timestamp_epoch": "1533964510.611281000" }, { "kind": "directory_service", "dst_ip": "192.168.1.6", "fields": { "ldap.filter": "1", "ldap.baseObject": "cn=policies,cn=system,DC=sputnikhouse,DC=org", "ldap.protocolOp": "3" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-9fcc48832e532851f07ff423", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 233, "timestamp_epoch": "1533964510.611544000" }, { "kind": "directory_service", "dst_ip": "192.168.1.95", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-e223db1b219a7e70fc4a826d", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 234, "timestamp_epoch": "1533964510.611824000" }, { "kind": "directory_service", "dst_ip": "192.168.1.6", "fields": { "ldap.protocolOp": "2" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-b22a27a1a8a7158fb1a01612", "src_port": null, "tcp_stream": 16, "udp_stream": null, "frame_number": 276, "timestamp_epoch": "1533964510.622861000" }, { "kind": "directory_service", "dst_ip": "192.168.1.6", "fields": { "ldap.protocolOp": "2" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-0bb107ceabde4263df00f695", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 280, "timestamp_epoch": "1533964511.138137000" }, { "kind": "directory_service", "dst_ip": "192.168.1.6", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-62c9cc784590b6b3732dd671", "src_port": null, "tcp_stream": 21, "udp_stream": null, "frame_number": 317, "timestamp_epoch": "1533964517.004734000" }, { "kind": "directory_service", "dst_ip": "192.168.1.95", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-85ea6357c64498ebfed5bd65", "src_port": null, "tcp_stream": 21, "udp_stream": null, "frame_number": 318, "timestamp_epoch": "1533964517.005160000" }, { "kind": "directory_service", "dst_ip": "192.168.1.6", "fields": { "ldap.protocolOp": "0" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-f3729f8694b02afefd12f77d", "src_port": null, "tcp_stream": 21, "udp_stream": null, "frame_number": 320, "timestamp_epoch": "1533964517.006592000" }, { "kind": "directory_service", "dst_ip": "192.168.1.95", "fields": { "ldap.protocolOp": "1" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-41ad9db66424e487355f3fff", "src_port": null, "tcp_stream": 21, "udp_stream": null, "frame_number": 322, "timestamp_epoch": "1533964517.007228000" }, { "kind": "directory_service", "dst_ip": "192.168.1.6", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-cdf1c6ede237fd96a0c2f8e8", "src_port": null, "tcp_stream": 21, "udp_stream": null, "frame_number": 323, "timestamp_epoch": "1533964517.008621000" }, { "kind": "directory_service", "dst_ip": "192.168.1.95", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-7e64128429313feb2f030ac3", "src_port": null, "tcp_stream": 21, "udp_stream": null, "frame_number": 324, "timestamp_epoch": "1533964517.008777000" }, { "kind": "directory_service", "dst_ip": "192.168.1.6", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-e9863b4786157aa07bf5ed8f", "src_port": null, "tcp_stream": 21, "udp_stream": null, "frame_number": 325, "timestamp_epoch": "1533964517.009167000" }, { "kind": "directory_service", "dst_ip": "192.168.1.95", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-76b31e2ff055c4ef9c1456e1", "src_port": null, "tcp_stream": 21, "udp_stream": null, "frame_number": 326, "timestamp_epoch": "1533964517.009323000" }, { "kind": "directory_service", "dst_ip": "192.168.1.6", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=NTDS Settings,CN=SPUTNIKHOUSE-DC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=sputnikhouse,DC=org", "ldap.protocolOp": "3" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-18a13978b300ffcf1a019184", "src_port": null, "tcp_stream": 21, "udp_stream": null, "frame_number": 327, "timestamp_epoch": "1533964517.009497000" }, { "kind": "directory_service", "dst_ip": "192.168.1.95", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-0cde21a43ebc782eaaa5830b", "src_port": null, "tcp_stream": 21, "udp_stream": null, "frame_number": 328, "timestamp_epoch": "1533964517.009686000" }, { "kind": "directory_service", "dst_ip": "192.168.1.6", "fields": { "ldap.filter": "3", "ldap.baseObject": "CN=Public Key Services,CN=Services,CN=Configuration,DC=sputnikhouse,DC=org", "ldap.protocolOp": "3" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-7cfed8c6fe87835f023d00b0", "src_port": null, "tcp_stream": 21, "udp_stream": null, "frame_number": 329, "timestamp_epoch": "1533964517.009929000" }, { "kind": "directory_service", "dst_ip": "192.168.1.95", "fields": { "ldap.protocolOp": "5" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-640348f87e30f792cc6d3e94", "src_port": null, "tcp_stream": 21, "udp_stream": null, "frame_number": 330, "timestamp_epoch": "1533964517.010757000" }, { "kind": "directory_service", "dst_ip": "192.168.1.6", "fields": { "ldap.protocolOp": "0" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-b6dfb5a7607f2f1d7cb1f71c", "src_port": null, "tcp_stream": 22, "udp_stream": null, "frame_number": 336, "timestamp_epoch": "1533964517.021374000" }, { "kind": "directory_service", "dst_ip": "192.168.1.95", "fields": { "ldap.protocolOp": "1" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-4f07d80cc0d48bd433d62a18", "src_port": null, "tcp_stream": 22, "udp_stream": null, "frame_number": 338, "timestamp_epoch": "1533964517.021989000" }, { "kind": "directory_service", "dst_ip": "192.168.1.6", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-95c0bf94343881bcdbe520bc", "src_port": null, "tcp_stream": 22, "udp_stream": null, "frame_number": 339, "timestamp_epoch": "1533964517.022382000" }, { "kind": "directory_service", "dst_ip": "192.168.1.95", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-f861cc9cae35357bae89f4af", "src_port": null, "tcp_stream": 22, "udp_stream": null, "frame_number": 340, "timestamp_epoch": "1533964517.022558000" }, { "kind": "directory_service", "dst_ip": "192.168.1.6", "fields": { "ldap.filter": "3", "ldap.baseObject": "CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=sputnikhouse,DC=org", "ldap.protocolOp": "3" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-32adb834ef6a97a970482280", "src_port": null, "tcp_stream": 22, "udp_stream": null, "frame_number": 368, "timestamp_epoch": "1533964517.045974000" }, { "kind": "directory_service", "dst_ip": "192.168.1.95", "fields": { "ldap.protocolOp": "5" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-c12c8d0aab6038fe1723bd30", "src_port": null, "tcp_stream": 22, "udp_stream": null, "frame_number": 369, "timestamp_epoch": "1533964517.046764000" }, { "kind": "directory_service", "dst_ip": "192.168.1.6", "fields": { "ldap.protocolOp": "2" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-7b95ddb6e54aa07787d53f1a", "src_port": null, "tcp_stream": 22, "udp_stream": null, "frame_number": 370, "timestamp_epoch": "1533964517.047019000" }, { "kind": "directory_service", "dst_ip": "192.168.1.6", "fields": { "ldap.protocolOp": "2" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-f0e03e1b4d51f29743701ebe", "src_port": null, "tcp_stream": 21, "udp_stream": null, "frame_number": 372, "timestamp_epoch": "1533964517.047598000" }, { "kind": "directory_service", "dst_ip": "192.168.1.6", "fields": { "drsuapi.opnum": "0" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-a3881e80cfb59a08eb8ce91a", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 444, "timestamp_epoch": "1533964528.985245000" }, { "kind": "directory_service", "dst_ip": "192.168.1.95", "fields": { "drsuapi.opnum": "0" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-e3ccf7dbedf2a1f300fb2053", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 445, "timestamp_epoch": "1533964528.985479000" }, { "kind": "directory_service", "dst_ip": "192.168.1.6", "fields": { "drsuapi.opnum": "12" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-306cfcfba4b12059b4d61775", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 446, "timestamp_epoch": "1533964528.985673000" }, { "kind": "directory_service", "dst_ip": "192.168.1.95", "fields": { "drsuapi.opnum": "12" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-d53e12171067297384326bc3", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 447, "timestamp_epoch": "1533964528.985973000" }, { "kind": "directory_service", "dst_ip": "192.168.1.6", "fields": { "drsuapi.opnum": "12" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-e229246840835b21a7fcbdc2", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 448, "timestamp_epoch": "1533964528.986102000" }, { "kind": "directory_service", "dst_ip": "192.168.1.95", "fields": { "drsuapi.opnum": "12" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-494af97de3016a6908f4f43b", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 449, "timestamp_epoch": "1533964528.986457000" }, { "kind": "directory_service", "dst_ip": "192.168.1.6", "fields": { "drsuapi.opnum": "1" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-935cab3e659b1b0d1df72d52", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 450, "timestamp_epoch": "1533964528.986584000" }, { "kind": "directory_service", "dst_ip": "192.168.1.95", "fields": { "drsuapi.opnum": "1" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-06a1b34d639eb9bf35f8c5a4", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 451, "timestamp_epoch": "1533964528.986777000" }, { "kind": "directory_service", "dst_ip": "192.168.1.6", "fields": { "ldap.protocolOp": "0" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-4b4e46a059260d81aad915cf", "src_port": null, "tcp_stream": 31, "udp_stream": null, "frame_number": 471, "timestamp_epoch": "1533964529.529068000" }, { "kind": "directory_service", "dst_ip": "192.168.1.95", "fields": { "ldap.protocolOp": "1" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-e47aab7862fc93a212b4d035", "src_port": null, "tcp_stream": 31, "udp_stream": null, "frame_number": 473, "timestamp_epoch": "1533964529.529903000" }, { "kind": "directory_service", "dst_ip": "192.168.1.6", "fields": { "ldap.filter": "1", "ldap.baseObject": "DC=sputnikhouse,DC=org", "ldap.protocolOp": "3" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-ad301aa2c27ee7183df4bae1", "src_port": null, "tcp_stream": 31, "udp_stream": null, "frame_number": 474, "timestamp_epoch": "1533964529.537653000" }, { "kind": "directory_service", "dst_ip": "192.168.1.95", "fields": { "ldap.protocolOp": "4,19,19,19,5" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-81869f79ec24d61581929f2c", "src_port": null, "tcp_stream": 31, "udp_stream": null, "frame_number": 475, "timestamp_epoch": "1533964529.537995000" }, { "kind": "directory_service", "dst_ip": "192.168.1.6", "fields": { "ldap.protocolOp": "0" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-bc58a62663c0dafa44dad3d6", "src_port": null, "tcp_stream": 33, "udp_stream": null, "frame_number": 479, "timestamp_epoch": "1533964529.542989000" }, { "kind": "directory_service", "dst_ip": "192.168.1.95", "fields": { "ldap.protocolOp": "1" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-d42d766ebd343591c89997ee", "src_port": null, "tcp_stream": 33, "udp_stream": null, "frame_number": 481, "timestamp_epoch": "1533964529.543547000" }, { "kind": "directory_service", "dst_ip": "192.168.1.6", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-b5aa648113596c4a36328e55", "src_port": null, "tcp_stream": 33, "udp_stream": null, "frame_number": 482, "timestamp_epoch": "1533964529.544279000" }, { "kind": "directory_service", "dst_ip": "192.168.1.95", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-2aa9401f7da20a0f8e143430", "src_port": null, "tcp_stream": 33, "udp_stream": null, "frame_number": 483, "timestamp_epoch": "1533964529.544436000" }, { "kind": "directory_service", "dst_ip": "192.168.1.6", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=sputnikhouse,DC=org", "ldap.protocolOp": "3" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-dba7fde095436100a1fd869a", "src_port": null, "tcp_stream": 33, "udp_stream": null, "frame_number": 484, "timestamp_epoch": "1533964529.544672000" }, { "kind": "directory_service", "dst_ip": "192.168.1.95", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-6accdd1ee739e0c4b28740aa", "src_port": null, "tcp_stream": 33, "udp_stream": null, "frame_number": 485, "timestamp_epoch": "1533964529.544824000" }, { "kind": "directory_service", "dst_ip": "192.168.1.6", "fields": { "ldap.filter": "1", "ldap.baseObject": "cn=policies,cn=system,DC=sputnikhouse,DC=org", "ldap.protocolOp": "3" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-76ec33d169ac13fcb16147a1", "src_port": null, "tcp_stream": 31, "udp_stream": null, "frame_number": 486, "timestamp_epoch": "1533964529.545298000" }, { "kind": "directory_service", "dst_ip": "192.168.1.95", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-d04542bba91285ec1d96ae3d", "src_port": null, "tcp_stream": 31, "udp_stream": null, "frame_number": 487, "timestamp_epoch": "1533964529.545617000" }, { "kind": "directory_service", "dst_ip": "192.168.1.6", "fields": { "ldap.protocolOp": "2" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-e638ffd9140361075a758a67", "src_port": null, "tcp_stream": 33, "udp_stream": null, "frame_number": 523, "timestamp_epoch": "1533964529.554461000" }, { "kind": "directory_service", "dst_ip": "192.168.1.6", "fields": { "ldap.protocolOp": "2" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-b22c48145951f47dd2fbe0c9", "src_port": null, "tcp_stream": 31, "udp_stream": null, "frame_number": 528, "timestamp_epoch": "1533964530.061030000" }, { "kind": "directory_service", "dst_ip": "192.168.1.6", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-a4eea2af914bce1e5c231950", "src_port": null, "tcp_stream": 1037, "udp_stream": null, "frame_number": 39562, "timestamp_epoch": "1533965407.382281000" }, { "kind": "directory_service", "dst_ip": "192.168.1.95", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-2bce4b79e8ede4d7b750e0e0", "src_port": null, "tcp_stream": 1037, "udp_stream": null, "frame_number": 39563, "timestamp_epoch": "1533965407.382541000" }, { "kind": "directory_service", "dst_ip": "192.168.1.6", "fields": { "ldap.protocolOp": "0" }, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-86dd7dd920ddf217d236e96b", "src_port": null, "tcp_stream": 1037, "udp_stream": null, "frame_number": 39575, "timestamp_epoch": "1533965407.386100000" }, { "kind": "directory_service", "dst_ip": "192.168.1.95", "fields": { "ldap.protocolOp": "1" }, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-a5b93001a08044ba17beabcd", "src_port": null, "tcp_stream": 1037, "udp_stream": null, "frame_number": 39577, "timestamp_epoch": "1533965407.386782000" }, { "kind": "directory_service", "dst_ip": "192.168.1.6", "fields": {}, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-7ffdd34c4292d80091053eed", "src_port": null, "tcp_stream": 1037, "udp_stream": null, "frame_number": 39578, "timestamp_epoch": "1533965407.387136000" }, { "kind": "directory_service", "dst_ip": "192.168.1.95", "fields": {}, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-2d17534c8b3c040804377d97", "src_port": null, "tcp_stream": 1037, "udp_stream": null, "frame_number": 39579, "timestamp_epoch": "1533965407.387374000" }, { "kind": "directory_service", "dst_ip": "192.168.1.6", "fields": {}, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-7f7ee1f38221a5e4b793d52f", "src_port": null, "tcp_stream": 1037, "udp_stream": null, "frame_number": 39580, "timestamp_epoch": "1533965407.387659000" }, { "kind": "directory_service", "dst_ip": "192.168.1.95", "fields": {}, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-a2b38789b0bf4493aa5a148d", "src_port": null, "tcp_stream": 1037, "udp_stream": null, "frame_number": 39581, "timestamp_epoch": "1533965407.388139000" }, { "kind": "directory_service", "dst_ip": "192.168.1.6", "fields": {}, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-b859ecbb323f3b963b404417", "src_port": null, "tcp_stream": 1037, "udp_stream": null, "frame_number": 39590, "timestamp_epoch": "1533965407.489451000" }, { "kind": "directory_service", "dst_ip": "192.168.1.95", "fields": {}, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-1fad3fe21cd47ec728f37a91", "src_port": null, "tcp_stream": 1037, "udp_stream": null, "frame_number": 39593, "timestamp_epoch": "1533965407.490531000" }, { "kind": "directory_service", "dst_ip": "192.168.1.6", "fields": {}, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-c9555ee17f2061da88383b36", "src_port": null, "tcp_stream": 1037, "udp_stream": null, "frame_number": 39604, "timestamp_epoch": "1533965407.596998000" }, { "kind": "directory_service", "dst_ip": "192.168.1.95", "fields": {}, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-f731307e917d149384ed1196", "src_port": null, "tcp_stream": 1037, "udp_stream": null, "frame_number": 39607, "timestamp_epoch": "1533965407.597859000" }, { "kind": "directory_service", "dst_ip": "192.168.1.6", "fields": {}, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-62f19c7a4b860b6e9fe210e3", "src_port": null, "tcp_stream": 1037, "udp_stream": null, "frame_number": 39614, "timestamp_epoch": "1533965407.599471000" }, { "kind": "directory_service", "dst_ip": "192.168.1.95", "fields": {}, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-4614548b90663cfe585da969", "src_port": null, "tcp_stream": 1037, "udp_stream": null, "frame_number": 39615, "timestamp_epoch": "1533965407.599801000" }, { "kind": "directory_service", "dst_ip": "192.168.1.6", "fields": {}, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-eaa7563f96a3600b28a1eff2", "src_port": null, "tcp_stream": 1037, "udp_stream": null, "frame_number": 39621, "timestamp_epoch": "1533965407.601733000" }, { "kind": "directory_service", "dst_ip": "192.168.1.95", "fields": {}, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-8d6f790eade0cb961c1c335f", "src_port": null, "tcp_stream": 1037, "udp_stream": null, "frame_number": 39623, "timestamp_epoch": "1533965407.602381000" }, { "kind": "directory_service", "dst_ip": "192.168.1.6", "fields": {}, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-b8bc4aba7c8a42b5055ad05b", "src_port": null, "tcp_stream": 1037, "udp_stream": null, "frame_number": 39624, "timestamp_epoch": "1533965407.602649000" }, { "kind": "directory_service", "dst_ip": "192.168.1.95", "fields": {}, "src_ip": "192.168.1.6", "dst_port": null, "event_id": "evt-13c9b465669b3c6465fd5746", "src_port": null, "tcp_stream": 1037, "udp_stream": null, "frame_number": 39625, "timestamp_epoch": "1533965407.603086000" }, { "kind": "directory_service", "dst_ip": "192.168.1.6", "fields": {}, "src_ip": "192.168.1.95", "dst_port": null, "event_id": "evt-1c9218fe3719da9fd93e8544", "src_port": null, "tcp_stream": 1037, "udp_stream": null, "frame_number": 39626, "timestamp_epoch": "1533965407.603236000" } ] }, "capture": { "format": "pcap-le-microsecond", "packet_count": 47177, "interface_ids": [], "source_sha256": "c9e136e6e53daec4deec416e545d56e3c430dbc2d38374cf7a4dc839a0f4a3ff", "captured_bytes": 29249335, "protocol_counts": { "ip": 47177, "dns": 737, "eth": 47177, "ntp": 4, "png": 18, "smb": 2, "tcp": 46300, "tls": 13176, "udp": 862, "xml": 1, "data": 4, "dhcp": 12, "http": 324, "igmp": 30, "json": 2, "ldap": 74, "nbns": 87, "nbss": 68, "smb2": 65, "cldap": 10, "llmnr": 12, "media": 49, "dcerpc": 52, "pkcs-1": 195, "spnego": 37, "x509ce": 14353, "gss-api": 71, "x509sat": 17875, "kerberos": 48, "ethertype": 47177, "image-gif": 5, "pkix-cert": 4, "websocket": 16, "spnego-krb5": 115, "ns_cert_exts": 20, "pkix1explicit": 1420, "pkix1implicit": 2025, "data-text-lines": 87, "urlencoded-form": 34, "logotypecertextn": 6 }, "duration_seconds": 1398.54051, "last_packet_epoch": "1533965907.307885", "source_size_bytes": 30004191, "first_packet_epoch": "1533964508.767375", "encapsulation_types": [ 1 ] }, "summary": "Decoded 47177 packets across 267 IP endpoints and 1605 transport flows. Observed 737 DNS events, 154 HTTP requests, 1089 TLS ClientHello events, and 110 recovered file/message object(s). Deterministic rules produced 45 finding(s): 1 high, 40 medium, and 4 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.", "coverage": { "warnings": [], "limitations": [ "Encrypted application contents are not decrypted", "Protocol decoding and heuristic findings do not establish malware family or attribution", "No endpoint execution, persistence, or credential-theft proof without corresponding evidence" ], "event_limits": { "dns": { "returned": 737, "truncated": false }, "dhcp": { "returned": 12, "truncated": false }, "smtp": { "returned": 0, "truncated": false }, "identity": { "returned": 234, "truncated": false }, "http_request": { "returned": 154, "truncated": false }, "http_response": { "returned": 152, "truncated": false }, "tls_client_hello": { "returned": 1089, "truncated": false }, "unclassified_tcp": { "returned": 0, "truncated": false }, "directory_service": { "returned": 90, "truncated": false } }, "http_objects": { "complete": true, "selection": "content-classified first, then size descending, SHA256 tie-break; deduplicated by full hash; overflow retains a compact hash index", "hashed_bytes": 2856790, "export_status": "completed", "unique_hashes": 110, "hashed_objects": 183, "compact_objects": 0, "detailed_objects": 110, "exported_objects": 183, "unhashed_objects": 0, "compact_hash_index": [], "omitted_unique_hashes": 0, "returned_unique_hashes": 110 }, "name_resolution": false, "supplemental_objects": { "scope": "bounded IMF, inert embedded base64 and complete contiguous HTTP response recovery", "returned": 0 }, "complete_within_profile": true, "encrypted_payload_visibility": "metadata-only" }, "findings": [ { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/1.rar", "source": "149.129.222.112", "destination": "192.168.1.95", "content_type": "application/x-rar-compressed", "response_count": 1, "declared_body_bytes": 154 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 178, "frame_number": 7263, "display_filter": "frame.number == 7263", "timestamp_epoch": "1533964850.464296000" }, { "tcp_stream": 178, "frame_number": 7266, "display_filter": "frame.number == 7266", "timestamp_epoch": "1533964851.215554000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-c7236ee2bc47223de830e818", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/1.zip", "source": "149.129.222.112", "destination": "192.168.1.95", "content_type": "application/zip", "response_count": 1, "declared_body_bytes": 299 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 179, "frame_number": 7277, "display_filter": "frame.number == 7277", "timestamp_epoch": "1533964857.855860000" }, { "tcp_stream": 179, "frame_number": 7279, "display_filter": "frame.number == 7279", "timestamp_epoch": "1533964858.677650000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-c49073509e03d50105c86230", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Periodic HTTP callback pattern", "status": "candidate", "metrics": { "uri": "/dot.php", "host": "185.68.93.18", "port": 80, "method": "POST", "source": "192.168.1.95", "destination": "185.68.93.18", "request_count": 33, "median_interval_seconds": 16.172, "median_absolute_deviation": 0.098 }, "rule_id": "periodic-http-callbacks", "evidence": [ { "tcp_stream": 1036, "frame_number": 39557, "display_filter": "frame.number == 39557", "timestamp_epoch": "1533965406.977212000" }, { "tcp_stream": 1046, "frame_number": 39676, "display_filter": "frame.number == 39676", "timestamp_epoch": "1533965418.580357000" }, { "tcp_stream": 1046, "frame_number": 39681, "display_filter": "frame.number == 39681", "timestamp_epoch": "1533965419.412338000" }, { "tcp_stream": 1047, "frame_number": 39699, "display_filter": "frame.number == 39699", "timestamp_epoch": "1533965435.576793000" }, { "tcp_stream": 1048, "frame_number": 39712, "display_filter": "frame.number == 39712", "timestamp_epoch": "1533965451.757604000" }, { "tcp_stream": 1049, "frame_number": 39725, "display_filter": "frame.number == 39725", "timestamp_epoch": "1533965467.936416000" }, { "tcp_stream": 1050, "frame_number": 39741, "display_filter": "frame.number == 39741", "timestamp_epoch": "1533965484.293094000" }, { "tcp_stream": 1051, "frame_number": 39754, "display_filter": "frame.number == 39754", "timestamp_epoch": "1533965500.471438000" }, { "tcp_stream": 1052, "frame_number": 39767, "display_filter": "frame.number == 39767", "timestamp_epoch": "1533965516.649335000" }, { "tcp_stream": 1053, "frame_number": 39781, "display_filter": "frame.number == 39781", "timestamp_epoch": "1533965532.902740000" }, { "tcp_stream": 1054, "frame_number": 39796, "display_filter": "frame.number == 39796", "timestamp_epoch": "1533965549.287287000" }, { "tcp_stream": 1055, "frame_number": 39809, "display_filter": "frame.number == 39809", "timestamp_epoch": "1533965565.437819000" }, { "tcp_stream": 1057, "frame_number": 39879, "display_filter": "frame.number == 39879", "timestamp_epoch": "1533965581.646796000" }, { "tcp_stream": 1058, "frame_number": 39895, "display_filter": "frame.number == 39895", "timestamp_epoch": "1533965597.772796000" }, { "tcp_stream": 1060, "frame_number": 39951, "display_filter": "frame.number == 39951", "timestamp_epoch": "1533965613.953658000" }, { "tcp_stream": 1061, "frame_number": 39970, "display_filter": "frame.number == 39970", "timestamp_epoch": "1533965630.124714000" }, { "tcp_stream": 1062, "frame_number": 39983, "display_filter": "frame.number == 39983", "timestamp_epoch": "1533965646.289888000" }, { "tcp_stream": 1063, "frame_number": 39996, "display_filter": "frame.number == 39996", "timestamp_epoch": "1533965662.463461000" }, { "tcp_stream": 1064, "frame_number": 40009, "display_filter": "frame.number == 40009", "timestamp_epoch": "1533965678.767587000" }, { "tcp_stream": 1065, "frame_number": 40022, "display_filter": "frame.number == 40022", "timestamp_epoch": "1533965694.815438000" }, { "tcp_stream": 1066, "frame_number": 40038, "display_filter": "frame.number == 40038", "timestamp_epoch": "1533965712.030869000" }, { "tcp_stream": 1067, "frame_number": 40051, "display_filter": "frame.number == 40051", "timestamp_epoch": "1533965728.827660000" }, { "tcp_stream": 1068, "frame_number": 40064, "display_filter": "frame.number == 40064", "timestamp_epoch": "1533965744.894700000" }, { "tcp_stream": 1069, "frame_number": 40078, "display_filter": "frame.number == 40078", "timestamp_epoch": "1533965761.462868000" }, { "tcp_stream": 1136, "frame_number": 43076, "display_filter": "frame.number == 43076", "timestamp_epoch": "1533965777.816386000" }, { "tcp_stream": 1228, "frame_number": 46895, "display_filter": "frame.number == 46895", "timestamp_epoch": "1533965794.146966000" }, { "tcp_stream": 1231, "frame_number": 46979, "display_filter": "frame.number == 46979", "timestamp_epoch": "1533965810.211920000" }, { "tcp_stream": 1232, "frame_number": 47000, "display_filter": "frame.number == 47000", "timestamp_epoch": "1533965826.339697000" }, { "tcp_stream": 1233, "frame_number": 47020, "display_filter": "frame.number == 47020", "timestamp_epoch": "1533965842.507089000" }, { "tcp_stream": 1234, "frame_number": 47112, "display_filter": "frame.number == 47112", "timestamp_epoch": "1533965858.482440000" }, { "tcp_stream": 1235, "frame_number": 47140, "display_filter": "frame.number == 47140", "timestamp_epoch": "1533965874.474111000" }, { "tcp_stream": 1236, "frame_number": 47152, "display_filter": "frame.number == 47152", "timestamp_epoch": "1533965890.554906000" }, { "tcp_stream": 1237, "frame_number": 47174, "display_filter": "frame.number == 47174", "timestamp_epoch": "1533965906.527374000" } ], "severity": "high", "confidence": 0.88, "finding_id": "finding-8798192d6b4571d1d4d40028", "explanation": "Repeated requests have a stable cadence consistent with automated callback or beacon behavior.", "rule_version": "pcap-rules-v5" }, { "title": "Repeated outbound HTTP POST activity", "status": "candidate", "metrics": { "uri": "/dot.php", "host": "185.68.93.18", "port": 80, "source": "192.168.1.95", "destination": "185.68.93.18", "request_count": 33, "declared_body_bytes": 2722 }, "rule_id": "repeated-http-posts", "evidence": [ { "tcp_stream": 1036, "frame_number": 39557, "display_filter": "frame.number == 39557", "timestamp_epoch": "1533965406.977212000" }, { "tcp_stream": 1046, "frame_number": 39676, "display_filter": "frame.number == 39676", "timestamp_epoch": "1533965418.580357000" }, { "tcp_stream": 1046, "frame_number": 39681, "display_filter": "frame.number == 39681", "timestamp_epoch": "1533965419.412338000" }, { "tcp_stream": 1047, "frame_number": 39699, "display_filter": "frame.number == 39699", "timestamp_epoch": "1533965435.576793000" }, { "tcp_stream": 1048, "frame_number": 39712, "display_filter": "frame.number == 39712", "timestamp_epoch": "1533965451.757604000" }, { "tcp_stream": 1049, "frame_number": 39725, "display_filter": "frame.number == 39725", "timestamp_epoch": "1533965467.936416000" }, { "tcp_stream": 1050, "frame_number": 39741, "display_filter": "frame.number == 39741", "timestamp_epoch": "1533965484.293094000" }, { "tcp_stream": 1051, "frame_number": 39754, "display_filter": "frame.number == 39754", "timestamp_epoch": "1533965500.471438000" }, { "tcp_stream": 1052, "frame_number": 39767, "display_filter": "frame.number == 39767", "timestamp_epoch": "1533965516.649335000" }, { "tcp_stream": 1053, "frame_number": 39781, "display_filter": "frame.number == 39781", "timestamp_epoch": "1533965532.902740000" }, { "tcp_stream": 1054, "frame_number": 39796, "display_filter": "frame.number == 39796", "timestamp_epoch": "1533965549.287287000" }, { "tcp_stream": 1055, "frame_number": 39809, "display_filter": "frame.number == 39809", "timestamp_epoch": "1533965565.437819000" }, { "tcp_stream": 1057, "frame_number": 39879, "display_filter": "frame.number == 39879", "timestamp_epoch": "1533965581.646796000" }, { "tcp_stream": 1058, "frame_number": 39895, "display_filter": "frame.number == 39895", "timestamp_epoch": "1533965597.772796000" }, { "tcp_stream": 1060, "frame_number": 39951, "display_filter": "frame.number == 39951", "timestamp_epoch": "1533965613.953658000" }, { "tcp_stream": 1061, "frame_number": 39970, "display_filter": "frame.number == 39970", "timestamp_epoch": "1533965630.124714000" }, { "tcp_stream": 1062, "frame_number": 39983, "display_filter": "frame.number == 39983", "timestamp_epoch": "1533965646.289888000" }, { "tcp_stream": 1063, "frame_number": 39996, "display_filter": "frame.number == 39996", "timestamp_epoch": "1533965662.463461000" }, { "tcp_stream": 1064, "frame_number": 40009, "display_filter": "frame.number == 40009", "timestamp_epoch": "1533965678.767587000" }, { "tcp_stream": 1065, "frame_number": 40022, "display_filter": "frame.number == 40022", "timestamp_epoch": "1533965694.815438000" }, { "tcp_stream": 1066, "frame_number": 40038, "display_filter": "frame.number == 40038", "timestamp_epoch": "1533965712.030869000" }, { "tcp_stream": 1067, "frame_number": 40051, "display_filter": "frame.number == 40051", "timestamp_epoch": "1533965728.827660000" }, { "tcp_stream": 1068, "frame_number": 40064, "display_filter": "frame.number == 40064", "timestamp_epoch": "1533965744.894700000" }, { "tcp_stream": 1069, "frame_number": 40078, "display_filter": "frame.number == 40078", "timestamp_epoch": "1533965761.462868000" }, { "tcp_stream": 1136, "frame_number": 43076, "display_filter": "frame.number == 43076", "timestamp_epoch": "1533965777.816386000" }, { "tcp_stream": 1228, "frame_number": 46895, "display_filter": "frame.number == 46895", "timestamp_epoch": "1533965794.146966000" }, { "tcp_stream": 1231, "frame_number": 46979, "display_filter": "frame.number == 46979", "timestamp_epoch": "1533965810.211920000" }, { "tcp_stream": 1232, "frame_number": 47000, "display_filter": "frame.number == 47000", "timestamp_epoch": "1533965826.339697000" }, { "tcp_stream": 1233, "frame_number": 47020, "display_filter": "frame.number == 47020", "timestamp_epoch": "1533965842.507089000" }, { "tcp_stream": 1234, "frame_number": 47112, "display_filter": "frame.number == 47112", "timestamp_epoch": "1533965858.482440000" }, { "tcp_stream": 1235, "frame_number": 47140, "display_filter": "frame.number == 47140", "timestamp_epoch": "1533965874.474111000" }, { "tcp_stream": 1236, "frame_number": 47152, "display_filter": "frame.number == 47152", "timestamp_epoch": "1533965890.554906000" }, { "tcp_stream": 1237, "frame_number": 47174, "display_filter": "frame.number == 47174", "timestamp_epoch": "1533965906.527374000" } ], "severity": "medium", "confidence": 0.72, "finding_id": "finding-f6fbeb351fe8b8310aaae04b", "explanation": "The same endpoint pair and HTTP target produced repeated POST requests suitable for beaconing or data transfer review.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/js/jquery-1.8.3.min.js?v=1533913284", "source": "103.5.149.72", "destination": "192.168.1.95", "content_type": "application/javascript", "response_count": 1, "declared_body_bytes": 93636 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 1070, "frame_number": 40113, "display_filter": "frame.number == 40113", "timestamp_epoch": "1533965770.052650000" }, { "tcp_stream": 1070, "frame_number": 41024, "display_filter": "frame.number == 41024", "timestamp_epoch": "1533965774.001669000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-3f0ed1b278193d391bf5372f", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/js/api/openapi.js?v=1533913284", "source": "87.240.129.133", "destination": "192.168.1.95", "content_type": "application/x-javascript", "response_count": 1, "declared_body_bytes": 0 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 1076, "frame_number": 40209, "display_filter": "frame.number == 40209", "timestamp_epoch": "1533965770.487843000" }, { "tcp_stream": 1076, "frame_number": 40506, "display_filter": "frame.number == 40506", "timestamp_epoch": "1533965771.061475000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-2a1ed4994e65289283c77598", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/js/jquery-ui.min.js?v=1533913284", "source": "103.5.149.72", "destination": "192.168.1.95", "content_type": "application/javascript", "response_count": 1, "declared_body_bytes": 88650 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 1071, "frame_number": 41126, "display_filter": "frame.number == 41126", "timestamp_epoch": "1533965772.393285000" }, { "tcp_stream": 1071, "frame_number": 43633, "display_filter": "frame.number == 43633", "timestamp_epoch": "1533965782.904170000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-9c9340b301125a695118cef7", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/js/common/infinite-scroll.js?v=1533913284", "source": "103.5.149.72", "destination": "192.168.1.95", "content_type": "application/javascript", "response_count": 1, "declared_body_bytes": 572 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 1073, "frame_number": 41347, "display_filter": "frame.number == 41347", "timestamp_epoch": "1533965773.014142000" }, { "tcp_stream": 1073, "frame_number": 41786, "display_filter": "frame.number == 41786", "timestamp_epoch": "1533965774.640490000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-5c426f25219e07b1a83e312f", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/js/common/angular-touch.js?v=1533913284", "source": "103.5.149.72", "destination": "192.168.1.95", "content_type": "application/javascript", "response_count": 1, "declared_body_bytes": 21191 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 1072, "frame_number": 41353, "display_filter": "frame.number == 41353", "timestamp_epoch": "1533965773.026022000" }, { "tcp_stream": 1072, "frame_number": 42689, "display_filter": "frame.number == 42689", "timestamp_epoch": "1533965776.931692000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-08888b1df2552c9ad869e978", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/js/zoom/angular.rangeSlider.js?v=1533913284", "source": "103.5.149.72", "destination": "192.168.1.95", "content_type": "application/javascript", "response_count": 1, "declared_body_bytes": 31135 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 1070, "frame_number": 41365, "display_filter": "frame.number == 41365", "timestamp_epoch": "1533965773.105996000" }, { "tcp_stream": 1070, "frame_number": 41848, "display_filter": "frame.number == 41848", "timestamp_epoch": "1533965774.795760000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-5c2d05d29eda3147469063ac", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/js/zoom/ng-pinch-zoom.js?v=1533913284", "source": "103.5.149.72", "destination": "192.168.1.95", "content_type": "application/javascript", "response_count": 1, "declared_body_bytes": 5404 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 1074, "frame_number": 41391, "display_filter": "frame.number == 41391", "timestamp_epoch": "1533965773.250617000" }, { "tcp_stream": 1074, "frame_number": 42201, "display_filter": "frame.number == 42201", "timestamp_epoch": "1533965775.812971000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-779eca848c7626f7eb302d1a", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/js/common/tass.js?v=1533913284", "source": "103.5.149.72", "destination": "192.168.1.95", "content_type": "application/javascript", "response_count": 1, "declared_body_bytes": 6084 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 1075, "frame_number": 41437, "display_filter": "frame.number == 41437", "timestamp_epoch": "1533965773.488179000" }, { "tcp_stream": 1075, "frame_number": 41872, "display_filter": "frame.number == 41872", "timestamp_epoch": "1533965774.844975000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-ca9597b4e67b7fe2b72c27d6", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/js/common/angular-sanitize.min.js?v=1533913284", "source": "103.5.149.72", "destination": "192.168.1.95", "content_type": "application/javascript", "response_count": 1, "declared_body_bytes": 4247 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 1132, "frame_number": 41781, "display_filter": "frame.number == 41781", "timestamp_epoch": "1533965774.639806000" }, { "tcp_stream": 1132, "frame_number": 42224, "display_filter": "frame.number == 42224", "timestamp_epoch": "1533965775.860779000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-9b11ebef8f3e3a98db57e1a6", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/js/angular-1.2.4.min.js?v=1533913284", "source": "103.5.149.72", "destination": "192.168.1.95", "content_type": "application/javascript", "response_count": 1, "declared_body_bytes": 99790 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 1133, "frame_number": 41784, "display_filter": "frame.number == 41784", "timestamp_epoch": "1533965774.640184000" }, { "tcp_stream": 1133, "frame_number": 43154, "display_filter": "frame.number == 43154", "timestamp_epoch": "1533965778.041937000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-395d635f884761d139c04a85", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/js/common/photoModeController.js?v=1533913284", "source": "103.5.149.72", "destination": "192.168.1.95", "content_type": "application/javascript", "response_count": 1, "declared_body_bytes": 1519 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 1073, "frame_number": 41791, "display_filter": "frame.number == 41791", "timestamp_epoch": "1533965774.642796000" }, { "tcp_stream": 1073, "frame_number": 42246, "display_filter": "frame.number == 42246", "timestamp_epoch": "1533965775.872998000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-3cdb2afccdff86b9c35bec62", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/js/common/mainTopSlider.js?v=1533913284", "source": "103.5.149.72", "destination": "192.168.1.95", "content_type": "application/javascript", "response_count": 1, "declared_body_bytes": 15430 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 1070, "frame_number": 41850, "display_filter": "frame.number == 41850", "timestamp_epoch": "1533965774.796502000" }, { "tcp_stream": 1070, "frame_number": 42263, "display_filter": "frame.number == 42263", "timestamp_epoch": "1533965775.927745000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-9c60064dc2f38d4b856a1246", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/js/common/pressCenterCalendar.js?v=1533913284", "source": "103.5.149.72", "destination": "192.168.1.95", "content_type": "application/javascript", "response_count": 1, "declared_body_bytes": 9636 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 1075, "frame_number": 41876, "display_filter": "frame.number == 41876", "timestamp_epoch": "1533965774.845808000" }, { "tcp_stream": 1075, "frame_number": 42283, "display_filter": "frame.number == 42283", "timestamp_epoch": "1533965775.985989000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-21f6889d14d5ee7e07f12cd2", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/js/common/mainDirect.js?v=1533913284", "source": "103.5.149.72", "destination": "192.168.1.95", "content_type": "application/javascript", "response_count": 1, "declared_body_bytes": 19588 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 1134, "frame_number": 42021, "display_filter": "frame.number == 42021", "timestamp_epoch": "1533965775.393890000" }, { "tcp_stream": 1134, "frame_number": 42702, "display_filter": "frame.number == 42702", "timestamp_epoch": "1533965776.948117000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-79d2965a7b00ce4479fc8da3", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/js/activeViewService.js?v=1533913284", "source": "103.5.149.72", "destination": "192.168.1.95", "content_type": "application/javascript", "response_count": 1, "declared_body_bytes": 3543 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 1135, "frame_number": 42022, "display_filter": "frame.number == 42022", "timestamp_epoch": "1533965775.393893000" }, { "tcp_stream": 1135, "frame_number": 42485, "display_filter": "frame.number == 42485", "timestamp_epoch": "1533965776.392419000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-cdde78502cba802e6e588769", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/js/doublephoto/doublephoto.js?v=1533913284", "source": "103.5.149.72", "destination": "192.168.1.95", "content_type": "application/javascript", "response_count": 1, "declared_body_bytes": 3448 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 1130, "frame_number": 42049, "display_filter": "frame.number == 42049", "timestamp_epoch": "1533965775.438635000" }, { "tcp_stream": 1130, "frame_number": 42522, "display_filter": "frame.number == 42522", "timestamp_epoch": "1533965776.482909000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-fb2142355b7d51b4050b493b", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/js/hammer.min.js?v=1533913284", "source": "103.5.149.72", "destination": "192.168.1.95", "content_type": "application/javascript", "response_count": 1, "declared_body_bytes": 18358 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 1131, "frame_number": 42057, "display_filter": "frame.number == 42057", "timestamp_epoch": "1533965775.442355000" }, { "tcp_stream": 1131, "frame_number": 42755, "display_filter": "frame.number == 42755", "timestamp_epoch": "1533965777.083387000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-8bd76b09c82f5f200541d495", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/js/zoom/zoomController.js?v=1533913284", "source": "103.5.149.72", "destination": "192.168.1.95", "content_type": "application/javascript", "response_count": 1, "declared_body_bytes": 14904 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 1074, "frame_number": 42204, "display_filter": "frame.number == 42204", "timestamp_epoch": "1533965775.813738000" }, { "tcp_stream": 1074, "frame_number": 42975, "display_filter": "frame.number == 42975", "timestamp_epoch": "1533965777.599893000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-96abb0b6a1f83a6e50509b6a", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/js/common/mediaBlocksController.js?v=1533913284", "source": "103.5.149.72", "destination": "192.168.1.95", "content_type": "application/javascript", "response_count": 1, "declared_body_bytes": 9712 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 1132, "frame_number": 42230, "display_filter": "frame.number == 42230", "timestamp_epoch": "1533965775.861597000" }, { "tcp_stream": 1132, "frame_number": 42749, "display_filter": "frame.number == 42749", "timestamp_epoch": "1533965777.082154000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-361b6ad8a0eb9a61e280b4e8", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/js/jquery.cookie.js?v=1533913284", "source": "103.5.149.72", "destination": "192.168.1.95", "content_type": "application/javascript", "response_count": 1, "declared_body_bytes": 3121 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 1073, "frame_number": 42248, "display_filter": "frame.number == 42248", "timestamp_epoch": "1533965775.873952000" }, { "tcp_stream": 1073, "frame_number": 42762, "display_filter": "frame.number == 42762", "timestamp_epoch": "1533965777.097664000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-d0321b76736ebd67bb6e2035", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/js/highcharts/highcharts.js?v=1533913284", "source": "103.5.149.72", "destination": "192.168.1.95", "content_type": "application/javascript", "response_count": 1, "declared_body_bytes": 153909 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 1070, "frame_number": 42266, "display_filter": "frame.number == 42266", "timestamp_epoch": "1533965775.928489000" }, { "tcp_stream": 1070, "frame_number": 43271, "display_filter": "frame.number == 43271", "timestamp_epoch": "1533965778.485448000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-1a2d3f5d7f8e3cd604dfdfe9", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/js/adfox.asyn.code.scroll.js", "source": "103.5.149.72", "destination": "192.168.1.95", "content_type": "application/javascript", "response_count": 1, "declared_body_bytes": 2985 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 1075, "frame_number": 42289, "display_filter": "frame.number == 42289", "timestamp_epoch": "1533965775.986796000" }, { "tcp_stream": 1075, "frame_number": 42849, "display_filter": "frame.number == 42849", "timestamp_epoch": "1533965777.296514000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-a2426691066db3250439f5a9", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/js/mainSliderWidget.js", "source": "103.5.149.72", "destination": "192.168.1.95", "content_type": "application/javascript", "response_count": 1, "declared_body_bytes": 350 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 1135, "frame_number": 42488, "display_filter": "frame.number == 42488", "timestamp_epoch": "1533965776.394706000" }, { "tcp_stream": 1135, "frame_number": 42903, "display_filter": "frame.number == 42903", "timestamp_epoch": "1533965777.414677000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-7c01c3477831862903d07f33", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/assets/bfcd510f/libs.min.js?v=1533913284", "source": "103.5.149.72", "destination": "192.168.1.95", "content_type": "application/javascript", "response_count": 1, "declared_body_bytes": 192101 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 1130, "frame_number": 42524, "display_filter": "frame.number == 42524", "timestamp_epoch": "1533965776.483672000" }, { "tcp_stream": 1130, "frame_number": 43539, "display_filter": "frame.number == 43539", "timestamp_epoch": "1533965779.484237000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-e5cb782606a98614ecaf2a4f", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/assets/287c4a4b/itar.min.js?v=1533913284", "source": "103.5.149.72", "destination": "192.168.1.95", "content_type": "application/javascript", "response_count": 1, "declared_body_bytes": 69253 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 1072, "frame_number": 42696, "display_filter": "frame.number == 42696", "timestamp_epoch": "1533965776.932397000" }, { "tcp_stream": 1072, "frame_number": 43580, "display_filter": "frame.number == 43580", "timestamp_epoch": "1533965779.848676000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-15444850cb1a65256f1cc02b", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/tag/js/gpt.js", "source": "216.58.194.162", "destination": "192.168.1.95", "content_type": "text/javascript", "response_count": 1, "declared_body_bytes": 7819 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 1139, "frame_number": 43669, "display_filter": "frame.number == 43669", "timestamp_epoch": "1533965783.098093000" }, { "tcp_stream": 1139, "frame_number": 43720, "display_filter": "frame.number == 43720", "timestamp_epoch": "1533965783.225531000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-0b8a7bfdd58462b99bf6585d", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/delivery/rta/rta.js?netId=5895&cookieName=crtg_rta&rnd=74932308510&varName=crtg_content", "source": "74.119.117.100", "destination": "192.168.1.95", "content_type": "text/html", "response_count": 1, "declared_body_bytes": 144 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 1146, "frame_number": 43682, "display_filter": "frame.number == 43682", "timestamp_epoch": "1533965783.173153000" }, { "tcp_stream": 1146, "frame_number": 43740, "display_filter": "frame.number == 43740", "timestamp_epoch": "1533965783.308767000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-1dea55259f57f179e0d2eb71", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/gtm.js?id=GTM-KX9ZXT", "source": "216.58.192.8", "destination": "192.168.1.95", "content_type": "application/javascript; charset=utf-8", "response_count": 1, "declared_body_bytes": 51691 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 1147, "frame_number": 43686, "display_filter": "frame.number == 43686", "timestamp_epoch": "1533965783.173455000" }, { "tcp_stream": 1147, "frame_number": 44010, "display_filter": "frame.number == 44010", "timestamp_epoch": "1533965783.936535000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-bb4b4ff8054af1a06f563eb7", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/en_US/sdk.js", "source": "157.240.11.22", "destination": "192.168.1.95", "content_type": "application/x-javascript; charset=utf-8", "response_count": 1, "declared_body_bytes": 67344 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 1151, "frame_number": 43690, "display_filter": "frame.number == 43690", "timestamp_epoch": "1533965783.175343000" }, { "tcp_stream": 1151, "frame_number": 43966, "display_filter": "frame.number == 43966", "timestamp_epoch": "1533965783.858453000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-745f7c23326bbe6e83ba542c", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/widgets.js", "source": "192.229.163.25", "destination": "192.168.1.95", "content_type": "application/javascript; charset=utf-8", "response_count": 1, "declared_body_bytes": 35362 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 1150, "frame_number": 43698, "display_filter": "frame.number == 43698", "timestamp_epoch": "1533965783.176462000" }, { "tcp_stream": 1150, "frame_number": 43810, "display_filter": "frame.number == 43810", "timestamp_epoch": "1533965783.596265000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-78daea85d10928f7a2fc4662", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/pagead/osd.js", "source": "216.58.194.162", "destination": "192.168.1.95", "content_type": "text/javascript; charset=utf-8", "response_count": 1, "declared_body_bytes": 26268 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 1187, "frame_number": 44800, "display_filter": "frame.number == 44800", "timestamp_epoch": "1533965786.356599000" }, { "tcp_stream": 1187, "frame_number": 45009, "display_filter": "frame.number == 45009", "timestamp_epoch": "1533965786.714272000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-bc988b8b9edf9da315bdd9fd", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/js/common/textBroadcastController.js?v=1533913284", "source": "103.5.149.72", "destination": "192.168.1.95", "content_type": "application/javascript", "response_count": 1, "declared_body_bytes": 10013 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 1130, "frame_number": 46427, "display_filter": "frame.number == 46427", "timestamp_epoch": "1533965791.295458000" }, { "tcp_stream": 1130, "frame_number": 46593, "display_filter": "frame.number == 46593", "timestamp_epoch": "1533965791.764965000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-bf5cd1cd4a136eb5c4cbe791", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/js/audioWidget.js", "source": "103.5.149.72", "destination": "192.168.1.95", "content_type": "application/javascript", "response_count": 1, "declared_body_bytes": 3364 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 1071, "frame_number": 46441, "display_filter": "frame.number == 46441", "timestamp_epoch": "1533965791.370352000" }, { "tcp_stream": 1071, "frame_number": 46630, "display_filter": "frame.number == 46630", "timestamp_epoch": "1533965791.925149000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-a9a89059f9e02062a63ed0b8", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/js/videoWidget.js", "source": "103.5.149.72", "destination": "192.168.1.95", "content_type": "application/javascript", "response_count": 1, "declared_body_bytes": 11271 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 1133, "frame_number": 46465, "display_filter": "frame.number == 46465", "timestamp_epoch": "1533965791.437407000" }, { "tcp_stream": 1133, "frame_number": 46683, "display_filter": "frame.number == 46683", "timestamp_epoch": "1533965792.154573000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-ffc196f02b7c315e5e7f9a9f", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/js/social/socialDirective.js", "source": "103.5.149.72", "destination": "192.168.1.95", "content_type": "application/javascript", "response_count": 1, "declared_body_bytes": 12028 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 1070, "frame_number": 46484, "display_filter": "frame.number == 46484", "timestamp_epoch": "1533965791.472841000" }, { "tcp_stream": 1070, "frame_number": 46735, "display_filter": "frame.number == 46735", "timestamp_epoch": "1533965792.353700000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-00c291b89975a084ec3ca605", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Repeated TLS cadence across multiple names", "status": "candidate", "metrics": { "ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "hosts": [ "a1.adform.net", "c1.adform.net", "da4pli3l5vc0d.cloudfront.net", "ib.adnxs.com", "magnetic.t.domdex.com", "pixel.rubiconproject.com", "secure.adnxs.com", "small-video.edgecast.syn-cdn.com", "vid-io.springserve.net" ], "source": "192.168.1.95", "regular_hosts": 9, "client_hello_count": 1084, "per_host_median_intervals": [ 68.327, 37.964, 62.88, 20.119, 102.577, 87.449, 48.725, 65.904, 20.343 ], "other_names_sharing_fingerprint": [ "2886.tm.zedo.com", "a.company-target.com", "a.tribalfusion.com", "a1.seadform.net", "aa.agkn.com", "acdn.adnxs.com", "ad.360yield.com", "ad.lkqd.net", "ad.sxp.smartclip.net", "ad.turn.com", "ade.googlesyndication.com", "ads.adaptv.advertising.com", "ads.creative-serving.com", "ads.deliverimp.com", "ads.lfstmedia.com", "ads.pubmatic.com", "ads.rubiconproject.com", "ads.scorecardresearch.com", "ads.stickyadstv.com", "ads.yahoo.com", "adserver.adtech.advertising.com", "adservice.google.com", "adventori.com", "ag.innovid.com", "ajax.googleapis.com", "an.yandex.ru", "apnx-match.dotomi.com", "appnexus-partners.tremorhub.com", "b1sync.zemanta.com", "bcp.crwdcntrl.net", "beacon.tru.am", "beacon.walmart.com", "bh.contextweb.com", "bid.contextweb.com", "bid.g.doubleclick.net", "bidder.criteo.com", "bttrack.com", "c.bing.com", "cdn-ssl.vidible.tv", "cdn.adnxs.com", "cdn.doubleverify.com", "cdn.jsdelivr.net", "cdn.marphezis.com", "cdn.onthe.io", "cdn1.tass.ru", "cdn2.tass.ru", "cdn3.doubleverify.com", "cdni.rt.com", "ce.lijit.com", "cm.adform.net", "cm.adgrx.com", "cm.eyereturn.com", "cm.g.doubleclick.net", "cms.quantserve.com", "code.createjs.com", "contextual.media.net", "cookie.brealtime.com", "cookiex.ngd.yahoo.com", "counter.yadro.ru", "cs.adingo.jp", "csi.gstatic.com", "d5p.de17a.com", "delivery-us-west-1.openx.net", "delivery.h.switchadhub.com", "dh.serving-sys.com", "dis.criteo.com", "dmp.brand-display.com", "dpm.demdex.net", "dsp.adfarm1.adition.com", "dsp.adkernel.com", "dsum-sec.casalemedia.com", "e.nexac.com", "e1.emxdgt.com", "eb2.3lift.com", "ebdr3.com", "eus.rubiconproject.com", "fastlane-adv.rubiconproject.com", "fonts.googleapis.com", "fonts.gstatic.com", "g2.gumgum.com", "googleads.g.doubleclick.net", "googleads4.g.doubleclick.net", "hb-api.omnitagjs.com", "hbevents.1rx.io", "i.w55c.net", "i.ytimg.com", "id.rlcdn.com", "idpix.media6degrees.com", "idsync.rlcdn.com", "iecvlist.microsoft.com", "image2.pubmatic.com", "image4.pubmatic.com", "image6.pubmatic.com", "images.outbrainimg.com", "images9.engageya.com", "imasdk.googleapis.com", "jadserve.postrelease.com", "launcher.spot.im", "lax1-ib.adnxs.com", "load77.exelator.com", "loadm.exelator.com", "m.adnxs.com", "match.adsrvr.org", "match.basebanner.com", "match.bnmla.com", "match.prod.bidr.io", "match.rundsp.com", "match.sharethrough.com", "match.taboola.com", "mc.yandex.ru", "melia.sp1.convertro.com", "mixi.media", "ml314.com", "mm.melia.com", "net.finam.ru", "odb.outbrain.com", "odr.mookie1.com", "optimized-by.rubiconproject.com", "ox.pxl.ace.advertising.com", "oxp.mxptint.net", "p.adsymptotic.com", "p.rfihub.com", "p.skimresources.com", "pagead2.googlesyndication.com", "phototass1.cdnvideo.ru", "phototass2.cdnvideo.ru", "phototass3.cdnvideo.ru", "phototass4.cdnvideo.ru", "ping.chartbeat.net", "pippio.com", "pix.impdesk.com", "pix.spot.im", "pixel-a.sitescout.com", "pixel-sc2.adsymptotic.com", "pixel-sync.sitescout.com", "pixel-us-east.rubiconproject.com", "pixel.advertising.com", "pixel.quantserve.com", "pixel.sitescout.com", "pixel.tapad.com", "pixeltrack.eyeviewads.com", "platform.twitter.com", "pm.w55c.net", "pmp.mxptint.net", "pp.lp4.io", "pr-bh.ybp.yahoo.com", "pre-usermatch.targeting.unrulymedia.com", "prod.y-medialink.com", "pubads.g.doubleclick.net", "pubmatic-match.dotomi.com", "pubmatic2waycm-atl.netmng.com", "px.adhigh.net", "px.moatads.com", "px.owneriq.net", "px.powerlinks.com", "pxl.connexity.net", "qcx.quantserve.com", "r.nexac.com", "rbp.mxptint.net", "recs.engageya.com", "relap.io", "rp.gwallet.com", "rtb-csync.smartadserver.com", "rtb.adentifi.com", "rtb.gumgum.com", "rtb.openx.net", "rtb0.doubleverify.com", "rtr.innovid.com", "rub.pxl.ace.advertising.com", "rubicon-match.dotomi.com", "rum-collector-2.pingdom.net", "rum-collector.pingdom.net", "rum-static.pingdom.net", "ruptly-d.openx.net", "s-static.innovid.com", "s.amazon-adsystem.com", "s.innovid.com", "s.thebrighttag.com", "s.ytimg.com", "s0.2mdn.net", "s2.adform.net", "saxp.zedo.com", "sb.scorecardresearch.com", "secure-assets.rubiconproject.com", "securepubads.g.doubleclick.net", "simage2.pubmatic.com", "simage4.pubmatic.com", "smi2.net", "smi2.ru", "ss3.zedo.com", "stags.bluekai.com", "stat.media", "static.chartbeat.com", "static.criteo.net", "static.doubleclick.net", "static.mixi.media", "static2.mixi.media", "static4.mixi.media", "static5.mixi.media", "staticxx.facebook.com", "stats.g.doubleclick.net", "su.addthis.com", "synacor.autoplay-plugins.static-origin.syn-cdn.com", "sync-tm.everesttech.net", "sync.1rx.io", "sync.adotmob.com", "sync.aralego.com", "sync.crwdcntrl.net", "sync.extend.tv", "sync.ipredictive.com", "sync.ligadx.com", "sync.mathtag.com", "sync.search.spotxchange.com", "sync.springserve.com", "sync.teads.tv", "sync.tidaltv.com", "synchroscript.deliveryengine.adswizz.com", "syndication.twitter.com", "t.cwkuki.com", "t.lkqd.net", "t.mookie1.com", "t.wayfair.com", "tag.1rx.io", "tags.bluekai.com", "tags.crwdcntrl.net", "target.mixi.media", "teutorigos-cat.com", "thrtle.com", "token.rubiconproject.com", "tpc.googlesyndication.com", "tps.doubleverify.com", "tps700.doubleverify.com", "tps702.doubleverify.com", "track.eyeviewads.com", "trc.taboola.com", "tru.am", "tt.onthe.io", "tt1.zedo.com", "tt3.zedo.com", "uat-net.technoratimedia.com", "uat-secure.technoratimedia.com", "ucs02.engageya.com", "um.simpli.fi", "us-u.openx.net", "v.lkqd.net", "vcdn.adnxs.com", "vid-io.springserve.com", "vid.springserve.com", "vk.com", "vpaid.springserve.net", "widget.engageya.com", "widgets.outbrain.com", "www.google-analytics.com", "www.google.com", "www.googletagservices.com", "www.rt.com", "www.tns-counter.ru", "www.youtube.com", "x.bidswitch.net", "x.dlx.addthis.com", "x.skimresources.com", "yastatic.net", "z.moatads.com", "zedo-d.openx.net" ] }, "rule_id": "multi-host-tls-cadence", "evidence": [ { "tcp_stream": 37, "frame_number": 550, "display_filter": "frame.number == 550", "timestamp_epoch": "1533964544.926326000" }, { "tcp_stream": 38, "frame_number": 552, "display_filter": "frame.number == 552", "timestamp_epoch": "1533964544.926457000" }, { "tcp_stream": 48, "frame_number": 624, "display_filter": "frame.number == 624", "timestamp_epoch": "1533964545.709230000" }, { "tcp_stream": 47, "frame_number": 626, "display_filter": "frame.number == 626", "timestamp_epoch": "1533964545.709442000" }, { "tcp_stream": 42, "frame_number": 636, "display_filter": "frame.number == 636", "timestamp_epoch": "1533964545.733784000" }, { "tcp_stream": 39, "frame_number": 638, "display_filter": "frame.number == 638", "timestamp_epoch": "1533964545.733803000" }, { "tcp_stream": 41, "frame_number": 642, "display_filter": "frame.number == 642", "timestamp_epoch": "1533964545.736658000" }, { "tcp_stream": 40, "frame_number": 646, "display_filter": "frame.number == 646", "timestamp_epoch": "1533964545.736960000" }, { "tcp_stream": 51, "frame_number": 651, "display_filter": "frame.number == 651", "timestamp_epoch": "1533964545.746485000" }, { "tcp_stream": 52, "frame_number": 659, "display_filter": "frame.number == 659", "timestamp_epoch": "1533964545.748147000" }, { "tcp_stream": 53, "frame_number": 692, "display_filter": "frame.number == 692", "timestamp_epoch": "1533964545.823140000" }, { "tcp_stream": 54, "frame_number": 696, "display_filter": "frame.number == 696", "timestamp_epoch": "1533964545.823802000" }, { "tcp_stream": 56, "frame_number": 698, "display_filter": "frame.number == 698", "timestamp_epoch": "1533964545.824007000" }, { "tcp_stream": 55, "frame_number": 699, "display_filter": "frame.number == 699", "timestamp_epoch": "1533964545.824041000" }, { "tcp_stream": 57, "frame_number": 702, "display_filter": "frame.number == 702", "timestamp_epoch": "1533964545.824352000" }, { "tcp_stream": 58, "frame_number": 704, "display_filter": "frame.number == 704", "timestamp_epoch": "1533964545.824437000" }, { "tcp_stream": 43, "frame_number": 712, "display_filter": "frame.number == 712", "timestamp_epoch": "1533964545.855496000" }, { "tcp_stream": 44, "frame_number": 730, "display_filter": "frame.number == 730", "timestamp_epoch": "1533964545.873598000" }, { "tcp_stream": 46, "frame_number": 741, "display_filter": "frame.number == 741", "timestamp_epoch": "1533964545.878035000" }, { "tcp_stream": 49, "frame_number": 747, "display_filter": "frame.number == 747", "timestamp_epoch": "1533964545.885142000" }, { "tcp_stream": 50, "frame_number": 758, "display_filter": "frame.number == 758", "timestamp_epoch": "1533964545.899143000" }, { "tcp_stream": 45, "frame_number": 770, "display_filter": "frame.number == 770", "timestamp_epoch": "1533964545.905290000" }, { "tcp_stream": 59, "frame_number": 1264, "display_filter": "frame.number == 1264", "timestamp_epoch": "1533964546.538622000" }, { "tcp_stream": 60, "frame_number": 1266, "display_filter": "frame.number == 1266", "timestamp_epoch": "1533964546.538863000" }, { "tcp_stream": 62, "frame_number": 2255, "display_filter": "frame.number == 2255", "timestamp_epoch": "1533964549.224979000" }, { "tcp_stream": 61, "frame_number": 2257, "display_filter": "frame.number == 2257", "timestamp_epoch": "1533964549.225497000" }, { "tcp_stream": 63, "frame_number": 2381, "display_filter": "frame.number == 2381", "timestamp_epoch": "1533964549.653129000" }, { "tcp_stream": 64, "frame_number": 2517, "display_filter": "frame.number == 2517", "timestamp_epoch": "1533964550.141655000" }, { "tcp_stream": 65, "frame_number": 2518, "display_filter": "frame.number == 2518", "timestamp_epoch": "1533964550.141657000" }, { "tcp_stream": 66, "frame_number": 3236, "display_filter": "frame.number == 3236", "timestamp_epoch": "1533964552.452729000" }, { "tcp_stream": 69, "frame_number": 3238, "display_filter": "frame.number == 3238", "timestamp_epoch": "1533964552.452910000" }, { "tcp_stream": 67, "frame_number": 3244, "display_filter": "frame.number == 3244", "timestamp_epoch": "1533964552.457149000" }, { "tcp_stream": 68, "frame_number": 3246, "display_filter": "frame.number == 3246", "timestamp_epoch": "1533964552.457436000" }, { "tcp_stream": 74, "frame_number": 3264, "display_filter": "frame.number == 3264", "timestamp_epoch": "1533964552.477001000" }, { "tcp_stream": 75, "frame_number": 3266, "display_filter": "frame.number == 3266", "timestamp_epoch": "1533964552.477100000" }, { "tcp_stream": 73, "frame_number": 3267, "display_filter": "frame.number == 3267", "timestamp_epoch": "1533964552.477139000" }, { "tcp_stream": 81, "frame_number": 3318, "display_filter": "frame.number == 3318", "timestamp_epoch": "1533964552.685613000" }, { "tcp_stream": 80, "frame_number": 3321, "display_filter": "frame.number == 3321", "timestamp_epoch": "1533964552.686031000" }, { "tcp_stream": 77, "frame_number": 3376, "display_filter": "frame.number == 3376", "timestamp_epoch": "1533964552.740894000" }, { "tcp_stream": 70, "frame_number": 3378, "display_filter": "frame.number == 3378", "timestamp_epoch": "1533964552.741152000" }, { "tcp_stream": 78, "frame_number": 3380, "display_filter": "frame.number == 3380", "timestamp_epoch": "1533964552.741239000" }, { "tcp_stream": 79, "frame_number": 3382, "display_filter": "frame.number == 3382", "timestamp_epoch": "1533964552.741451000" }, { "tcp_stream": 76, "frame_number": 3384, "display_filter": "frame.number == 3384", "timestamp_epoch": "1533964552.741554000" }, { "tcp_stream": 71, "frame_number": 3430, "display_filter": "frame.number == 3430", "timestamp_epoch": "1533964552.803227000" }, { "tcp_stream": 72, "frame_number": 3432, "display_filter": "frame.number == 3432", "timestamp_epoch": "1533964552.803334000" }, { "tcp_stream": 89, "frame_number": 3448, "display_filter": "frame.number == 3448", "timestamp_epoch": "1533964552.872865000" }, { "tcp_stream": 88, "frame_number": 3452, "display_filter": "frame.number == 3452", "timestamp_epoch": "1533964552.874123000" }, { "tcp_stream": 92, "frame_number": 3486, "display_filter": "frame.number == 3486", "timestamp_epoch": "1533964552.880734000" }, { "tcp_stream": 93, "frame_number": 3494, "display_filter": "frame.number == 3494", "timestamp_epoch": "1533964552.882566000" }, { "tcp_stream": 91, "frame_number": 3496, "display_filter": "frame.number == 3496", "timestamp_epoch": "1533964552.884239000" }, { "tcp_stream": 90, "frame_number": 3504, "display_filter": "frame.number == 3504", "timestamp_epoch": "1533964552.885100000" }, { "tcp_stream": 83, "frame_number": 3529, "display_filter": "frame.number == 3529", "timestamp_epoch": "1533964552.955577000" }, { "tcp_stream": 82, "frame_number": 3536, "display_filter": "frame.number == 3536", "timestamp_epoch": "1533964552.957535000" }, { "tcp_stream": 85, "frame_number": 3557, "display_filter": "frame.number == 3557", "timestamp_epoch": "1533964552.967444000" }, { "tcp_stream": 87, "frame_number": 3558, "display_filter": "frame.number == 3558", "timestamp_epoch": "1533964552.967445000" }, { "tcp_stream": 86, "frame_number": 3561, "display_filter": "frame.number == 3561", "timestamp_epoch": "1533964552.967829000" }, { "tcp_stream": 84, "frame_number": 3563, "display_filter": "frame.number == 3563", "timestamp_epoch": "1533964552.967938000" }, { "tcp_stream": 94, "frame_number": 3768, "display_filter": "frame.number == 3768", "timestamp_epoch": "1533964553.364593000" }, { "tcp_stream": 95, "frame_number": 3770, "display_filter": "frame.number == 3770", "timestamp_epoch": "1533964553.365363000" }, { "tcp_stream": 98, "frame_number": 3953, "display_filter": "frame.number == 3953", "timestamp_epoch": "1533964553.582136000" }, { "tcp_stream": 96, "frame_number": 3955, "display_filter": "frame.number == 3955", "timestamp_epoch": "1533964553.582237000" }, { "tcp_stream": 97, "frame_number": 3969, "display_filter": "frame.number == 3969", "timestamp_epoch": "1533964553.584391000" }, { "tcp_stream": 99, "frame_number": 4029, "display_filter": "frame.number == 4029", "timestamp_epoch": "1533964553.660668000" }, { "tcp_stream": 100, "frame_number": 4031, "display_filter": "frame.number == 4031", "timestamp_epoch": "1533964553.662840000" }, { "tcp_stream": 101, "frame_number": 4033, "display_filter": "frame.number == 4033", "timestamp_epoch": "1533964553.663008000" }, { "tcp_stream": 102, "frame_number": 4037, "display_filter": "frame.number == 4037", "timestamp_epoch": "1533964553.663428000" }, { "tcp_stream": 105, "frame_number": 4404, "display_filter": "frame.number == 4404", "timestamp_epoch": "1533964554.396779000" }, { "tcp_stream": 106, "frame_number": 4412, "display_filter": "frame.number == 4412", "timestamp_epoch": "1533964554.397822000" }, { "tcp_stream": 108, "frame_number": 4626, "display_filter": "frame.number == 4626", "timestamp_epoch": "1533964555.042529000" }, { "tcp_stream": 107, "frame_number": 4629, "display_filter": "frame.number == 4629", "timestamp_epoch": "1533964555.043031000" }, { "tcp_stream": 109, "frame_number": 4775, "display_filter": "frame.number == 4775", "timestamp_epoch": "1533964555.360271000" }, { "tcp_stream": 110, "frame_number": 4777, "display_filter": "frame.number == 4777", "timestamp_epoch": "1533964555.360273000" }, { "tcp_stream": 111, "frame_number": 4925, "display_filter": "frame.number == 4925", "timestamp_epoch": "1533964555.708590000" }, { "tcp_stream": 112, "frame_number": 4934, "display_filter": "frame.number == 4934", "timestamp_epoch": "1533964555.710501000" }, { "tcp_stream": 113, "frame_number": 4986, "display_filter": "frame.number == 4986", "timestamp_epoch": "1533964555.774473000" }, { "tcp_stream": 114, "frame_number": 4996, "display_filter": "frame.number == 4996", "timestamp_epoch": "1533964555.787234000" }, { "tcp_stream": 117, "frame_number": 5184, "display_filter": "frame.number == 5184", "timestamp_epoch": "1533964556.077465000" }, { "tcp_stream": 118, "frame_number": 5188, "display_filter": "frame.number == 5188", "timestamp_epoch": "1533964556.079603000" }, { "tcp_stream": 124, "frame_number": 5207, "display_filter": "frame.number == 5207", "timestamp_epoch": "1533964556.093107000" }, { "tcp_stream": 122, "frame_number": 5211, "display_filter": "frame.number == 5211", "timestamp_epoch": "1533964556.093873000" }, { "tcp_stream": 121, "frame_number": 5212, "display_filter": "frame.number == 5212", "timestamp_epoch": "1533964556.093986000" }, { "tcp_stream": 125, "frame_number": 5214, "display_filter": "frame.number == 5214", "timestamp_epoch": "1533964556.094107000" }, { "tcp_stream": 123, "frame_number": 5216, "display_filter": "frame.number == 5216", "timestamp_epoch": "1533964556.094416000" }, { "tcp_stream": 126, "frame_number": 5218, "display_filter": "frame.number == 5218", "timestamp_epoch": "1533964556.094443000" }, { "tcp_stream": 115, "frame_number": 5234, "display_filter": "frame.number == 5234", "timestamp_epoch": "1533964556.109083000" }, { "tcp_stream": 116, "frame_number": 5237, "display_filter": "frame.number == 5237", "timestamp_epoch": "1533964556.109634000" }, { "tcp_stream": 120, "frame_number": 5245, "display_filter": "frame.number == 5245", "timestamp_epoch": "1533964556.112608000" }, { "tcp_stream": 119, "frame_number": 5246, "display_filter": "frame.number == 5246", "timestamp_epoch": "1533964556.112610000" }, { "tcp_stream": 129, "frame_number": 5477, "display_filter": "frame.number == 5477", "timestamp_epoch": "1533964556.949763000" }, { "tcp_stream": 131, "frame_number": 5484, "display_filter": "frame.number == 5484", "timestamp_epoch": "1533964556.953322000" }, { "tcp_stream": 130, "frame_number": 5489, "display_filter": "frame.number == 5489", "timestamp_epoch": "1533964556.954242000" }, { "tcp_stream": 132, "frame_number": 5541, "display_filter": "frame.number == 5541", "timestamp_epoch": "1533964557.014836000" }, { "tcp_stream": 133, "frame_number": 5551, "display_filter": "frame.number == 5551", "timestamp_epoch": "1533964557.021044000" }, { "tcp_stream": 135, "frame_number": 5705, "display_filter": "frame.number == 5705", "timestamp_epoch": "1533964558.825936000" }, { "tcp_stream": 134, "frame_number": 5707, "display_filter": "frame.number == 5707", "timestamp_epoch": "1533964558.827148000" }, { "tcp_stream": 138, "frame_number": 5881, "display_filter": "frame.number == 5881", "timestamp_epoch": "1533964559.508438000" }, { "tcp_stream": 142, "frame_number": 5883, "display_filter": "frame.number == 5883", "timestamp_epoch": "1533964559.508584000" }, { "tcp_stream": 139, "frame_number": 5887, "display_filter": "frame.number == 5887", "timestamp_epoch": "1533964559.509117000" }, { "tcp_stream": 143, "frame_number": 5891, "display_filter": "frame.number == 5891", "timestamp_epoch": "1533964559.512892000" }, { "tcp_stream": 145, "frame_number": 5900, "display_filter": "frame.number == 5900", "timestamp_epoch": "1533964559.530894000" } ], "severity": "medium", "confidence": 0.6, "finding_id": "finding-92fa16c676a3ff5fd9bd920b", "explanation": "A client fingerprint repeats connections across several names at regular per-name intervals. Telemetry and legitimate agents can do this; TLS payload content and attribution remain unknown.", "rule_version": "pcap-rules-v5" }, { "title": "Directory-service protocol activity", "status": "candidate", "metrics": { "source": "192.168.1.6", "protocol": "drsuapi", "destination": "192.168.1.95", "event_count": 8, "operation_numbers": [ "0", "1", "12" ] }, "rule_id": "directory-service-activity", "evidence": [ { "tcp_stream": 9, "frame_number": 166, "display_filter": "frame.number == 166", "timestamp_epoch": "1533964509.620754000" }, { "tcp_stream": 9, "frame_number": 168, "display_filter": "frame.number == 168", "timestamp_epoch": "1533964509.621271000" }, { "tcp_stream": 9, "frame_number": 170, "display_filter": "frame.number == 170", "timestamp_epoch": "1533964509.621780000" }, { "tcp_stream": 9, "frame_number": 172, "display_filter": "frame.number == 172", "timestamp_epoch": "1533964509.622205000" }, { "tcp_stream": 9, "frame_number": 445, "display_filter": "frame.number == 445", "timestamp_epoch": "1533964528.985479000" }, { "tcp_stream": 9, "frame_number": 447, "display_filter": "frame.number == 447", "timestamp_epoch": "1533964528.985973000" }, { "tcp_stream": 9, "frame_number": 449, "display_filter": "frame.number == 449", "timestamp_epoch": "1533964528.986457000" }, { "tcp_stream": 9, "frame_number": 451, "display_filter": "frame.number == 451", "timestamp_epoch": "1533964528.986777000" } ], "severity": "low", "confidence": 0.95, "finding_id": "finding-d69273f6229c2f1f6dc6cfd4", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "rule_version": "pcap-rules-v5" }, { "title": "Directory-service protocol activity", "status": "candidate", "metrics": { "source": "192.168.1.6", "protocol": "ldap", "destination": "192.168.1.95", "event_count": 33, "operation_numbers": [ "", "1", "4,19,19,19,5", "4,5", "5" ] }, "rule_id": "directory-service-activity", "evidence": [ { "tcp_stream": 5, "frame_number": 84, "display_filter": "frame.number == 84", "timestamp_epoch": "1533964509.289255000" }, { "tcp_stream": 5, "frame_number": 98, "display_filter": "frame.number == 98", "timestamp_epoch": "1533964509.293214000" }, { "tcp_stream": 13, "frame_number": 187, "display_filter": "frame.number == 187", "timestamp_epoch": "1533964510.594193000" }, { "tcp_stream": 13, "frame_number": 191, "display_filter": "frame.number == 191", "timestamp_epoch": "1533964510.595761000" }, { "tcp_stream": 13, "frame_number": 203, "display_filter": "frame.number == 203", "timestamp_epoch": "1533964510.605457000" }, { "tcp_stream": 16, "frame_number": 228, "display_filter": "frame.number == 228", "timestamp_epoch": "1533964510.610220000" }, { "tcp_stream": 16, "frame_number": 230, "display_filter": "frame.number == 230", "timestamp_epoch": "1533964510.610839000" }, { "tcp_stream": 16, "frame_number": 232, "display_filter": "frame.number == 232", "timestamp_epoch": "1533964510.611281000" }, { "tcp_stream": 13, "frame_number": 234, "display_filter": "frame.number == 234", "timestamp_epoch": "1533964510.611824000" }, { "tcp_stream": 21, "frame_number": 318, "display_filter": "frame.number == 318", "timestamp_epoch": "1533964517.005160000" }, { "tcp_stream": 21, "frame_number": 322, "display_filter": "frame.number == 322", "timestamp_epoch": "1533964517.007228000" }, { "tcp_stream": 21, "frame_number": 324, "display_filter": "frame.number == 324", "timestamp_epoch": "1533964517.008777000" }, { "tcp_stream": 21, "frame_number": 326, "display_filter": "frame.number == 326", "timestamp_epoch": "1533964517.009323000" }, { "tcp_stream": 21, "frame_number": 328, "display_filter": "frame.number == 328", "timestamp_epoch": "1533964517.009686000" }, { "tcp_stream": 21, "frame_number": 330, "display_filter": "frame.number == 330", "timestamp_epoch": "1533964517.010757000" }, { "tcp_stream": 22, "frame_number": 338, "display_filter": "frame.number == 338", "timestamp_epoch": "1533964517.021989000" }, { "tcp_stream": 22, "frame_number": 340, "display_filter": "frame.number == 340", "timestamp_epoch": "1533964517.022558000" }, { "tcp_stream": 22, "frame_number": 369, "display_filter": "frame.number == 369", "timestamp_epoch": "1533964517.046764000" }, { "tcp_stream": 31, "frame_number": 473, "display_filter": "frame.number == 473", "timestamp_epoch": "1533964529.529903000" }, { "tcp_stream": 31, "frame_number": 475, "display_filter": "frame.number == 475", "timestamp_epoch": "1533964529.537995000" }, { "tcp_stream": 33, "frame_number": 481, "display_filter": "frame.number == 481", "timestamp_epoch": "1533964529.543547000" }, { "tcp_stream": 33, "frame_number": 483, "display_filter": "frame.number == 483", "timestamp_epoch": "1533964529.544436000" }, { "tcp_stream": 33, "frame_number": 485, "display_filter": "frame.number == 485", "timestamp_epoch": "1533964529.544824000" }, { "tcp_stream": 31, "frame_number": 487, "display_filter": "frame.number == 487", "timestamp_epoch": "1533964529.545617000" }, { "tcp_stream": 1037, "frame_number": 39563, "display_filter": "frame.number == 39563", "timestamp_epoch": "1533965407.382541000" }, { "tcp_stream": 1037, "frame_number": 39577, "display_filter": "frame.number == 39577", "timestamp_epoch": "1533965407.386782000" }, { "tcp_stream": 1037, "frame_number": 39579, "display_filter": "frame.number == 39579", "timestamp_epoch": "1533965407.387374000" }, { "tcp_stream": 1037, "frame_number": 39581, "display_filter": "frame.number == 39581", "timestamp_epoch": "1533965407.388139000" }, { "tcp_stream": 1037, "frame_number": 39593, "display_filter": "frame.number == 39593", "timestamp_epoch": "1533965407.490531000" }, { "tcp_stream": 1037, "frame_number": 39607, "display_filter": "frame.number == 39607", "timestamp_epoch": "1533965407.597859000" }, { "tcp_stream": 1037, "frame_number": 39615, "display_filter": "frame.number == 39615", "timestamp_epoch": "1533965407.599801000" }, { "tcp_stream": 1037, "frame_number": 39623, "display_filter": "frame.number == 39623", "timestamp_epoch": "1533965407.602381000" }, { "tcp_stream": 1037, "frame_number": 39625, "display_filter": "frame.number == 39625", "timestamp_epoch": "1533965407.603086000" } ], "severity": "low", "confidence": 0.95, "finding_id": "finding-0cac5db4352164069a35e389", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "rule_version": "pcap-rules-v5" }, { "title": "Directory-service protocol activity", "status": "candidate", "metrics": { "source": "192.168.1.95", "protocol": "drsuapi", "destination": "192.168.1.6", "event_count": 8, "operation_numbers": [ "0", "1", "12" ] }, "rule_id": "directory-service-activity", "evidence": [ { "tcp_stream": 9, "frame_number": 165, "display_filter": "frame.number == 165", "timestamp_epoch": "1533964509.620535000" }, { "tcp_stream": 9, "frame_number": 167, "display_filter": "frame.number == 167", "timestamp_epoch": "1533964509.620952000" }, { "tcp_stream": 9, "frame_number": 169, "display_filter": "frame.number == 169", "timestamp_epoch": "1533964509.621511000" }, { "tcp_stream": 9, "frame_number": 171, "display_filter": "frame.number == 171", "timestamp_epoch": "1533964509.622050000" }, { "tcp_stream": 9, "frame_number": 444, "display_filter": "frame.number == 444", "timestamp_epoch": "1533964528.985245000" }, { "tcp_stream": 9, "frame_number": 446, "display_filter": "frame.number == 446", "timestamp_epoch": "1533964528.985673000" }, { "tcp_stream": 9, "frame_number": 448, "display_filter": "frame.number == 448", "timestamp_epoch": "1533964528.986102000" }, { "tcp_stream": 9, "frame_number": 450, "display_filter": "frame.number == 450", "timestamp_epoch": "1533964528.986584000" } ], "severity": "low", "confidence": 0.95, "finding_id": "finding-44c1fa1c3f11deb13e7681bb", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "rule_version": "pcap-rules-v5" }, { "title": "Directory-service protocol activity", "status": "candidate", "metrics": { "source": "192.168.1.95", "protocol": "ldap", "destination": "192.168.1.6", "event_count": 41, "operation_numbers": [ "", "0", "2", "3" ] }, "rule_id": "directory-service-activity", "evidence": [ { "tcp_stream": 5, "frame_number": 83, "display_filter": "frame.number == 83", "timestamp_epoch": "1533964509.288970000" }, { "tcp_stream": 5, "frame_number": 96, "display_filter": "frame.number == 96", "timestamp_epoch": "1533964509.292603000" }, { "tcp_stream": 5, "frame_number": 99, "display_filter": "frame.number == 99", "timestamp_epoch": "1533964509.295044000" }, { "tcp_stream": 13, "frame_number": 186, "display_filter": "frame.number == 186", "timestamp_epoch": "1533964510.593774000" }, { "tcp_stream": 13, "frame_number": 189, "display_filter": "frame.number == 189", "timestamp_epoch": "1533964510.595028000" }, { "tcp_stream": 13, "frame_number": 202, "display_filter": "frame.number == 202", "timestamp_epoch": "1533964510.605118000" }, { "tcp_stream": 16, "frame_number": 223, "display_filter": "frame.number == 223", "timestamp_epoch": "1533964510.609304000" }, { "tcp_stream": 16, "frame_number": 229, "display_filter": "frame.number == 229", "timestamp_epoch": "1533964510.610678000" }, { "tcp_stream": 16, "frame_number": 231, "display_filter": "frame.number == 231", "timestamp_epoch": "1533964510.611062000" }, { "tcp_stream": 13, "frame_number": 233, "display_filter": "frame.number == 233", "timestamp_epoch": "1533964510.611544000" }, { "tcp_stream": 16, "frame_number": 276, "display_filter": "frame.number == 276", "timestamp_epoch": "1533964510.622861000" }, { "tcp_stream": 13, "frame_number": 280, "display_filter": "frame.number == 280", "timestamp_epoch": "1533964511.138137000" }, { "tcp_stream": 21, "frame_number": 317, "display_filter": "frame.number == 317", "timestamp_epoch": "1533964517.004734000" }, { "tcp_stream": 21, "frame_number": 320, "display_filter": "frame.number == 320", "timestamp_epoch": "1533964517.006592000" }, { "tcp_stream": 21, "frame_number": 323, "display_filter": "frame.number == 323", "timestamp_epoch": "1533964517.008621000" }, { "tcp_stream": 21, "frame_number": 325, "display_filter": "frame.number == 325", "timestamp_epoch": "1533964517.009167000" }, { "tcp_stream": 21, "frame_number": 327, "display_filter": "frame.number == 327", "timestamp_epoch": "1533964517.009497000" }, { "tcp_stream": 21, "frame_number": 329, "display_filter": "frame.number == 329", "timestamp_epoch": "1533964517.009929000" }, { "tcp_stream": 22, "frame_number": 336, "display_filter": "frame.number == 336", "timestamp_epoch": "1533964517.021374000" }, { "tcp_stream": 22, "frame_number": 339, "display_filter": "frame.number == 339", "timestamp_epoch": "1533964517.022382000" }, { "tcp_stream": 22, "frame_number": 368, "display_filter": "frame.number == 368", "timestamp_epoch": "1533964517.045974000" }, { "tcp_stream": 22, "frame_number": 370, "display_filter": "frame.number == 370", "timestamp_epoch": "1533964517.047019000" }, { "tcp_stream": 21, "frame_number": 372, "display_filter": "frame.number == 372", "timestamp_epoch": "1533964517.047598000" }, { "tcp_stream": 31, "frame_number": 471, "display_filter": "frame.number == 471", "timestamp_epoch": "1533964529.529068000" }, { "tcp_stream": 31, "frame_number": 474, "display_filter": "frame.number == 474", "timestamp_epoch": "1533964529.537653000" }, { "tcp_stream": 33, "frame_number": 479, "display_filter": "frame.number == 479", "timestamp_epoch": "1533964529.542989000" }, { "tcp_stream": 33, "frame_number": 482, "display_filter": "frame.number == 482", "timestamp_epoch": "1533964529.544279000" }, { "tcp_stream": 33, "frame_number": 484, "display_filter": "frame.number == 484", "timestamp_epoch": "1533964529.544672000" }, { "tcp_stream": 31, "frame_number": 486, "display_filter": "frame.number == 486", "timestamp_epoch": "1533964529.545298000" }, { "tcp_stream": 33, "frame_number": 523, "display_filter": "frame.number == 523", "timestamp_epoch": "1533964529.554461000" }, { "tcp_stream": 31, "frame_number": 528, "display_filter": "frame.number == 528", "timestamp_epoch": "1533964530.061030000" }, { "tcp_stream": 1037, "frame_number": 39562, "display_filter": "frame.number == 39562", "timestamp_epoch": "1533965407.382281000" }, { "tcp_stream": 1037, "frame_number": 39575, "display_filter": "frame.number == 39575", "timestamp_epoch": "1533965407.386100000" }, { "tcp_stream": 1037, "frame_number": 39578, "display_filter": "frame.number == 39578", "timestamp_epoch": "1533965407.387136000" }, { "tcp_stream": 1037, "frame_number": 39580, "display_filter": "frame.number == 39580", "timestamp_epoch": "1533965407.387659000" }, { "tcp_stream": 1037, "frame_number": 39590, "display_filter": "frame.number == 39590", "timestamp_epoch": "1533965407.489451000" }, { "tcp_stream": 1037, "frame_number": 39604, "display_filter": "frame.number == 39604", "timestamp_epoch": "1533965407.596998000" }, { "tcp_stream": 1037, "frame_number": 39614, "display_filter": "frame.number == 39614", "timestamp_epoch": "1533965407.599471000" }, { "tcp_stream": 1037, "frame_number": 39621, "display_filter": "frame.number == 39621", "timestamp_epoch": "1533965407.601733000" }, { "tcp_stream": 1037, "frame_number": 39624, "display_filter": "frame.number == 39624", "timestamp_epoch": "1533965407.602649000" }, { "tcp_stream": 1037, "frame_number": 39626, "display_filter": "frame.number == 39626", "timestamp_epoch": "1533965407.603236000" } ], "severity": "low", "confidence": 0.95, "finding_id": "finding-086a44ccacf8e130f7763d1d", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "rule_version": "pcap-rules-v5" }, { "title": "Sustained external TCP conversation outside decoded application coverage", "status": "candidate", "metrics": { "source": "192.168.1.95", "packets": 22, "wire_bytes": 7427, "destination": "207.244.102.143", "destination_port": 443, "duration_seconds": 49.953 }, "rule_id": "unclassified-external-tcp", "evidence": [ { "tcp_stream": 882, "frame_number": 32315, "display_filter": "tcp.stream == 882", "timestamp_epoch": "1533965107.408281" } ], "severity": "medium", "confidence": 0.7, "finding_id": "finding-2110a36a2975eaeb0d73edf9", "explanation": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.", "rule_version": "pcap-rules-v5" } ], "artifacts": [ { "md5": "937cfd8c2d60d04068169c159d51308b", "sha1": "e4cc38a71bbe474ca7daab4dd6628c35a51afe27", "type": "http-exported-object", "sha256": "225bd232b88e6072f4601058ebf7a0db0fa5cb3bf7537350c7de0bf5f2f5c54a", "evidence": [ { "tcp_stream": 1147, "frame_number": 44010, "display_filter": "frame.number == 44010", "timestamp_epoch": "1533965783.936535000" } ], "filename": "gtm.js%3fid=GTM-KX9ZXT", "filenames": [ "gtm.js%3fid=GTM-KX9ZXT" ], "transfers": [ { "url": "http://www.googletagmanager.com/gtm.js?id=GTM-KX9ZXT", "client_ip": "192.168.1.95", "server_ip": "216.58.192.8", "tcp_stream": 1147, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 43686, "response_frame": 44010 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 401284, "artifact_id": "artifact-31a4a12d7a90521ccf346c19", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [ { "offset": 107, "excerpt": "eval(", "feature": "dynamic-evaluation" } ], "content_kind": "script-like-text", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 262144, "inspection_truncated": true }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "564019f236046fdd622404a4925dfe36", "sha1": "9d25368a5f7c928f5dc37c3081c6a70b8ced2bf7", "type": "http-exported-object", "sha256": "87da7fce38fb944279568a460f952df3009b4398083bbe5dedb489fde5f46814", "evidence": [ { "tcp_stream": 1151, "frame_number": 43966, "display_filter": "frame.number == 43966", "timestamp_epoch": "1533965783.858453000" } ], "filename": "sdk.js", "filenames": [ "sdk.js" ], "transfers": [ { "url": "http://connect.facebook.net/en_US/sdk.js", "client_ip": "192.168.1.95", "server_ip": "157.240.11.22", "tcp_stream": 1151, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 43690, "response_frame": 43966 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "text/javascript", "size_bytes": 222891, "artifact_id": "artifact-cadc37ef2db510406ba78e1c", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 222891, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [ { "offset": 205419, "excerpt": "eval(", "feature": "dynamic-evaluation" } ], "content_kind": "script-like-text", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 222891, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "5473299167525c8d0addb8248900606a", "sha1": "fa99241ee9581f281544423881cf702375d33c23", "type": "http-exported-object", "sha256": "bc1fc69f9747dc034ece7d9bb795c5e596d9be6ca71efe75c6c0fd18f3cbfbf5", "evidence": [ { "tcp_stream": 179, "frame_number": 7325, "display_filter": "frame.number == 7325", "timestamp_epoch": "1533964860.776598000" } ], "filename": "a3.dat", "filenames": [ "a3.dat" ], "transfers": [ { "url": "http://r53x.com/a3.dat", "client_ip": "192.168.1.95", "server_ip": "149.129.222.112", "tcp_stream": 179, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 7280, "response_frame": 7325 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 104048, "artifact_id": "artifact-f7137015f0e1869f85b08850", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 104048, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": "executable", "features": [], "content_kind": "pe", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 104048, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "63664393c63e67de2220279605bcdd0a", "sha1": "3098130b71a6c55c28b476748f70823ecf8275c3", "type": "http-exported-object", "sha256": "8ed22d97053651c1bf38b50de0630657e03c9dc1b82f2c80241d72dd68c34fc8", "evidence": [ { "tcp_stream": 1133, "frame_number": 43154, "display_filter": "frame.number == 43154", "timestamp_epoch": "1533965778.041937000" } ], "filename": "angular-1.2.4.min.js%3fv=1533913284", "filenames": [ "angular-1.2.4.min.js%3fv=1533913284" ], "transfers": [ { "url": "http://tass.com/js/angular-1.2.4.min.js?v=1533913284", "client_ip": "192.168.1.95", "server_ip": "103.5.149.72", "tcp_stream": 1133, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 41784, "response_frame": 43154 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 99790, "artifact_id": "artifact-81b03a5bc900d779112ee655", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 99790, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [ { "offset": 47556, "excerpt": "eval(", "feature": "dynamic-evaluation" } ], "content_kind": "script-like-text", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 99790, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "5efb803ef77f2864d09850c27aaa2459", "sha1": "fe19f37b9339a8ed146765594f15c7af6d4f0e93", "type": "http-exported-object", "sha256": "1d762c3dcf8ec1d7cf68b813aed274886103a60b67c11ff9f166398e96fdedaf", "evidence": [ { "tcp_stream": 1076, "frame_number": 40506, "display_filter": "frame.number == 40506", "timestamp_epoch": "1533965771.061475000" } ], "filename": "openapi.js%3fv=1533913284", "filenames": [ "openapi.js%3fv=1533913284" ], "transfers": [ { "url": "http://vk.com/js/api/openapi.js?v=1533913284", "client_ip": "192.168.1.95", "server_ip": "87.240.129.133", "tcp_stream": 1076, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 40209, "response_frame": 40506 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 95382, "artifact_id": "artifact-b40f64f91a680c96de36ab82", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 95382, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [ { "offset": 29791, "excerpt": "eval(", "feature": "dynamic-evaluation" } ], "content_kind": "script-like-text", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 95382, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "c53003b9bc15025f27eece7e47ea92c6", "sha1": "baf2cfd86bbce816513cd99b19ddfe182aa4d2a4", "type": "http-exported-object", "sha256": "fb03a6b96e7aa8dc5c4e079289c84f446a7374d65f7bb79a734c34c9fb8e7703", "evidence": [ { "tcp_stream": 1134, "frame_number": 42702, "display_filter": "frame.number == 42702", "timestamp_epoch": "1533965776.948117000" } ], "filename": "mainDirect.js%3fv=1533913284", "filenames": [ "mainDirect.js%3fv=1533913284" ], "transfers": [ { "url": "http://tass.com/js/common/mainDirect.js?v=1533913284", "client_ip": "192.168.1.95", "server_ip": "103.5.149.72", "tcp_stream": 1134, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 42021, "response_frame": 42702 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 19588, "artifact_id": "artifact-37a0ae2c68a0b5dfaa4c1fe9", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 19588, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [ { "offset": 634, "excerpt": "eval(", "feature": "dynamic-evaluation" } ], "content_kind": "script-like-text", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 19588, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "66f5668ac5056b7badf79cbed592104a", "sha1": "729ebe0cb523e9ca7c6bf434917ae81daac9f96f", "type": "http-exported-object", "sha256": "beff9a913c0887163fd4a17d037f2188ed9e93f6c57f770448c2f7046ca7d141", "evidence": [ { "tcp_stream": 1073, "frame_number": 41786, "display_filter": "frame.number == 41786", "timestamp_epoch": "1533965774.640490000" } ], "filename": "infinite-scroll.js%3fv=1533913284", "filenames": [ "infinite-scroll.js%3fv=1533913284" ], "transfers": [ { "url": "http://tass.com/js/common/infinite-scroll.js?v=1533913284", "client_ip": "192.168.1.95", "server_ip": "103.5.149.72", "tcp_stream": 1073, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 41347, "response_frame": 41786 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 572, "artifact_id": "artifact-203f7a5b74b108b2bd574132", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 572, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [ { "offset": 355, "excerpt": "eval(", "feature": "dynamic-evaluation" } ], "content_kind": "script-like-text", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 572, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "b3022d6e52378fe96ce7d21355c91361", "sha1": "7cd1a717f77e35646866e5b810df89fd7df8b27c", "type": "http-exported-object", "sha256": "c0d599b80025a70004d813d62b587af4f8ae8abd64f514f280b6e4899436623f", "evidence": [ { "tcp_stream": 179, "frame_number": 7279, "display_filter": "frame.number == 7279", "timestamp_epoch": "1533964858.677650000" } ], "filename": "1.zip", "filenames": [ "1.zip" ], "transfers": [ { "url": "http://r53x.com/1.zip", "client_ip": "192.168.1.95", "server_ip": "149.129.222.112", "tcp_stream": 179, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 7277, "response_frame": 7279 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/zip", "size_bytes": 299, "artifact_id": "artifact-8414822ad628d253d08f5e7a", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 299, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [ { "offset": 184, "excerpt": "DownloadFile", "feature": "powershell-download" } ], "content_kind": "script-like-text", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 299, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "4b8139414b01d7728ce273c2a0f565c2", "sha1": "a5404c174b4acaaa5f26efb95c6aa589c1230152", "type": "http-exported-object", "sha256": "b908d9b1001d0a39ba92501c086b1c25b05b171eeda035ae9f3e129d2776a314", "evidence": [ { "tcp_stream": 178, "frame_number": 7266, "display_filter": "frame.number == 7266", "timestamp_epoch": "1533964851.215554000" } ], "filename": "1(1).rar", "filenames": [ "1(1).rar" ], "transfers": [ { "url": "http://r53x.com/1.rar", "client_ip": "192.168.1.95", "server_ip": "149.129.222.112", "tcp_stream": 178, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 7263, "response_frame": 7266 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 154, "artifact_id": "artifact-b8c70bac7d2ead3799659b33", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 154, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [ { "offset": 108, "excerpt": "downloadstring", "feature": "powershell-download" }, { "offset": 76, "excerpt": "IEX", "feature": "dynamic-evaluation" } ], "content_kind": "script-like-text", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 154, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "4d6877668d58be1c8add1842b356295e", "sha1": "b282418ff07e48b0c9dcb5560baf5c2c93f36ac6", "type": "http-exported-object", "sha256": "c87f78fc36289e69a164914c940e5cecd31024d0a06089c2fab4dcd23e507ae6", "evidence": [ { "tcp_stream": 1073, "frame_number": 41020, "display_filter": "frame.number == 41020", "timestamp_epoch": "1533965773.992817000" } ], "filename": "layout.min.css%3fv=1533913284", "filenames": [ "layout.min.css%3fv=1533913284" ], "transfers": [ { "url": "http://tass.com/assets/14df3cc8/layout.min.css?v=1533913284", "client_ip": "192.168.1.95", "server_ip": "103.5.149.72", "tcp_stream": 1073, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 40173, "response_frame": 41020 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 216785, "artifact_id": "artifact-95edf276c00493ffe88932d3", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 216785, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 216785, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "35d1e2a5f6babed038652f187d9401dd", "sha1": "de6d849aed84c7a87790131ad7e89d54bb2b93bf", "type": "http-exported-object", "sha256": "cc59dfc0669d00ad2b72411ff19cf555e4d0f1b940f0c674904004c73a3edb07", "evidence": [ { "tcp_stream": 1130, "frame_number": 43539, "display_filter": "frame.number == 43539", "timestamp_epoch": "1533965779.484237000" } ], "filename": "libs.min.js%3fv=1533913284", "filenames": [ "libs.min.js%3fv=1533913284" ], "transfers": [ { "url": "http://tass.com/assets/bfcd510f/libs.min.js?v=1533913284", "client_ip": "192.168.1.95", "server_ip": "103.5.149.72", "tcp_stream": 1130, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 42524, "response_frame": 43539 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 192101, "artifact_id": "artifact-7c1ddb90d635294ace68383e", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 192101, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 192101, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "bdd06f45e34c33dfaaac249f3eb50040", "sha1": "9305510952cfeb4ed26cc43965d070afadc1e021", "type": "http-exported-object", "sha256": "af5e4f327b79424352a42bf43df71e6a2f52d6f8948b82d6a42b4c2e97f7bfea", "evidence": [ { "tcp_stream": 1070, "frame_number": 43271, "display_filter": "frame.number == 43271", "timestamp_epoch": "1533965778.485448000" } ], "filename": "highcharts.js%3fv=1533913284", "filenames": [ "highcharts.js%3fv=1533913284" ], "transfers": [ { "url": "http://tass.com/js/highcharts/highcharts.js?v=1533913284", "client_ip": "192.168.1.95", "server_ip": "103.5.149.72", "tcp_stream": 1070, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 42266, "response_frame": 43271 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 153909, "artifact_id": "artifact-362b7648a433a8471d00b600", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 153909, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 153909, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "9ffa7d68589ad062d994a6eb0a097e12", "sha1": "50ee146fa2e6903813f79c7ce4cdd77a0aa26f8e", "type": "http-exported-object", "sha256": "1dc9f4fe16b9590b8044c7389d2d1c37fb18ef5dad0ef801a6071f4df7c7a9d5", "evidence": [ { "tcp_stream": 1070, "frame_number": 46359, "display_filter": "frame.number == 46359", "timestamp_epoch": "1533965790.986215000" } ], "filename": "1016847", "filenames": [ "1016847" ], "transfers": [ { "url": "http://tass.com/economy/1016847", "client_ip": "192.168.1.95", "server_ip": "103.5.149.72", "tcp_stream": 1070, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 46268, "response_frame": 46359 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 127688, "artifact_id": "artifact-4e0465076a2b4ed33139f41d", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 127688, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 127688, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "6a149d6ef4cd817b9ca0747ca86325e5", "sha1": "b01ea2aeccec8b33e543f4988eff30a68317a37c", "type": "http-exported-object", "sha256": "7d856e9985a83e2e6fa80ea41c6e67c8db9e19d9f30ce8d0a8d87ad942a00a31", "evidence": [ { "tcp_stream": 1150, "frame_number": 43810, "display_filter": "frame.number == 43810", "timestamp_epoch": "1533965783.596265000" } ], "filename": "widgets.js", "filenames": [ "widgets.js" ], "transfers": [ { "url": "http://platform.twitter.com/widgets.js", "client_ip": "192.168.1.95", "server_ip": "192.229.163.25", "tcp_stream": 1150, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 43698, "response_frame": 43810 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "text/javascript", "size_bytes": 121199, "artifact_id": "artifact-3e3e1a6a50bb031e6ca8433c", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 121199, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 121199, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "3576a6e73c9dccdbbc4a2cf8ff544ad7", "sha1": "06e872300088b9ba8a08427d28ed0efcdf9c6ff5", "type": "http-exported-object", "sha256": "61c6caebd23921741fb5ffe6603f16634fca9840c2bf56ac8201e9264d6daccf", "evidence": [ { "tcp_stream": 1070, "frame_number": 41024, "display_filter": "frame.number == 41024", "timestamp_epoch": "1533965774.001669000" } ], "filename": "jquery-1.8.3.min.js%3fv=1533913284", "filenames": [ "jquery-1.8.3.min.js%3fv=1533913284" ], "transfers": [ { "url": "http://tass.com/js/jquery-1.8.3.min.js?v=1533913284", "client_ip": "192.168.1.95", "server_ip": "103.5.149.72", "tcp_stream": 1070, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 40113, "response_frame": 41024 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 93636, "artifact_id": "artifact-e9ecb3fe55afb4d6756ad3d4", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 93636, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 93636, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "1f2043250a82536d35df77a7888a4964", "sha1": "b7a1fbfd8329d0a92ed755ec6ba432ae8dfab606", "type": "http-exported-object", "sha256": "17f91f2405171b6857a93cb8c9b306144951f1e272a039a61a7753ba04eb0b52", "evidence": [ { "tcp_stream": 1071, "frame_number": 43633, "display_filter": "frame.number == 43633", "timestamp_epoch": "1533965782.904170000" } ], "filename": "jquery-ui.min.js%3fv=1533913284", "filenames": [ "jquery-ui.min.js%3fv=1533913284" ], "transfers": [ { "url": "http://tass.com/js/jquery-ui.min.js?v=1533913284", "client_ip": "192.168.1.95", "server_ip": "103.5.149.72", "tcp_stream": 1071, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 41126, "response_frame": 43633 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 88650, "artifact_id": "artifact-c79bf9ac28694094d8d67b27", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 88650, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 88650, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "e8b3f0da267d0861529b2b94a351eb84", "sha1": "4d4e996d695bc73f01692998b956b4b424bcbffe", "type": "http-exported-object", "sha256": "110c07b1c1d0b56bb1755a621024babe4a7f60cacd8ffe605ef41826d3fe6784", "evidence": [ { "tcp_stream": 1133, "frame_number": 46463, "display_filter": "frame.number == 46463", "timestamp_epoch": "1533965791.436706000" } ], "filename": "material.min.css%3fv=1533913284", "filenames": [ "material.min.css%3fv=1533913284" ], "transfers": [ { "url": "http://tass.com/assets/88a00814/material.min.css?v=1533913284", "client_ip": "192.168.1.95", "server_ip": "103.5.149.72", "tcp_stream": 1133, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 46355, "response_frame": 46463 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 76152, "artifact_id": "artifact-f73231b93c0907d153afb23c", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 76152, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 76152, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "6d7a638336386d34c7413eb162eef754", "sha1": "715452ba7b50babe4b3b78f8aab648b3a516899e", "type": "http-exported-object", "sha256": "2ea3ff820ddb55c4c951ff1c0fbfe8590ebff986b806fb351f2f32aded2fefc4", "evidence": [ { "tcp_stream": 1187, "frame_number": 45009, "display_filter": "frame.number == 45009", "timestamp_epoch": "1533965786.714272000" } ], "filename": "osd.js", "filenames": [ "osd.js" ], "transfers": [ { "url": "http://pagead2.googlesyndication.com/pagead/osd.js", "client_ip": "192.168.1.95", "server_ip": "216.58.194.162", "tcp_stream": 1187, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 44800, "response_frame": 45009 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "text/javascript", "size_bytes": 72153, "artifact_id": "artifact-f623e9e8e69cbeecc748e4ea", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 72153, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 72153, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "7a99860d59c58ae3860b52603d4c7b3d", "sha1": "cfc2b137f04e6a529716db3d7576c5f72e322f84", "type": "http-exported-object", "sha256": "ea843998fbbcd38dd92e228250a9bf15521391a26c88cb25a16b162d7f35d0e1", "evidence": [ { "tcp_stream": 1072, "frame_number": 43580, "display_filter": "frame.number == 43580", "timestamp_epoch": "1533965779.848676000" } ], "filename": "itar.min.js%3fv=1533913284", "filenames": [ "itar.min.js%3fv=1533913284" ], "transfers": [ { "url": "http://tass.com/assets/287c4a4b/itar.min.js?v=1533913284", "client_ip": "192.168.1.95", "server_ip": "103.5.149.72", "tcp_stream": 1072, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 42696, "response_frame": 43580 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 69253, "artifact_id": "artifact-3540b3c526f08d42b1fe3e02", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 69253, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 69253, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "767760b1b3b838b2de0599d0e76d1c76", "sha1": "c56b126f887495918e8abcf813957780f0b9466a", "type": "http-exported-object", "sha256": "c0f37380971fb93ecb0cfa3c2bd6d91cc77f254f0a6ca41edeff47fda0e409cc", "evidence": [ { "tcp_stream": 1035, "frame_number": 39550, "display_filter": "frame.number == 39550", "timestamp_epoch": "1533965406.682444000" } ], "filename": "authrootstl.cab", "filenames": [ "authrootstl.cab" ], "transfers": [ { "url": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab", "client_ip": "192.168.1.95", "server_ip": "205.185.216.42", "tcp_stream": 1035, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 39496, "response_frame": 39550 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 54153, "artifact_id": "artifact-587c5a7517e1e63b8559a169", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 54153, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 54153, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "f0e8ef7b0f1c3270277a5187d01e8844", "sha1": "a3b123f3dd6e4470f953bcab0a06ebb1d01cd909", "type": "http-exported-object", "sha256": "a002c9d3c0bfd9a9ff3c9ff2b1dbd79beb6bf0af5b45933ccad66337bc6864eb", "evidence": [ { "tcp_stream": 1071, "frame_number": 40357, "display_filter": "frame.number == 40357", "timestamp_epoch": "1533965770.815798000" } ], "filename": "mainTopSlider.css%3fv=1533913284", "filenames": [ "mainTopSlider.css%3fv=1533913284" ], "transfers": [ { "url": "http://tass.com/assets/842758d5/mainTopSlider.css?v=1533913284", "client_ip": "192.168.1.95", "server_ip": "103.5.149.72", "tcp_stream": 1071, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 40213, "response_frame": 40357 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 48109, "artifact_id": "artifact-f912d399360640227670dcb0", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 48109, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 48109, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "126260b59895050de79f127386082964", "sha1": "d6336336c7ab590b6715e998dca0e7a07ca8ce4e", "type": "http-exported-object", "sha256": "2a44910e028b6d330cacd3462a0252019ce6c016805a1b16c1c9c52b5c1caa46", "evidence": [ { "tcp_stream": 1073, "frame_number": 41345, "display_filter": "frame.number == 41345", "timestamp_epoch": "1533965773.012991000" } ], "filename": "mobile.css%3f_=1", "filenames": [ "mobile.css%3f_=1" ], "transfers": [ { "url": "http://tass.com/css/mobile.css?_=1", "client_ip": "192.168.1.95", "server_ip": "103.5.149.72", "tcp_stream": 1073, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 41022, "response_frame": 41345 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 44094, "artifact_id": "artifact-b0655124fe16a065e1cd5a26", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 44094, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 44094, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "062a3c7349b1a1d3830c2b6365190ef9", "sha1": "9a6714e86ecdf04be96e49baa9c099f7c9fa4920", "type": "http-exported-object", "sha256": "05879b64ff801a2c6fbc4e43a1872c6a0ab6a67d3839d1eb3ed8e4852d4d58bd", "evidence": [ { "tcp_stream": 1073, "frame_number": 46312, "display_filter": "frame.number == 46312", "timestamp_epoch": "1533965790.494171000" } ], "filename": "favicon.ico%3f225", "filenames": [ "favicon.ico%3f225" ], "transfers": [ { "url": "http://tass.com/favicon.ico?225", "client_ip": "192.168.1.95", "server_ip": "103.5.149.72", "tcp_stream": 1073, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 46258, "response_frame": 46312 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 34494, "artifact_id": "artifact-cc39241edeafcf01f551d37e", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 34494, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 34494, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "bb2847431feb71a464e7ce9f51fb46f0", "sha1": "1f4d1d835ec6d830fbcd286b93bf3b2afac5b1f9", "type": "http-exported-object", "sha256": "f8e7288c0e055bff074b4d2f64cf687fa49de2e08955cd2cdb00d55eaacb3a61", "evidence": [ { "tcp_stream": 1070, "frame_number": 41848, "display_filter": "frame.number == 41848", "timestamp_epoch": "1533965774.795760000" } ], "filename": "angular.rangeSlider.js%3fv=1533913284", "filenames": [ "angular.rangeSlider.js%3fv=1533913284" ], "transfers": [ { "url": "http://tass.com/js/zoom/angular.rangeSlider.js?v=1533913284", "client_ip": "192.168.1.95", "server_ip": "103.5.149.72", "tcp_stream": 1070, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 41365, "response_frame": 41848 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 31135, "artifact_id": "artifact-a497816b2c1e0a2c7f711d63", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 31135, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 31135, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "7641709db5179facf68bdb5c349d6eb3", "sha1": "c295d6006044234fc04b5544d6cd97687f35d38d", "type": "http-exported-object", "sha256": "387ad007219e458d5db35423310dcbc61b583b2611fde57a36879e31b3fb1d99", "evidence": [ { "tcp_stream": 1071, "frame_number": 44328, "display_filter": "frame.number == 44328", "timestamp_epoch": "1533965784.989637000" } ], "filename": "icontass.eot%3f", "filenames": [ "icontass.eot%3f" ], "transfers": [ { "url": "http://tass.com/fonts/icontass/icontass.eot?", "client_ip": "192.168.1.95", "server_ip": "103.5.149.72", "tcp_stream": 1071, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 43657, "response_frame": 44328 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 29052, "artifact_id": "artifact-be039b9b1cdf1f3be4768df9", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 29052, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 29052, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "d64fe6e6b2ad89fbc3cdbf24c08bfbdf", "sha1": "123ba6628589c64cddf09b7ef5fb9da82eff2c61", "type": "http-exported-object", "sha256": "7a44293f37ed3ab18757c89dc76b673aa3ff923e31933ba1bdae740fb0e7ddd4", "evidence": [ { "tcp_stream": 1070, "frame_number": 41363, "display_filter": "frame.number == 41363", "timestamp_epoch": "1533965773.105299000" } ], "filename": "media-queries.css%3f_=3", "filenames": [ "media-queries.css%3f_=3" ], "transfers": [ { "url": "http://tass.com/css/media-queries.css?_=3", "client_ip": "192.168.1.95", "server_ip": "103.5.149.72", "tcp_stream": 1070, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 41026, "response_frame": 41363 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 28223, "artifact_id": "artifact-bd661b8a27f6a651f498c64f", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 28223, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 28223, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "db288e5dc92beb5b805f4349947f2e5c", "sha1": "4a9cabfca33a5a00630c31819b4359468d9ff9de", "type": "http-exported-object", "sha256": "e4c763b60274fbb4f5ebfb43603452f0c592aedf39647951ce87182fdb702955", "evidence": [ { "tcp_stream": 1073, "frame_number": 44488, "display_filter": "frame.number == 44488", "timestamp_epoch": "1533965785.453535000" } ], "filename": "lenta%3flimit=50", "filenames": [ "lenta%3flimit=50" ], "transfers": [ { "url": "http://tass.com/api/news/lenta?limit=50", "client_ip": "192.168.1.95", "server_ip": "103.5.149.72", "tcp_stream": 1073, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 44285, "response_frame": 44488 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 27503, "artifact_id": "artifact-30363fca6c237ce1425d95fb", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 27503, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 27503, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "2fc3e42ef2eef26d296845e50f933f4d", "sha1": "47d2bb69f7d2bf434698b7800f591df531c642a5", "type": "http-exported-object", "sha256": "ad927cfd47a633c08193fec7881a927102c04802a42fa9d880c34dcba5d473ed", "evidence": [ { "tcp_stream": 1130, "frame_number": 42045, "display_filter": "frame.number == 42045", "timestamp_epoch": "1533965775.437637000" } ], "filename": "lenta.min.css%3fv=1533913284", "filenames": [ "lenta.min.css%3fv=1533913284" ], "transfers": [ { "url": "http://tass.com/assets/666a6de7/lenta.min.css?v=1533913284", "client_ip": "192.168.1.95", "server_ip": "103.5.149.72", "tcp_stream": 1130, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 41322, "response_frame": 42045 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 22170, "artifact_id": "artifact-86b2c3fc47c6e274e84dbe14", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 22170, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 22170, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "0464b22b1d966212326452d266840b7e", "sha1": "1a5e93417ac099cf694a7bd8147162845e45518f", "type": "http-exported-object", "sha256": "39f55c0059bfa765dbc67836a3c694c4257e3880c5323e14a2874d78f4de5582", "evidence": [ { "tcp_stream": 1072, "frame_number": 42689, "display_filter": "frame.number == 42689", "timestamp_epoch": "1533965776.931692000" } ], "filename": "angular-touch.js%3fv=1533913284", "filenames": [ "angular-touch.js%3fv=1533913284" ], "transfers": [ { "url": "http://tass.com/js/common/angular-touch.js?v=1533913284", "client_ip": "192.168.1.95", "server_ip": "103.5.149.72", "tcp_stream": 1072, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 41353, "response_frame": 42689 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 21191, "artifact_id": "artifact-956cb1acf5016719fb6762fc", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 21191, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 21191, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "41551a254f99036adbd05c9c0d10280f", "sha1": "f45fd04f3908053cdab19132c86438f9e2121386", "type": "http-exported-object", "sha256": "2361c69cc160246a46ecca25b6b50d825c2d950c39328c29aa1a168018640b11", "evidence": [ { "tcp_stream": 1139, "frame_number": 43720, "display_filter": "frame.number == 43720", "timestamp_epoch": "1533965783.225531000" } ], "filename": "gpt.js", "filenames": [ "gpt.js" ], "transfers": [ { "url": "http://www.googletagservices.com/tag/js/gpt.js", "client_ip": "192.168.1.95", "server_ip": "216.58.194.162", "tcp_stream": 1139, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 43669, "response_frame": 43720 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "text/javascript", "size_bytes": 20578, "artifact_id": "artifact-730a750bb366d91a0c387bac", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 20578, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 20578, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "a1471d1d6431c893582a5f6a250db3f9", "sha1": "ff5673d89e6c2893d24c87bc9786c632290e150e", "type": "http-exported-object", "sha256": "3ab30e780c8b0bcc4998b838a5b30c3bfe28edead312906dc3c12271fae0699a", "evidence": [ { "tcp_stream": 1197, "frame_number": 45736, "display_filter": "frame.number == 45736", "timestamp_epoch": "1533965788.591645000" } ], "filename": "KFOlCnqEu92Fr1MmSU5fBBc-.woff", "filenames": [ "KFOlCnqEu92Fr1MmSU5fBBc-.woff" ], "transfers": [ { "url": "http://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmSU5fBBc-.woff", "client_ip": "192.168.1.95", "server_ip": "216.58.192.3", "tcp_stream": 1197, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 45321, "response_frame": 45736 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 19916, "artifact_id": "artifact-c02024160ea0c00b299cfc9c", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 19916, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 19916, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "cf6613d1adf490972c557a8e318e0868", "sha1": "b2198c3fc1c72646d372f63e135e70ba2c9fed8e", "type": "http-exported-object", "sha256": "468e579fe1210fa55525b1c470ed2d1958404512a2dd4fb972cac5ce0ff00b1f", "evidence": [ { "tcp_stream": 1198, "frame_number": 45737, "display_filter": "frame.number == 45737", "timestamp_epoch": "1533965788.591646000" } ], "filename": "KFOlCnqEu92Fr1MmWUlfBBc-.woff", "filenames": [ "KFOlCnqEu92Fr1MmWUlfBBc-.woff" ], "transfers": [ { "url": "http://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmWUlfBBc-.woff", "client_ip": "192.168.1.95", "server_ip": "216.58.192.3", "tcp_stream": 1198, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 45320, "response_frame": 45737 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 19888, "artifact_id": "artifact-c1d868faaf36a4a9dfd36a6a", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 19888, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 19888, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "5e096613a4835a9f0756fd09d566e0ac", "sha1": "acf211b20a4932fc5798a0d8605c6a2a319a5159", "type": "http-exported-object", "sha256": "8500d605a74853787e140b8e1fcc945de816b28bda06093a3a9d3a9fe00b9b6e", "evidence": [ { "tcp_stream": 1131, "frame_number": 42755, "display_filter": "frame.number == 42755", "timestamp_epoch": "1533965777.083387000" } ], "filename": "hammer.min.js%3fv=1533913284", "filenames": [ "hammer.min.js%3fv=1533913284" ], "transfers": [ { "url": "http://tass.com/js/hammer.min.js?v=1533913284", "client_ip": "192.168.1.95", "server_ip": "103.5.149.72", "tcp_stream": 1131, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 42057, "response_frame": 42755 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 18358, "artifact_id": "artifact-7155acdee6b4e1ca7efca9b6", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 18358, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 18358, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "81630c91a18657993bc3fbf1d512f0cc", "sha1": "718ef24efcae02c53eaa5ee6ea0a00a9fbda38d6", "type": "http-exported-object", "sha256": "044e4bccabac4f77e55d287724125fd5e1df18597c7e1d38cf690aefdae255b4", "evidence": [ { "tcp_stream": 1075, "frame_number": 40560, "display_filter": "frame.number == 40560", "timestamp_epoch": "1533965771.131947000" } ], "filename": "flags.min.css%3fv=1533913284", "filenames": [ "flags.min.css%3fv=1533913284" ], "transfers": [ { "url": "http://tass.com/assets/6f5f919/flags.min.css?v=1533913284", "client_ip": "192.168.1.95", "server_ip": "103.5.149.72", "tcp_stream": 1075, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 40177, "response_frame": 40560 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 15473, "artifact_id": "artifact-58aeae19fc7059094d59c3fc", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 15473, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 15473, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "677b9f873fe8a5cb746ba4c6bd1619b8", "sha1": "d038ec54537f68952c7b47ae9cd9bc939cbde010", "type": "http-exported-object", "sha256": "6281b1e2ea6a5d13e0fd8766295444b52867bc3298d5c2b6b55b1b22420f230c", "evidence": [ { "tcp_stream": 1070, "frame_number": 42263, "display_filter": "frame.number == 42263", "timestamp_epoch": "1533965775.927745000" } ], "filename": "mainTopSlider.js%3fv=1533913284", "filenames": [ "mainTopSlider.js%3fv=1533913284" ], "transfers": [ { "url": "http://tass.com/js/common/mainTopSlider.js?v=1533913284", "client_ip": "192.168.1.95", "server_ip": "103.5.149.72", "tcp_stream": 1070, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 41850, "response_frame": 42263 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 15430, "artifact_id": "artifact-30d9a3734c6cc92428d0a51f", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 15430, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 15430, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "14fb97e33150e48e00aa1965a3200865", "sha1": "638ce9703535186c0991f4d224256cd24b0da6f9", "type": "http-exported-object", "sha256": "826da83425629535790ab944e227e02a597999af91f0a662bcfb4351c950d274", "evidence": [ { "tcp_stream": 1074, "frame_number": 42975, "display_filter": "frame.number == 42975", "timestamp_epoch": "1533965777.599893000" } ], "filename": "zoomController.js%3fv=1533913284", "filenames": [ "zoomController.js%3fv=1533913284" ], "transfers": [ { "url": "http://tass.com/js/zoom/zoomController.js?v=1533913284", "client_ip": "192.168.1.95", "server_ip": "103.5.149.72", "tcp_stream": 1074, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 42204, "response_frame": 42975 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 14904, "artifact_id": "artifact-d2011be53bd5006ac6863f2d", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 14904, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 14904, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "a53fe746f15eaf6f18c612fbe2a5b5aa", "sha1": "b0b1d1d3be98178b270499e0e91c97875a79aa65", "type": "http-exported-object", "sha256": "99fb918a282d39d585d3d759f7903f7508925d0f78ae80e427cec27378c5b71b", "evidence": [ { "tcp_stream": 1133, "frame_number": 44312, "display_filter": "frame.number == 44312", "timestamp_epoch": "1533965784.893851000" } ], "filename": "appstore.svg", "filenames": [ "appstore.svg" ], "transfers": [ { "url": "http://tass.com/images/appstore.svg", "client_ip": "192.168.1.95", "server_ip": "103.5.149.72", "tcp_stream": 1133, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 44183, "response_frame": 44312 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/svg+xml", "size_bytes": 14903, "artifact_id": "artifact-c19fafe5f3841c21405bd779", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 14903, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 14903, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "f19c48dda2fdbde73b721f0ad9b5c148", "sha1": "6199efed932678781307c5808b9e2f7ae49320ee", "type": "http-exported-object", "sha256": "a6dd05c22e36e46f367bb82192f989ccf6b9f5407e61addeaab44b7c53e30a00", "evidence": [ { "tcp_stream": 1070, "frame_number": 46735, "display_filter": "frame.number == 46735", "timestamp_epoch": "1533965792.353700000" } ], "filename": "socialDirective.js", "filenames": [ "socialDirective.js" ], "transfers": [ { "url": "http://tass.com/js/social/socialDirective.js", "client_ip": "192.168.1.95", "server_ip": "103.5.149.72", "tcp_stream": 1070, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 46484, "response_frame": 46735 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "text/javascript", "size_bytes": 12028, "artifact_id": "artifact-743bc3a71b6488743113a89f", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 12028, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 12028, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "044820d45cea5cff311085b9687aa5fd", "sha1": "cdf7b8be227354c710602f8a2587ef80b94c4e4e", "type": "http-exported-object", "sha256": "3715612c143dd7fbcd9db512e0cbd31334fe349c77f5ac4921d0646ca8bb6fdf", "evidence": [ { "tcp_stream": 1131, "frame_number": 42053, "display_filter": "frame.number == 42053", "timestamp_epoch": "1533965775.441011000" } ], "filename": "footer.min.css%3fv=1533913284", "filenames": [ "footer.min.css%3fv=1533913284" ], "transfers": [ { "url": "http://tass.com/assets/916e0df6/footer.min.css?v=1533913284", "client_ip": "192.168.1.95", "server_ip": "103.5.149.72", "tcp_stream": 1131, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 41324, "response_frame": 42053 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 11634, "artifact_id": "artifact-1eb8b34793a797a49ba9e665", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 11634, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 11634, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "0360fa936e78424436b212f7411a1356", "sha1": "08ef0bad1594a840895f9efc30dae52ec60cf3f3", "type": "http-exported-object", "sha256": "5aa35acedcb1d276b3b3a71371eb51bc910b970deb8a3c6111fa99959fe6c9c7", "evidence": [ { "tcp_stream": 1133, "frame_number": 46683, "display_filter": "frame.number == 46683", "timestamp_epoch": "1533965792.154573000" } ], "filename": "videoWidget.js", "filenames": [ "videoWidget.js" ], "transfers": [ { "url": "http://tass.com/js/videoWidget.js", "client_ip": "192.168.1.95", "server_ip": "103.5.149.72", "tcp_stream": 1133, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 46465, "response_frame": 46683 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "text/javascript", "size_bytes": 11271, "artifact_id": "artifact-c5d7912a5385246facb3a62b", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 11271, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 11271, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "0b3fcb496c4e9e08e0217f2a769c2d34", "sha1": "9a10d5e834a1c2626f891f4986658c20bb7243b9", "type": "http-exported-object", "sha256": "a131c2b10883bc8647bffa08b4a6b27f04b376bbddb267a4d0c9d3e8ea851aa0", "evidence": [ { "tcp_stream": 1130, "frame_number": 46593, "display_filter": "frame.number == 46593", "timestamp_epoch": "1533965791.764965000" } ], "filename": "textBroadcastController.js%3fv=1533913284", "filenames": [ "textBroadcastController.js%3fv=1533913284" ], "transfers": [ { "url": "http://tass.com/js/common/textBroadcastController.js?v=1533913284", "client_ip": "192.168.1.95", "server_ip": "103.5.149.72", "tcp_stream": 1130, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 46427, "response_frame": 46593 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 10013, "artifact_id": "artifact-2a93d5ce214807e164306cfb", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 10013, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 10013, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "f4ee02f5fdd6dfdb3a3aaf23b7065410", "sha1": "f21b5b7f375ff4e42809e7f23e1042320be07c1c", "type": "http-exported-object", "sha256": "4efb8677134ae61413bf441d88c2e912ca065a68bb4566b30f935cae34f5a98e", "evidence": [ { "tcp_stream": 1132, "frame_number": 42749, "display_filter": "frame.number == 42749", "timestamp_epoch": "1533965777.082154000" } ], "filename": "mediaBlocksController.js%3fv=1533913284", "filenames": [ "mediaBlocksController.js%3fv=1533913284" ], "transfers": [ { "url": "http://tass.com/js/common/mediaBlocksController.js?v=1533913284", "client_ip": "192.168.1.95", "server_ip": "103.5.149.72", "tcp_stream": 1132, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 42230, "response_frame": 42749 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 9712, "artifact_id": "artifact-daa3f56f725a5fdf1a888f20", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 9712, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 9712, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "e27474d9542bb6a9bca30ba488e0c4d6", "sha1": "13096fb5b526a753db0a5571e58c383b6fa6190c", "type": "http-exported-object", "sha256": "1434636c458ad8cda52b2e1cb38178b63d9af59579d7259a36a436c9c6a11a72", "evidence": [ { "tcp_stream": 1075, "frame_number": 42283, "display_filter": "frame.number == 42283", "timestamp_epoch": "1533965775.985989000" } ], "filename": "pressCenterCalendar.js%3fv=1533913284", "filenames": [ "pressCenterCalendar.js%3fv=1533913284" ], "transfers": [ { "url": "http://tass.com/js/common/pressCenterCalendar.js?v=1533913284", "client_ip": "192.168.1.95", "server_ip": "103.5.149.72", "tcp_stream": 1075, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 41876, "response_frame": 42283 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 9636, "artifact_id": "artifact-fe173baf7129a428c1c4454f", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 9636, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 9636, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "76e2c7c199d29ab66d2d7a00ccacbe68", "sha1": "bce9ed854d3dff32b54b48719e423ac197cd5b6c", "type": "http-exported-object", "sha256": "ebdab894f319fe12a1b14f3dc8c883d45caf4c15e389fb9d6568145f926f4126", "evidence": [ { "tcp_stream": 1072, "frame_number": 46433, "display_filter": "frame.number == 46433", "timestamp_epoch": "1533965791.349917000" } ], "filename": "videoWidget.min.css%3fv=1533913284", "filenames": [ "videoWidget.min.css%3fv=1533913284" ], "transfers": [ { "url": "http://tass.com/assets/7ce9e0a9/videoWidget.min.css?v=1533913284", "client_ip": "192.168.1.95", "server_ip": "103.5.149.72", "tcp_stream": 1072, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 46345, "response_frame": 46433 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 7533, "artifact_id": "artifact-1d3f34008ee3000e00ddc218", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 7533, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 7533, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "7aa858f22a5991daf6f47ee32486ef6c", "sha1": "6305dc72a581b486e0e7865b972a75416242fa4f", "type": "http-exported-object", "sha256": "ad984172bbde72d905cb477edf2775b567580976ef1327612313d7490a3d30ae", "evidence": [ { "tcp_stream": 1074, "frame_number": 40508, "display_filter": "frame.number == 40508", "timestamp_epoch": "1533965771.062370000" } ], "filename": "photoModeCss.css%3fv=1533913284", "filenames": [ "photoModeCss.css%3fv=1533913284" ], "transfers": [ { "url": "http://tass.com/assets/d45d2990/photoModeCss.css?v=1533913284", "client_ip": "192.168.1.95", "server_ip": "103.5.149.72", "tcp_stream": 1074, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 40165, "response_frame": 40508 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 7317, "artifact_id": "artifact-7c4f5c9fb86ade6f0bff2a96", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 7317, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 7317, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "cea74ce0dda7f6c872d0a04ecba87522", "sha1": "b17298c262c50c0cc4d30c93a5739edd97eaf5b2", "type": "http-exported-object", "sha256": "3836255ada8bd1d6a0ac85b332623efd56c48a84e44be7cdf39482e5e1fa9e3c", "evidence": [ { "tcp_stream": 1070, "frame_number": 46475, "display_filter": "frame.number == 46475", "timestamp_epoch": "1533965791.469549000" } ], "filename": "media-widget.min(1).css%3fv=1533913284", "filenames": [ "media-widget.min(1).css%3fv=1533913284" ], "transfers": [ { "url": "http://tass.com/assets/735f4b6e/media-widget.min.css?v=1533913284", "client_ip": "192.168.1.95", "server_ip": "103.5.149.72", "tcp_stream": 1070, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 46361, "response_frame": 46475 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 6821, "artifact_id": "artifact-297157fa8e4d6b03ec43436b", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 6821, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 6821, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "b2bd0b88c041578c03568b404155b06c", "sha1": "260feb41e99159825c08867f2e5e5d4245c4f3f3", "type": "http-exported-object", "sha256": "1ed6dac934e53a42db49242075dee716837fe4115d998e45f5c52d4ae96923a2", "evidence": [ { "tcp_stream": 1071, "frame_number": 40735, "display_filter": "frame.number == 40735", "timestamp_epoch": "1533965771.476895000" } ], "filename": "angular.rangeSlider.min.css%3fv=1533913284", "filenames": [ "angular.rangeSlider.min.css%3fv=1533913284" ], "transfers": [ { "url": "http://tass.com/assets/43ffdc60/angular.rangeSlider.min.css?v=1533913284", "client_ip": "192.168.1.95", "server_ip": "103.5.149.72", "tcp_stream": 1071, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 40361, "response_frame": 40735 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 6314, "artifact_id": "artifact-ca9d1256fbc25ce1bf3f107b", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 6314, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 6314, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "c331b08cd289977cb9f292607a3289df", "sha1": "220b7b63eb93911b478214193c0710dab241cf2f", "type": "http-exported-object", "sha256": "1baf84b9f47c61803a5ea556eb3541f6ba74fc6e3c5261aac798aa19773e5cf1", "evidence": [ { "tcp_stream": 1075, "frame_number": 41872, "display_filter": "frame.number == 41872", "timestamp_epoch": "1533965774.844975000" } ], "filename": "tass.js%3fv=1533913284", "filenames": [ "tass.js%3fv=1533913284" ], "transfers": [ { "url": "http://tass.com/js/common/tass.js?v=1533913284", "client_ip": "192.168.1.95", "server_ip": "103.5.149.72", "tcp_stream": 1075, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 41437, "response_frame": 41872 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 6084, "artifact_id": "artifact-d874ca723b5c0b1d05f53672", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 6084, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 6084, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "98fa87444f045f0fd676dc0cd8d1a480", "sha1": "5fedd790998d38854cd2d83c18f8aad83130c15e", "type": "http-exported-object", "sha256": "3cdffc1fdda52774a1ee46fcd7244b0ee88b11df0f7ddce7dc725609bd1f2a90", "evidence": [ { "tcp_stream": 1073, "frame_number": 44170, "display_filter": "frame.number == 44170", "timestamp_epoch": "1533965784.386310000" } ], "filename": "b-search-icon.png", "filenames": [ "b-search-icon.png" ], "transfers": [ { "url": "http://tass.com/i/b-search-icon.png", "client_ip": "192.168.1.95", "server_ip": "103.5.149.72", "tcp_stream": 1073, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 43972, "response_frame": 44170 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/png", "size_bytes": 5657, "artifact_id": "artifact-872f3021cc33da10214ae16b", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 5657, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 5657, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "6edd5ff7cf3c288df9f001bc130bb48b", "sha1": "ba117f39ba5ed5383fdff0458efd751616449971", "type": "http-exported-object", "sha256": "e2b232bd93d4faa6bd4156d3e31b542a24ac3afe877c6f7faf23c1f474eaf52a", "evidence": [ { "tcp_stream": 1131, "frame_number": 43041, "display_filter": "frame.number == 43041", "timestamp_epoch": "1533965777.766148000" } ], "filename": "loader_animation_lenta_new.gif", "filenames": [ "loader_animation_lenta_new.gif" ], "transfers": [ { "url": "http://tass.com/i/loader_animation_lenta_new.gif", "client_ip": "192.168.1.95", "server_ip": "103.5.149.72", "tcp_stream": 1131, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 42759, "response_frame": 43041 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/gif", "size_bytes": 5563, "artifact_id": "artifact-64a80b325e55fb4d130072cf", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 5563, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 5563, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "144861f128c7e9d05240a2e51ed5fac6", "sha1": "75c56220e6265ead20d77a15c8856702c0f55c7b", "type": "http-exported-object", "sha256": "9d0bbca6eb531759098a56914524f615a1d5a75a1b2c429d7b238973c2610c7a", "evidence": [ { "tcp_stream": 1074, "frame_number": 42201, "display_filter": "frame.number == 42201", "timestamp_epoch": "1533965775.812971000" } ], "filename": "ng-pinch-zoom.js%3fv=1533913284", "filenames": [ "ng-pinch-zoom.js%3fv=1533913284" ], "transfers": [ { "url": "http://tass.com/js/zoom/ng-pinch-zoom.js?v=1533913284", "client_ip": "192.168.1.95", "server_ip": "103.5.149.72", "tcp_stream": 1074, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 41391, "response_frame": 42201 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 5404, "artifact_id": "artifact-6ca4b4866d65d79cdbbee7c6", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 5404, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 5404, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "ec87b286537eae6ac3785788ab717434", "sha1": "db57418ca2b47ea16c2ce06d8358ad3a28029d53", "type": "http-exported-object", "sha256": "c735ac343470ff44195d0167c35e9cb3e0bc43a7c749b67f50fb662300f73d9f", "evidence": [ { "tcp_stream": 1134, "frame_number": 43001, "display_filter": "frame.number == 43001", "timestamp_epoch": "1533965777.669415000" } ], "filename": "logo_web_eng.png", "filenames": [ "logo_web_eng.png" ], "transfers": [ { "url": "http://tass.com/images/newStyle/normal/logo/logo_web_eng.png", "client_ip": "192.168.1.95", "server_ip": "103.5.149.72", "tcp_stream": 1134, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 42704, "response_frame": 43001 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/png", "size_bytes": 5079, "artifact_id": "artifact-5b248b381ef2f49d202a2243", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 5079, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 5079, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "4fa118d0bb1fc3b19e26cdb73863d1b2", "sha1": "4f1ee9547bee6859509e2354be99a7ad8fe8d6ad", "type": "http-exported-object", "sha256": "6db9e00a697b239f66e81bff6d475a80c885dd2e533c93ddeed3e5883a79b8e1", "evidence": [ { "tcp_stream": 1075, "frame_number": 41435, "display_filter": "frame.number == 41435", "timestamp_epoch": "1533965773.487448000" } ], "filename": "print.css%3fv=1", "filenames": [ "print.css%3fv=1" ], "transfers": [ { "url": "http://tass.com/css/print.css?v=1", "client_ip": "192.168.1.95", "server_ip": "103.5.149.72", "tcp_stream": 1075, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 41060, "response_frame": 41435 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 5004, "artifact_id": "artifact-c64b9f993aa071370a1dbf0c", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 5004, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 5004, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "8af4f6c8d3b860d7a0ab4e4b7766c09e", "sha1": "22743b7de65004753f3674a7946e89d2b14ce957", "type": "http-exported-object", "sha256": "1b78a08c32d00ced18d679a004b133df54370f1f1d359f29b64c44256aaf8302", "evidence": [ { "tcp_stream": 1132, "frame_number": 42224, "display_filter": "frame.number == 42224", "timestamp_epoch": "1533965775.860779000" } ], "filename": "angular-sanitize.min.js%3fv=1533913284", "filenames": [ "angular-sanitize.min.js%3fv=1533913284" ], "transfers": [ { "url": "http://tass.com/js/common/angular-sanitize.min.js?v=1533913284", "client_ip": "192.168.1.95", "server_ip": "103.5.149.72", "tcp_stream": 1132, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 41781, "response_frame": 42224 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 4247, "artifact_id": "artifact-79adfe2db11aa23e37e99c02", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 4247, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 4247, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "20b78d41d65948215ca2dff879a57db4", "sha1": "dd56564af85bafed797a08c2fdbb50b4a97cb83a", "type": "http-exported-object", "sha256": "4e4d1d22150544836181502bf5004097fe8d90b3cb647455a4d601153b39eeb7", "evidence": [ { "tcp_stream": 1072, "frame_number": 41351, "display_filter": "frame.number == 41351", "timestamp_epoch": "1533965773.025098000" } ], "filename": "before-widescreen.css", "filenames": [ "before-widescreen.css" ], "transfers": [ { "url": "http://tass.com/css/before-widescreen.css", "client_ip": "192.168.1.95", "server_ip": "103.5.149.72", "tcp_stream": 1072, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 41034, "response_frame": 41351 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "text/css", "size_bytes": 4183, "artifact_id": "artifact-78ea5a358acd9ece606735e0", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 4183, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 4183, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "f37960a0d703422a48a9e7134c01dc30", "sha1": "544207e98609e616a195bf0a5fd6e1129ce2e295", "type": "http-exported-object", "sha256": "e6145cbc4aac4c3d685d04d508cee083e4e4a8a727af838ed46de8f0384b6119", "evidence": [ { "tcp_stream": 1130, "frame_number": 46425, "display_filter": "frame.number == 46425", "timestamp_epoch": "1533965791.293732000" } ], "filename": "audioWidget.min.css%3fv=1533913284", "filenames": [ "audioWidget.min.css%3fv=1533913284" ], "transfers": [ { "url": "http://tass.com/assets/cb2c53b3/audioWidget.min.css?v=1533913284", "client_ip": "192.168.1.95", "server_ip": "103.5.149.72", "tcp_stream": 1130, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 46343, "response_frame": 46425 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 4171, "artifact_id": "artifact-a010300859ad58da603edccd", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 4171, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 4171, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "053dd961f947430d03c9f5d4a1eb19c8", "sha1": "4bece5d3aa08d44687c42d46cca07600b7063b75", "type": "http-exported-object", "sha256": "6865cb6b98a7a93856092e5a4f0d44d6564e74513f685a1eef824a2f7ea77438", "evidence": [ { "tcp_stream": 1074, "frame_number": 41389, "display_filter": "frame.number == 41389", "timestamp_epoch": "1533965773.249652000" } ], "filename": "widescreen.css", "filenames": [ "widescreen.css" ], "transfers": [ { "url": "http://tass.com/css/widescreen.css", "client_ip": "192.168.1.95", "server_ip": "103.5.149.72", "tcp_stream": 1074, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 41036, "response_frame": 41389 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "text/css", "size_bytes": 3853, "artifact_id": "artifact-4ae5a5739ec3e67cbb3a4b1d", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 3853, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 3853, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "4725763bfe412b390a7d6e489db2cd5b", "sha1": "43005d8d9d83e417f0e05e9c6b705473ebe517cf", "type": "http-exported-object", "sha256": "8f34acb688aeae2e39704c35a59767aa10f9b6b99d81f681b8398b23c2d56f22", "evidence": [ { "tcp_stream": 1073, "frame_number": 43048, "display_filter": "frame.number == 43048", "timestamp_epoch": "1533965777.767294000" } ], "filename": "logo_footer_print_eng.png", "filenames": [ "logo_footer_print_eng.png" ], "transfers": [ { "url": "http://tass.com/images/newStyle/normal/logo/logo_footer_print_eng.png", "client_ip": "192.168.1.95", "server_ip": "103.5.149.72", "tcp_stream": 1073, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 42766, "response_frame": 43048 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/png", "size_bytes": 3726, "artifact_id": "artifact-654064070eb9fe7d95ec8a36", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 3726, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 3726, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "2058f57a9955497ec1278965cf81d43b", "sha1": "3a061a3646ba44f1db5ee2d5cdb15cb2a7f5c439", "type": "http-exported-object", "sha256": "38b9ae4c8fe738059ad5faf084677b448bd9333fc6286e3440cfc09be2bb18d5", "evidence": [ { "tcp_stream": 1072, "frame_number": 40516, "display_filter": "frame.number == 40516", "timestamp_epoch": "1533965771.071918000" } ], "filename": "main-slider-widget.min.css%3fv=1533913284", "filenames": [ "main-slider-widget.min.css%3fv=1533913284" ], "transfers": [ { "url": "http://tass.com/assets/e2a326a5/main-slider-widget.min.css?v=1533913284", "client_ip": "192.168.1.95", "server_ip": "103.5.149.72", "tcp_stream": 1072, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 40171, "response_frame": 40516 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 3544, "artifact_id": "artifact-c18de276d18ebbdb08968596", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 3544, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 3544, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "36376f683c6a19cc2d1a8361200ff2b3", "sha1": "df253c78a3fde0a0a68617ddef00a2a2443b0ab3", "type": "http-exported-object", "sha256": "ae4f99d83e633923748305e0dd6434264babf605d56deb7d05345710796038fa", "evidence": [ { "tcp_stream": 1135, "frame_number": 42485, "display_filter": "frame.number == 42485", "timestamp_epoch": "1533965776.392419000" } ], "filename": "activeViewService.js%3fv=1533913284", "filenames": [ "activeViewService.js%3fv=1533913284" ], "transfers": [ { "url": "http://tass.com/js/activeViewService.js?v=1533913284", "client_ip": "192.168.1.95", "server_ip": "103.5.149.72", "tcp_stream": 1135, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 42022, "response_frame": 42485 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 3543, "artifact_id": "artifact-fb3e722aae5d7254d83eddd1", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 3543, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 3543, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "12c0ef9898c0949b71c8685b4c6d51c3", "sha1": "cf05ac4fe05b4150babe96159be5f422f06f370d", "type": "http-exported-object", "sha256": "3f7411e6cfd233d77fd01564a545084b986ae36e1c385c5999df93f5f430d65b", "evidence": [ { "tcp_stream": 1130, "frame_number": 42522, "display_filter": "frame.number == 42522", "timestamp_epoch": "1533965776.482909000" } ], "filename": "doublephoto.js%3fv=1533913284", "filenames": [ "doublephoto.js%3fv=1533913284" ], "transfers": [ { "url": "http://tass.com/js/doublephoto/doublephoto.js?v=1533913284", "client_ip": "192.168.1.95", "server_ip": "103.5.149.72", "tcp_stream": 1130, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 42049, "response_frame": 42522 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 3448, "artifact_id": "artifact-c81412c74ca9b8214f6a547d", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 3448, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 3448, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "89c10db955b9d40acf8c1274d5ca101a", "sha1": "8522d04bfbc42acd08b2b814268e1603a226d53c", "type": "http-exported-object", "sha256": "8ed18faec0943d33882e94cf8e4f01b732ff4e7c84294a9852dbed7cbb07afd7", "evidence": [ { "tcp_stream": 1071, "frame_number": 46630, "display_filter": "frame.number == 46630", "timestamp_epoch": "1533965791.925149000" } ], "filename": "audioWidget.js", "filenames": [ "audioWidget.js" ], "transfers": [ { "url": "http://tass.com/js/audioWidget.js", "client_ip": "192.168.1.95", "server_ip": "103.5.149.72", "tcp_stream": 1071, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 46441, "response_frame": 46630 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "text/javascript", "size_bytes": 3364, "artifact_id": "artifact-cd1065fb06bea33d9e2d04f1", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 3364, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 3364, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "d5528dde0006c78be04817327c2f9b6f", "sha1": "31e1bcc4cf805a2c2fee21f48ded1e598f64a2a8", "type": "http-exported-object", "sha256": "b84161c9fbf7520cd14e7019f92120bd87a928a074156e91a992eba9fc9436e8", "evidence": [ { "tcp_stream": 1073, "frame_number": 42762, "display_filter": "frame.number == 42762", "timestamp_epoch": "1533965777.097664000" } ], "filename": "jquery.cookie.js%3fv=1533913284", "filenames": [ "jquery.cookie.js%3fv=1533913284" ], "transfers": [ { "url": "http://tass.com/js/jquery.cookie.js?v=1533913284", "client_ip": "192.168.1.95", "server_ip": "103.5.149.72", "tcp_stream": 1073, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 42248, "response_frame": 42762 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 3121, "artifact_id": "artifact-39f6419a51c7b46d20e4bbe0", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 3121, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 3121, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "65ae4862a70137a9ea9f1acfd29fb37f", "sha1": "1f84e2cf991fce3e0c9177aede1b443cd8d1ce58", "type": "http-exported-object", "sha256": "f9496faf384dba29602fe3072688892f2dcf7738eecb77208c51de0eaa12562a", "evidence": [ { "tcp_stream": 1075, "frame_number": 42849, "display_filter": "frame.number == 42849", "timestamp_epoch": "1533965777.296514000" } ], "filename": "adfox.asyn.code.scroll.js", "filenames": [ "adfox.asyn.code.scroll.js" ], "transfers": [ { "url": "http://tass.com/js/adfox.asyn.code.scroll.js", "client_ip": "192.168.1.95", "server_ip": "103.5.149.72", "tcp_stream": 1075, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 42289, "response_frame": 42849 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "text/javascript", "size_bytes": 2985, "artifact_id": "artifact-4869836fd9626c96628b3a62", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 2985, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 2985, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "9afe1b785b60fd54082b7dc3a90c05f2", "sha1": "3373273ab2c323e1409c35f20d85e5394c602761", "type": "http-exported-object", "sha256": "2ffb9c700e123b950ec5913c37c94fdd8fbb16d072458bfd5a99b57a43233417", "evidence": [ { "tcp_stream": 1132, "frame_number": 43007, "display_filter": "frame.number == 43007", "timestamp_epoch": "1533965777.679401000" } ], "filename": "loader_animation.gif", "filenames": [ "loader_animation.gif" ], "transfers": [ { "url": "http://tass.com/i/loader_animation.gif", "client_ip": "192.168.1.95", "server_ip": "103.5.149.72", "tcp_stream": 1132, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 42753, "response_frame": 43007 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/gif", "size_bytes": 2921, "artifact_id": "artifact-d8582ba3ae7add63bc28f580", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 2921, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 2921, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "bc79804ec2587a68c3bfca5d4bc83cef", "sha1": "44a0865da1d790d7e884061f81a1058eb3002e82", "type": "http-exported-object", "sha256": "ced5c873136c4fab4584c0c6d26dcd530c748303d7ed9b7a7966b2fe1d6f5915", "evidence": [ { "tcp_stream": 1165, "frame_number": 44415, "display_filter": "frame.number == 44415", "timestamp_epoch": "1533965785.323540000" }, { "tcp_stream": 1166, "frame_number": 44696, "display_filter": "frame.number == 44696", "timestamp_epoch": "1533965786.038948000" } ], "filename": "container(1).html", "filenames": [ "container(1).html", "container.html" ], "transfers": [ { "url": "http://tpc.googlesyndication.com/safeframe/1-0-29/html/container.html", "client_ip": "192.168.1.95", "server_ip": "216.58.192.1", "tcp_stream": 1165, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 44277, "response_frame": 44415 }, { "url": "http://tpc.googlesyndication.com/safeframe/1-0-29/html/container.html", "client_ip": "192.168.1.95", "server_ip": "216.58.192.1", "tcp_stream": 1166, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 44398, "response_frame": 44696 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "text/html", "size_bytes": 2882, "artifact_id": "artifact-684bd71445348beea5d483c1", "occurrences": 2, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 2882, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 2882, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "cae943c0e96d12c22bff9cf3acb3c2f6", "sha1": "c1505934462b448fda0b9f0d4430c9b7e0a1621f", "type": "http-exported-object", "sha256": "cd649c61b13497605100760e8bf986b569254a716cc2b21612b8b4f09051a732", "evidence": [ { "tcp_stream": 1075, "frame_number": 41048, "display_filter": "frame.number == 41048", "timestamp_epoch": "1533965774.045150000" }, { "tcp_stream": 1073, "frame_number": 46418, "display_filter": "frame.number == 46418", "timestamp_epoch": "1533965791.269544000" } ], "filename": "css(1).css%3fv=1533913284", "filenames": [ "css(1).css%3fv=1533913284", "css.css%3fv=1533913284" ], "transfers": [ { "url": "http://tass.com/assets/8665a252/css.css?v=1533913284", "client_ip": "192.168.1.95", "server_ip": "103.5.149.72", "tcp_stream": 1075, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 40562, "response_frame": 41048 }, { "url": "http://tass.com/css/doublephoto/css.css?v=1533913284", "client_ip": "192.168.1.95", "server_ip": "103.5.149.72", "tcp_stream": 1073, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 46341, "response_frame": 46418 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 2670, "artifact_id": "artifact-ebfb02573069c54bedbc577a", "occurrences": 2, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 2670, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 2670, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "6262d68808f821fa7d075c9755bb32ad", "sha1": "ed058a2017ceab4266d90bb3ba0f007ebc88fdb9", "type": "http-exported-object", "sha256": "403f055d841332e37c429d5a4f0699e95a960529853388d36e4ef51e4309ebd0", "evidence": [ { "tcp_stream": 1130, "frame_number": 44210, "display_filter": "frame.number == 44210", "timestamp_epoch": "1533965784.461359000" } ], "filename": "icon_rybriki_normal.png", "filenames": [ "icon_rybriki_normal.png" ], "transfers": [ { "url": "http://tass.com/images/newStyle/normal/icon_rybriki_normal.png", "client_ip": "192.168.1.95", "server_ip": "103.5.149.72", "tcp_stream": 1130, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 44024, "response_frame": 44210 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/png", "size_bytes": 2269, "artifact_id": "artifact-2a115e0ed3400c35e998d04d", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 2269, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 2269, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "303ab92bf22367aeef7af0db00338020", "sha1": "f695fe243bbe9e787828626ce5a3e7b0233d0a50", "type": "http-exported-object", "sha256": "7a788d144a48f85a8f0ffd046f90c7ae89208a52463f9e5ba27833ab2085a291", "evidence": [ { "tcp_stream": 1073, "frame_number": 46572, "display_filter": "frame.number == 46572", "timestamp_epoch": "1533965791.730204000" } ], "filename": "infographics-widget.min.css%3fv=1533913284", "filenames": [ "infographics-widget.min.css%3fv=1533913284" ], "transfers": [ { "url": "http://tass.com/assets/8b982e6a/infographics-widget.min.css?v=1533913284", "client_ip": "192.168.1.95", "server_ip": "103.5.149.72", "tcp_stream": 1073, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 46420, "response_frame": 46572 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 2258, "artifact_id": "artifact-1f084b0e66de93931c1e4f4d", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 2258, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 2258, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "7dd31bddca0173f495a3c776d177dd45", "sha1": "6f2e029a494428a3d94c142d9dee796fa5bb0e68", "type": "http-exported-object", "sha256": "c6e69e2ac48274e5650b25984db96e9b8c85f8c92941900207abb3d41b423cf7", "evidence": [ { "tcp_stream": 1070, "frame_number": 44237, "display_filter": "frame.number == 44237", "timestamp_epoch": "1533965784.480055000" } ], "filename": "logo_futter_web_eng.png", "filenames": [ "logo_futter_web_eng.png" ], "transfers": [ { "url": "http://tass.com/images/newStyle/normal/logo/logo_futter_web_eng.png", "client_ip": "192.168.1.95", "server_ip": "103.5.149.72", "tcp_stream": 1070, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 44072, "response_frame": 44237 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/png", "size_bytes": 2093, "artifact_id": "artifact-6cd43dead130bd952a5b5331", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 2093, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 2093, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "1cfbc1251d3b3f4385c05bcf196b8a3b", "sha1": "52e2dec4b7ab7c459415bb7d01374c12cf2263c6", "type": "http-exported-object", "sha256": "1b416e5dd993831d9e9f5073f76034d5d1485b7eeec0be5c57c3c408b9ca8f14", "evidence": [ { "tcp_stream": 1070, "frame_number": 44070, "display_filter": "frame.number == 44070", "timestamp_epoch": "1533965784.029075000" } ], "filename": "up-button.png", "filenames": [ "up-button.png" ], "transfers": [ { "url": "http://tass.com/i/up-button.png", "client_ip": "192.168.1.95", "server_ip": "103.5.149.72", "tcp_stream": 1070, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 43877, "response_frame": 44070 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/png", "size_bytes": 1816, "artifact_id": "artifact-a63e8e24c5b1e47b379eebcd", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 1816, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 1816, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "9d5eaf88f27a1003c8637933daf4c127", "sha1": "7da8685ebbde72afc645f5c8bca7812fde07aee7", "type": "http-exported-object", "sha256": "9346b79af539d6aa4f72a0499ca1459c42e1a6e2becf0d015ba2f4237f0a9eab", "evidence": [ { "tcp_stream": 1074, "frame_number": 41029, "display_filter": "frame.number == 41029", "timestamp_epoch": "1533965774.014452000" } ], "filename": "zoom.min.css%3fv=1533913284", "filenames": [ "zoom.min.css%3fv=1533913284" ], "transfers": [ { "url": "http://tass.com/assets/f64f6e6a/zoom.min.css?v=1533913284", "client_ip": "192.168.1.95", "server_ip": "103.5.149.72", "tcp_stream": 1074, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 40510, "response_frame": 41029 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 1705, "artifact_id": "artifact-b826d4aa086e3c3aaddc29ca", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 1705, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 1705, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "1afb65947db02362da5584d8de8b5aaa", "sha1": "e19e82610c7e7d2f6978fc1e5e4623fbe98d18e9", "type": "http-exported-object", "sha256": "25af58ca16a2bfb18ae772716df14b4c656b39ccdcb4b9fae9bca1634e505007", "evidence": [ { "tcp_stream": 1073, "frame_number": 42246, "display_filter": "frame.number == 42246", "timestamp_epoch": "1533965775.872998000" } ], "filename": "photoModeController.js%3fv=1533913284", "filenames": [ "photoModeController.js%3fv=1533913284" ], "transfers": [ { "url": "http://tass.com/js/common/photoModeController.js?v=1533913284", "client_ip": "192.168.1.95", "server_ip": "103.5.149.72", "tcp_stream": 1073, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 41791, "response_frame": 42246 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 1519, "artifact_id": "artifact-0c79d9e4847e60225312f9e3", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 1519, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 1519, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "06bf4996c9a848232b657a41bf1e5741", "sha1": "a3f1074d3b330e2b4aed181b292a7d44762deedf", "type": "http-exported-object", "sha256": "a1dbd5350e586eab4363644e8a82826a3032bc4f83694543d50fb6498ea6e82e", "evidence": [ { "tcp_stream": 1073, "frame_number": 43970, "display_filter": "frame.number == 43970", "timestamp_epoch": "1533965783.862394000" } ], "filename": "ru_en.png", "filenames": [ "ru_en.png" ], "transfers": [ { "url": "http://tass.com/images/newStyle/normal/ru_en.png", "client_ip": "192.168.1.95", "server_ip": "103.5.149.72", "tcp_stream": 1073, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 43710, "response_frame": 43970 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/png", "size_bytes": 1440, "artifact_id": "artifact-665727ac0a9689110c799d80", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 1440, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 1440, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "1edaf9ae99ce2920667d0e9a8b3f8c9c", "sha1": "f5ad0bcc1ad56cd150725b1c866c30ad92ef21b0", "type": "http-exported-object", "sha256": "4f32d5dc00f715250abcc486511e37f501a899deb3bf7ea8adbbd3aef1c412da", "evidence": [ { "tcp_stream": 296, "frame_number": 11594, "display_filter": "frame.number == 11594", "timestamp_epoch": "1533964901.403370000" }, { "tcp_stream": 297, "frame_number": 11602, "display_filter": "frame.number == 11602", "timestamp_epoch": "1533964901.411585000" } ], "filename": "COMODORSAAddTrustCA(1).crt", "filenames": [ "COMODORSAAddTrustCA(1).crt", "COMODORSAAddTrustCA.crt" ], "transfers": [ { "url": "http://crt.comodoca.com/COMODORSAAddTrustCA.crt", "client_ip": "192.168.1.95", "server_ip": "104.16.90.188", "tcp_stream": 296, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 11487, "response_frame": 11594 }, { "url": "http://crt.comodoca.com/COMODORSAAddTrustCA.crt", "client_ip": "192.168.1.95", "server_ip": "104.16.90.188", "tcp_stream": 297, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 11488, "response_frame": 11602 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 1400, "artifact_id": "artifact-277ec935bec3bf9b6b4dad13", "occurrences": 2, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 1400, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 1400, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "c6daa488f4011314bc7afb896010a999", "sha1": "38984430423e1fdec361fc4d50366f684f2cbcfc", "type": "http-exported-object", "sha256": "44509da8c1e070e58d174497add5449046af4bd1a1b62aa38152d73c9372a394", "evidence": [ { "tcp_stream": 1130, "frame_number": 44021, "display_filter": "frame.number == 44021", "timestamp_epoch": "1533965783.983808000" } ], "filename": "mobile-search-header.png", "filenames": [ "mobile-search-header.png" ], "transfers": [ { "url": "http://tass.com/i/mobile-search-header.png", "client_ip": "192.168.1.95", "server_ip": "103.5.149.72", "tcp_stream": 1130, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 43851, "response_frame": 44021 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/png", "size_bytes": 1303, "artifact_id": "artifact-6879cb4f253f5e6be070e687", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 1303, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 1303, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "55540a230bdab55187a841cfe1aa1545", "sha1": "363e4734f757bdeb89868efe94907774a327695e", "type": "http-exported-object", "sha256": "d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb", "evidence": [ { "tcp_stream": 158, "frame_number": 6283, "display_filter": "frame.number == 6283", "timestamp_epoch": "1533964560.336183000" }, { "tcp_stream": 159, "frame_number": 6292, "display_filter": "frame.number == 6292", "timestamp_epoch": "1533964560.378443000" } ], "filename": "x(1).cer", "filenames": [ "x(1).cer", "x.cer" ], "transfers": [ { "url": "http://x.ss2.us/x.cer", "client_ip": "192.168.1.95", "server_ip": "13.33.78.186", "tcp_stream": 158, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 6267, "response_frame": 6283 }, { "url": "http://x.ss2.us/x.cer", "client_ip": "192.168.1.95", "server_ip": "13.33.78.186", "tcp_stream": 159, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 6271, "response_frame": 6292 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 1302, "artifact_id": "artifact-d67c8ad0fc3909159e93a9c7", "occurrences": 2, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 1302, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 1302, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "beaf89c1764833e0d952aa067ae54020", "sha1": "1354734e7286c0b6705883e97908e934ae597763", "type": "http-exported-object", "sha256": "67dcf7446d48b5a0cb944a63bd3b69470cc6a48c024223aeff0252cc5b4f11b5", "evidence": [ { "tcp_stream": 1133, "frame_number": 44181, "display_filter": "frame.number == 44181", "timestamp_epoch": "1533965784.395940000" } ], "filename": "lenta.png", "filenames": [ "lenta.png" ], "transfers": [ { "url": "http://tass.com/images/newStyle/normal/lenta.png", "client_ip": "192.168.1.95", "server_ip": "103.5.149.72", "tcp_stream": 1133, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 43996, "response_frame": 44181 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/png", "size_bytes": 1258, "artifact_id": "artifact-2c22a3db844db721fab09b4e", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 1258, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 1258, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "345eff15b7a49add451b65a7f4bdc6ae", "sha1": "1fb86b1168ec743154062e8c9cc5b171a4b7ccb4", "type": "http-exported-object", "sha256": "154c433c491929c5ef686e838e323664a00e6a0d822ccc958fb4dab03e49a08f", "evidence": [ { "tcp_stream": 665, "frame_number": 24000, "display_filter": "frame.number == 24000", "timestamp_epoch": "1533964998.630407000" }, { "tcp_stream": 664, "frame_number": 24005, "display_filter": "frame.number == 24005", "timestamp_epoch": "1533964998.639411000" } ], "filename": "DigiCertSHA2SecureServerCA(1).crt", "filenames": [ "DigiCertSHA2SecureServerCA(1).crt", "DigiCertSHA2SecureServerCA.crt" ], "transfers": [ { "url": "http://cacerts.digicert.com/DigiCertSHA2SecureServerCA.crt", "client_ip": "192.168.1.95", "server_ip": "104.16.240.184", "tcp_stream": 665, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 23982, "response_frame": 24000 }, { "url": "http://cacerts.digicert.com/DigiCertSHA2SecureServerCA.crt", "client_ip": "192.168.1.95", "server_ip": "104.16.240.184", "tcp_stream": 664, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 23985, "response_frame": 24005 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 1176, "artifact_id": "artifact-f7e65c00adf9bde10818c13d", "occurrences": 2, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 1176, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 1176, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "dc32c3a76d2557c768099dea2da9a2d1", "sha1": "8782c6c304353bcfd29692d2593e7d44d934ff11", "type": "http-exported-object", "sha256": "f1c1b50ae5a20dd8030ec9f6bc24823dd367b5255759b4e71b61fce9f7375d73", "evidence": [ { "tcp_stream": 127, "frame_number": 5394, "display_filter": "frame.number == 5394", "timestamp_epoch": "1533964556.542428000" }, { "tcp_stream": 128, "frame_number": 5408, "display_filter": "frame.number == 5408", "timestamp_epoch": "1533964556.565537000" } ], "filename": "STCA(1).crt", "filenames": [ "STCA(1).crt", "STCA.crt" ], "transfers": [ { "url": "http://ssl.trustwave.com/issuers/STCA.crt", "client_ip": "192.168.1.95", "server_ip": "23.43.176.205", "tcp_stream": 127, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 5383, "response_frame": 5394 }, { "url": "http://ssl.trustwave.com/issuers/STCA.crt", "client_ip": "192.168.1.95", "server_ip": "23.43.176.205", "tcp_stream": 128, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 5387, "response_frame": 5408 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 956, "artifact_id": "artifact-a280c298ab38d4c1797f5bdf", "occurrences": 2, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 956, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 956, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "24e12b787ce78800a491cb12490de45f", "sha1": "1b9fe56555d38031a4705347e6691bfb4fd18e76", "type": "http-exported-object", "sha256": "d9e7bfb8aeed3257872096e5f7f09eb683adb4541c0fca3446823bea4a7c2168", "evidence": [ { "tcp_stream": 1072, "frame_number": 41028, "display_filter": "frame.number == 41028", "timestamp_epoch": "1533965774.014445000" } ], "filename": "cards.min.css%3fv=1533913284", "filenames": [ "cards.min.css%3fv=1533913284" ], "transfers": [ { "url": "http://tass.com/assets/a6d7cd43/cards.min.css?v=1533913284", "client_ip": "192.168.1.95", "server_ip": "103.5.149.72", "tcp_stream": 1072, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 40518, "response_frame": 41028 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 952, "artifact_id": "artifact-3aa88e792f20d998f30421c6", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 952, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 952, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "e6950e5bd3ba4c82577c3db1769f1005", "sha1": "46dc3150acd7c1544e9a50b1bf16b10f4cd1cab7", "type": "http-exported-object", "sha256": "b824ce476646a4ea83e2e7b3ccff9864cb702bf597c05656a470ec609954f9db", "evidence": [ { "tcp_stream": 1070, "frame_number": 44424, "display_filter": "frame.number == 44424", "timestamp_epoch": "1533965785.325303000" } ], "filename": "getCurrencyDynamics%3fcurrency=USD", "filenames": [ "getCurrencyDynamics%3fcurrency=USD" ], "transfers": [ { "url": "http://tass.com/site/getCurrencyDynamics?currency=USD", "client_ip": "192.168.1.95", "server_ip": "103.5.149.72", "tcp_stream": 1070, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 44239, "response_frame": 44424 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 932, "artifact_id": "artifact-7431da44ffbb3c5e5a7f07fc", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 932, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 932, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "e4a68ac854ac5242460afd72481b2a44", "sha1": "df3c24f9bfd666761b268073fe06d1cc8d4f82a4", "type": "http-exported-object", "sha256": "cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f", "evidence": [ { "tcp_stream": 773, "frame_number": 28032, "display_filter": "frame.number == 28032", "timestamp_epoch": "1533965036.828176000" }, { "tcp_stream": 774, "frame_number": 28033, "display_filter": "frame.number == 28033", "timestamp_epoch": "1533965036.858021000" }, { "tcp_stream": 775, "frame_number": 28036, "display_filter": "frame.number == 28036", "timestamp_epoch": "1533965036.883276000" }, { "tcp_stream": 776, "frame_number": 28042, "display_filter": "frame.number == 28042", "timestamp_epoch": "1533965036.950542000" } ], "filename": "DF3C24F9BFD666761B268073FE06D1CC8D4F82A4(1).crt", "filenames": [ "DF3C24F9BFD666761B268073FE06D1CC8D4F82A4(1).crt", "DF3C24F9BFD666761B268073FE06D1CC8D4F82A4(2).crt", "DF3C24F9BFD666761B268073FE06D1CC8D4F82A4(3).crt", "DF3C24F9BFD666761B268073FE06D1CC8D4F82A4.crt" ], "transfers": [ { "url": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/DF3C24F9BFD666761B268073FE06D1CC8D4F82A4.crt", "client_ip": "192.168.1.95", "server_ip": "13.107.4.50", "tcp_stream": 773, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 28015, "response_frame": 28032 }, { "url": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/DF3C24F9BFD666761B268073FE06D1CC8D4F82A4.crt", "client_ip": "192.168.1.95", "server_ip": "13.107.4.50", "tcp_stream": 774, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 28018, "response_frame": 28033 }, { "url": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/DF3C24F9BFD666761B268073FE06D1CC8D4F82A4.crt", "client_ip": "192.168.1.95", "server_ip": "13.107.4.50", "tcp_stream": 775, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 28026, "response_frame": 28036 }, { "url": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/DF3C24F9BFD666761B268073FE06D1CC8D4F82A4.crt", "client_ip": "192.168.1.95", "server_ip": "13.107.4.50", "tcp_stream": 776, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 28030, "response_frame": 28042 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 914, "artifact_id": "artifact-0827115acd06f49dbe8b8b33", "occurrences": 4, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 914, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 914, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "d4ae187b4574036c2d76b6df8a8c1a30", "sha1": "b06f409fa14bab33cbaf4a37811b8740b624d9e5", "type": "http-exported-object", "sha256": "a2ce3a0fa7d2a833d1801e01ec48e35b70d84f3467cc9f8fab370386e13879c7", "evidence": [ { "tcp_stream": 218, "frame_number": 8679, "display_filter": "frame.number == 8679", "timestamp_epoch": "1533964898.647739000" }, { "tcp_stream": 217, "frame_number": 8684, "display_filter": "frame.number == 8684", "timestamp_epoch": "1533964898.648021000" } ], "filename": "dstrootcax3(1).p7c", "filenames": [ "dstrootcax3(1).p7c", "dstrootcax3.p7c" ], "transfers": [ { "url": "http://apps.identrust.com/roots/dstrootcax3.p7c", "client_ip": "192.168.1.95", "server_ip": "192.35.177.64", "tcp_stream": 218, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 8633, "response_frame": 8679 }, { "url": "http://apps.identrust.com/roots/dstrootcax3.p7c", "client_ip": "192.168.1.95", "server_ip": "192.35.177.64", "tcp_stream": 217, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 8637, "response_frame": 8684 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/pkcs7-mime", "size_bytes": 893, "artifact_id": "artifact-04936c6190a421f398515b6a", "occurrences": 2, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 893, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 893, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "c5dfb849ca051355ee2dba1ac33eb028", "sha1": "d69b561148f01c77c54578c10926df5b856976ad", "type": "http-exported-object", "sha256": "cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b", "evidence": [ { "tcp_stream": 103, "frame_number": 4385, "display_filter": "frame.number == 4385", "timestamp_epoch": "1533964554.388744000" }, { "tcp_stream": 104, "frame_number": 4388, "display_filter": "frame.number == 4388", "timestamp_epoch": "1533964554.389450000" } ], "filename": "D69B561148F01C77C54578C10926DF5B856976AD(1).crt", "filenames": [ "D69B561148F01C77C54578C10926DF5B856976AD(1).crt", "D69B561148F01C77C54578C10926DF5B856976AD.crt" ], "transfers": [ { "url": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/D69B561148F01C77C54578C10926DF5B856976AD.crt", "client_ip": "192.168.1.95", "server_ip": "198.70.71.144", "tcp_stream": 103, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 4350, "response_frame": 4385 }, { "url": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/D69B561148F01C77C54578C10926DF5B856976AD.crt", "client_ip": "192.168.1.95", "server_ip": "198.70.71.144", "tcp_stream": 104, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 4331, "response_frame": 4388 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 867, "artifact_id": "artifact-9c5b92e578ee4be0db680596", "occurrences": 2, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 867, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 867, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "eaa78e267333ef380ef2941ae076e7dc", "sha1": "ab4ea130feaed2f99938a8cc51e1b88bb7daa77a", "type": "http-exported-object", "sha256": "09c4d94ef1b017b75ff5e2b9e68bcab620ec852cde6b08b21fb46f6d3ce8c904", "evidence": [ { "tcp_stream": 1072, "frame_number": 44032, "display_filter": "frame.number == 44032", "timestamp_epoch": "1533965784.000953000" } ], "filename": "strelka.png", "filenames": [ "strelka.png" ], "transfers": [ { "url": "http://tass.com/images/newStyle/normal/strelka.png", "client_ip": "192.168.1.95", "server_ip": "103.5.149.72", "tcp_stream": 1072, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 43853, "response_frame": 44032 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/png", "size_bytes": 559, "artifact_id": "artifact-ed4836d5fec7c9ef80a96454", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 559, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 559, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "c46093607b0006277fb918ed6ec7b190", "sha1": "3fff16ae13e4525718d0211a098fb9049189b778", "type": "http-exported-object", "sha256": "f379ea3023b93c6e5d2fe2945774dcf7c85a116326d9eb8f3274de541403811b", "evidence": [ { "tcp_stream": 1073, "frame_number": 44283, "display_filter": "frame.number == 44283", "timestamp_epoch": "1533965784.709122000" } ], "filename": "rss_futter_norma_1.png", "filenames": [ "rss_futter_norma_1.png" ], "transfers": [ { "url": "http://tass.com/images/newStyle/normal/social/rss_futter_norma_1.png", "client_ip": "192.168.1.95", "server_ip": "103.5.149.72", "tcp_stream": 1073, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 44172, "response_frame": 44283 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/png", "size_bytes": 470, "artifact_id": "artifact-88ca197406c3ee267a3b6c52", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 470, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 470, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "7901c7f0ed0c4263b24f4a1743e893ed", "sha1": "a7bd7af18e7b3877b51809ee639c090b59b701cf", "type": "http-exported-object", "sha256": "d84fb0e64ee9f712fb6a808e9caa959903068ae7d7805bd0ce5f4782a37422f4", "evidence": [], "filename": "dot(2).php", "filenames": [ "dot(2).php" ], "transfers": [], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 418, "artifact_id": "artifact-083726e1accf19b8c0d741ff", "occurrences": 1, "completeness": "unknown", "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 418, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "412c88cc441bae0ac0912e78d1e82eb2", "sha1": "78852bec039936cda1b676acca2cd71e1769cbf6", "type": "http-exported-object", "sha256": "f59b3fd3d4f882d5c2154e3b8aa5e535416a696f482996ec2a134e7a6978c333", "evidence": [ { "tcp_stream": 1070, "frame_number": 43875, "display_filter": "frame.number == 43875", "timestamp_epoch": "1533965783.720526000" } ], "filename": "g+_top_norma.png", "filenames": [ "g+_top_norma.png" ], "transfers": [ { "url": "http://tass.com/images/newStyle/normal/social/g+_top_norma.png", "client_ip": "192.168.1.95", "server_ip": "103.5.149.72", "tcp_stream": 1070, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 43706, "response_frame": 43875 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/png", "size_bytes": 380, "artifact_id": "artifact-e7ae2b3e09df3665618389d8", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 380, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 380, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "b7bef6ac289d3fc503a31804815669bb", "sha1": "04ee5cfdf917a0d7501b5d0c58f62e9b64e4091f", "type": "http-exported-object", "sha256": "9a3425a07bbde19cc69878e803f30c78d60b61f49049265a20a01841a1028350", "evidence": [ { "tcp_stream": 1072, "frame_number": 44410, "display_filter": "frame.number == 44410", "timestamp_epoch": "1533965785.323370000" } ], "filename": "tw_futter_norma_1.png", "filenames": [ "tw_futter_norma_1.png" ], "transfers": [ { "url": "http://tass.com/images/newStyle/normal/social/tw_futter_norma_1.png", "client_ip": "192.168.1.95", "server_ip": "103.5.149.72", "tcp_stream": 1072, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 44226, "response_frame": 44410 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/png", "size_bytes": 370, "artifact_id": "artifact-f1ade49a9f4a95308ca9c9d7", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 370, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 370, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "a3e4cfad394aaee75516cba58f9c9ff8", "sha1": "ad99166da001425cdecb70b7c8c8eab58c41bbe0", "type": "http-exported-object", "sha256": "f2addf74a79c54d648ed7d227042c992f8d500dd95f072528f9e55c168cf97ad", "evidence": [ { "tcp_stream": 1133, "frame_number": 43990, "display_filter": "frame.number == 43990", "timestamp_epoch": "1533965783.903839000" } ], "filename": "RSS.png", "filenames": [ "RSS.png" ], "transfers": [ { "url": "http://tass.com/images/newStyle/normal/RSS.png", "client_ip": "192.168.1.95", "server_ip": "103.5.149.72", "tcp_stream": 1133, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 43708, "response_frame": 43990 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/png", "size_bytes": 369, "artifact_id": "artifact-fa978c44395e600d81d9d2fe", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 369, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 369, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "a767e92ff5de2afe0eb81337fb9b97fd", "sha1": "c3f373af5477d39ce1da8a95b8cc4c4fbf6334c3", "type": "http-exported-object", "sha256": "8bf7a76576baee734a750ad21b0a8a583de9ef4312e41f7043594910e6649eed", "evidence": [ { "tcp_stream": 1135, "frame_number": 42903, "display_filter": "frame.number == 42903", "timestamp_epoch": "1533965777.414677000" } ], "filename": "mainSliderWidget.js", "filenames": [ "mainSliderWidget.js" ], "transfers": [ { "url": "http://tass.com/js/mainSliderWidget.js", "client_ip": "192.168.1.95", "server_ip": "103.5.149.72", "tcp_stream": 1135, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 42488, "response_frame": 42903 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "text/javascript", "size_bytes": 350, "artifact_id": "artifact-87d5d61b5a0765adef9598ac", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 350, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 350, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "2554f2eaae1fe4637076850eedd270f5", "sha1": "e1d7fc4842ed78d862411eb31e2974b1f1dd31d9", "type": "http-exported-object", "sha256": "03a8abd21deffa815518744425ed7da2e391745f22d80ecd2a98ece7e42644e3", "evidence": [ { "tcp_stream": 1130, "frame_number": 43847, "display_filter": "frame.number == 43847", "timestamp_epoch": "1533965783.655618000" } ], "filename": "tw_top_norma_1.png", "filenames": [ "tw_top_norma_1.png" ], "transfers": [ { "url": "http://tass.com/images/newStyle/normal/social/tw_top_norma_1.png", "client_ip": "192.168.1.95", "server_ip": "103.5.149.72", "tcp_stream": 1130, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 43704, "response_frame": 43847 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/png", "size_bytes": 325, "artifact_id": "artifact-21229393f6d54773b23dbcd4", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 325, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 325, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "7f6c0d0c67ae6fca76e535014b60de8b", "sha1": "c7ac33dbf25180f803a006c8746d43526d0fb95a", "type": "http-exported-object", "sha256": "38a2d4f024e57004e2d2324eead0ae08341ea9490151a439d6531132a5d2c2d5", "evidence": [ { "tcp_stream": 1130, "frame_number": 44409, "display_filter": "frame.number == 44409", "timestamp_epoch": "1533965785.323200000" } ], "filename": "fb_futter_norma_1.png", "filenames": [ "fb_futter_norma_1.png" ], "transfers": [ { "url": "http://tass.com/images/newStyle/normal/social/fb_futter_norma_1.png", "client_ip": "192.168.1.95", "server_ip": "103.5.149.72", "tcp_stream": 1130, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 44220, "response_frame": 44409 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/png", "size_bytes": 312, "artifact_id": "artifact-e0424bdabf5310eaf5f3b21f", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 312, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 312, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "a706c4e5f7653b2f8ddbee153ca18866", "sha1": "41e5379fa86212bb4c2a1dc6e877fb0e35c51bca", "type": "http-exported-object", "sha256": "e56be3ba3f85b78893bce2432a38aad1afda3d3032ee8667589dd44ee9ed0cc1", "evidence": [ { "tcp_stream": 1072, "frame_number": 43849, "display_filter": "frame.number == 43849", "timestamp_epoch": "1533965783.655787000" } ], "filename": "fb_top_norma_1.png", "filenames": [ "fb_top_norma_1.png" ], "transfers": [ { "url": "http://tass.com/images/newStyle/normal/social/fb_top_norma_1.png", "client_ip": "192.168.1.95", "server_ip": "103.5.149.72", "tcp_stream": 1072, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 43702, "response_frame": 43849 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/png", "size_bytes": 252, "artifact_id": "artifact-478f6051eef0975210a8db45", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 252, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 252, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "905c641583c0979786895ef047f5b12d", "sha1": "b93909fd5d0a6d087430ec105a5c280075cdee8b", "type": "http-exported-object", "sha256": "025bb8d092d17ec94d16f6a602b61447faf64f3260c93a4650e9b77b9003a3f9", "evidence": [ { "tcp_stream": 1072, "frame_number": 44212, "display_filter": "frame.number == 44212", "timestamp_epoch": "1533965784.461460000" } ], "filename": "foto.png", "filenames": [ "foto.png" ], "transfers": [ { "url": "http://tass.com/images/newStyle/normal/foto.png", "client_ip": "192.168.1.95", "server_ip": "103.5.149.72", "tcp_stream": 1072, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 44034, "response_frame": 44212 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/png", "size_bytes": 247, "artifact_id": "artifact-18c4219d3e6d43c89974f5a5", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 247, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 247, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "7e44f257f1a4e4ecb57bbef93c8d28a3", "sha1": "a2fc9de59070a66c6071d01d4e51acbcdc147ff3", "type": "http-exported-object", "sha256": "8380f10fcacb3780a860531c45384ab3bfdc2ab6a9b8ada7b38551448f69d889", "evidence": [ { "tcp_stream": 1190, "frame_number": 44998, "display_filter": "frame.number == 44998", "timestamp_epoch": "1533965786.617843000" } ], "filename": "css%3ffamily=Roboto%3a300", "filenames": [ "css%3ffamily=Roboto%3a300" ], "transfers": [ { "url": "http://fonts.googleapis.com/css?family=Roboto:300", "client_ip": "192.168.1.95", "server_ip": "216.58.192.10", "tcp_stream": 1190, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 44836, "response_frame": 44998 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 224, "artifact_id": "artifact-07bf75b85b2c15b60a0dfba8", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 224, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 224, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "df93f46c8f3e304a48d8bf67cc9e63e2", "sha1": "8e647684ba78be8f043d83adb6bbb0fb144f3391", "type": "http-exported-object", "sha256": "96bc02edb88af74dfe132e8341ef9a8694400d86bf0deb6fd93d06591bc5fa8d", "evidence": [ { "tcp_stream": 1191, "frame_number": 45011, "display_filter": "frame.number == 45011", "timestamp_epoch": "1533965786.714704000" } ], "filename": "css%3ffamily=Roboto%3a700", "filenames": [ "css%3ffamily=Roboto%3a700" ], "transfers": [ { "url": "http://fonts.googleapis.com/css?family=Roboto:700", "client_ip": "192.168.1.95", "server_ip": "216.58.192.10", "tcp_stream": 1191, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 44840, "response_frame": 45011 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 222, "artifact_id": "artifact-60c4e4d0af13113898313aa6", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 222, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 222, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "70461da8b94c6ca5d2fda3260c5a8c3b", "sha1": "994bc667720c21257500e29038c1a5f61e25da1e", "type": "http-exported-object", "sha256": "f33c27745f2bd87344be790465ef984a972fd539dc83bd4f61d4242c607ef1ee", "evidence": [ { "tcp_stream": 1071, "frame_number": 41120, "display_filter": "frame.number == 41120", "timestamp_epoch": "1533965774.073979000" }, { "tcp_stream": 1071, "frame_number": 46439, "display_filter": "frame.number == 46439", "timestamp_epoch": "1533965791.369624000" } ], "filename": "media-widget.min.css%3fv=1533913284", "filenames": [ "media-widget.min.css%3fv=1533913284", "socials.min.css%3fv=1533913284" ], "transfers": [ { "url": "http://tass.com/assets/735f4b6e/media-widget.min.css?v=1533913284", "client_ip": "192.168.1.95", "server_ip": "103.5.149.72", "tcp_stream": 1071, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "404", "completeness": "unknown", "request_frame": 40737, "response_frame": 41120 }, { "url": "http://tass.com/assets/1d1a4a07/socials.min.css?v=1533913284", "client_ip": "192.168.1.95", "server_ip": "103.5.149.72", "tcp_stream": 1071, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "404", "completeness": "unknown", "request_frame": 46347, "response_frame": 46439 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 162, "artifact_id": "artifact-57f4225178dc90214e9c3fe5", "occurrences": 2, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 162, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 162, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "5b0e9ae04fbc265788ce295eebdba1c6", "sha1": "b475e5fce42033a607bb68dc27581a9751c626c7", "type": "http-exported-object", "sha256": "d1b728e19d551b8bc4f3f2d0c12541e7d8950358f95ae31e610b6ab46cb6ec96", "evidence": [ { "tcp_stream": 1146, "frame_number": 43740, "display_filter": "frame.number == 43740", "timestamp_epoch": "1533965783.308767000" } ], "filename": "rta.js%3fnetId=5895&cookieName=crtg_rta&rnd=74932308510&varName=crtg_content", "filenames": [ "rta.js%3fnetId=5895&cookieName=crtg_rta&rnd=74932308510&varName=crtg_content" ], "transfers": [ { "url": "http://rtax.criteo.com/delivery/rta/rta.js?netId=5895&cookieName=crtg_rta&rnd=74932308510&varName=crtg_content", "client_ip": "192.168.1.95", "server_ip": "74.119.117.100", "tcp_stream": 1146, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 43682, "response_frame": 43740 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 144, "artifact_id": "artifact-169ad4ee2bae0119c8cafe05", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 144, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "0223d80a320a983871bfa82aa6d698ea", "sha1": "f4e06fe8e83c662bb565f175d7de22f51c1e7c9d", "type": "http-exported-object", "sha256": "fa523f248a332cb89ae3ad8cf51d840153e0f96bcc2a4c8db736e02a340dab48", "evidence": [ { "tcp_stream": 1144, "frame_number": 43951, "display_filter": "frame.number == 43951", "timestamp_epoch": "1533965783.844038000" } ], "filename": "logo;tass.com%3f44.6", "filenames": [ "logo;tass.com%3f44.6" ], "transfers": [ { "url": "http://counter.yadro.ru/logo;tass.com?44.6", "client_ip": "192.168.1.95", "server_ip": "88.212.196.103", "tcp_stream": 1144, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 43748, "response_frame": 43951 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 132, "artifact_id": "artifact-8052f3d6cb183a67b2009810", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 132, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 132, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "047e11e670605d6cd66628886f01c062", "sha1": "454c44e19a93a7682104c1a200ac3f41c6484244", "type": "http-exported-object", "sha256": "e9d0f873040fb0ee7b073debbc6dfbfdbc80c0c17518d38b04b277a54e5fb275", "evidence": [ { "tcp_stream": 1036, "frame_number": 39598, "display_filter": "frame.number == 39598", "timestamp_epoch": "1533965407.582409000" } ], "filename": "dot(1).php", "filenames": [ "dot(1).php" ], "transfers": [ { "url": "http://185.68.93.18/dot.php", "client_ip": "192.168.1.95", "server_ip": "185.68.93.18", "tcp_stream": 1036, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 39557, "response_frame": 39598 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 96, "artifact_id": "artifact-41d16f8e90b9dda336b1535c", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 96, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 96, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "9964273f1fa0123af87efe6c9f67246e", "sha1": "944ec86ead67a2de5ebc96f1f0d6b5faba7352d4", "type": "http-exported-object", "sha256": "aa81dc4dfa58c4040d0e5c08813a963dd3e8a8a16fd1c76ed758e703b62761f2", "evidence": [], "filename": "dot(10).php", "filenames": [ "dot(10).php", "dot(12).php", "dot(14).php", "dot(16).php", "dot(18).php", "dot(20).php", "dot(22).php", "dot(24).php", "dot(26).php", "dot(28).php", "dot(30).php", "dot(32).php", "dot(34).php", "dot(36).php", "dot(38).php", "dot(4).php", "dot(40).php", "dot(42).php", "dot(44).php", "dot(46).php", "dot(48).php", "dot(50).php", "dot(52).php", "dot(54).php", "dot(56).php", "dot(58).php", "dot(6).php", "dot(60).php", "dot(62).php", "dot(64).php" ], "transfers": [], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 72, "artifact_id": "artifact-804af7765a5d71b67e60625f", "occurrences": 32, "completeness": "unknown", "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 72, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "fc94fb0c3ed8a8f909dbc7630a0987ff", "sha1": "56d45f8a17f5078a20af9962c992ca4678450765", "type": "http-exported-object", "sha256": "2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363", "evidence": [ { "tcp_stream": 1143, "frame_number": 43956, "display_filter": "frame.number == 43956", "timestamp_epoch": "1533965783.848656000" } ], "filename": ";0.30934944172652073", "filenames": [ ";0.30934944172652073" ], "transfers": [ { "url": "http://counter.yadro.ru/hit;TASS_total?r;s1280*768*24;uhttp%3A//tass.com/;0.30934944172652073", "client_ip": "192.168.1.95", "server_ip": "88.212.196.103", "tcp_stream": 1143, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 43744, "response_frame": 43956 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 43, "artifact_id": "artifact-6838dbbaabc722ba2aa7f4ef", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 43, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 43, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "ad4b0f606e0f8465bc4c4c170b37e1a3", "sha1": "50b30fd5f87c85fe5cba2635cb83316ca71250d7", "type": "http-exported-object", "sha256": "cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda", "evidence": [ { "tcp_stream": 1137, "frame_number": 44151, "display_filter": "frame.number == 44151", "timestamp_epoch": "1533965784.337316000" } ], "filename": "851285090", "filenames": [ "851285090" ], "transfers": [ { "url": "http://www.tns-counter.ru/V13b***R%3E*itartass_com/ru/UTF-8/tmsec=itartass_total/851285090", "client_ip": "192.168.1.95", "server_ip": "194.226.130.228", "tcp_stream": 1137, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 43933, "response_frame": 44151 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 43, "artifact_id": "artifact-2d0bc6d384aacdf67150a3cd", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 43, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 43, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "0d19bfa42631790bed04cecf0802b114", "sha1": "901e33f73309a93382d459e0931aef38b942870d", "type": "http-exported-object", "sha256": "e49188fece61523b27d736f94bccb9b04d8a3f018fe0a770fc5cf9b6c734fd0a", "evidence": [ { "tcp_stream": 1046, "frame_number": 39678, "display_filter": "frame.number == 39678", "timestamp_epoch": "1533965419.411481000" } ], "filename": "dot(3).php", "filenames": [ "dot(3).php" ], "transfers": [ { "url": "http://185.68.93.18/dot.php", "client_ip": "192.168.1.95", "server_ip": "185.68.93.18", "tcp_stream": 1046, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 39676, "response_frame": 39678 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 24, "artifact_id": "artifact-87d10d646a2c23312a386eba", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 24, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 24, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "8fbb43e18cec4bd7ce9c695fc9e7d378", "sha1": "38676d66cea664aad57da9621335fe4e4eba320a", "type": "http-exported-object", "sha256": "b3719e3eda456a7457adfe13e6eed36fcef0901b0c31c22cc8ff48629ce8dcee", "evidence": [ { "tcp_stream": 1034, "frame_number": 39491, "display_filter": "frame.number == 39491", "timestamp_epoch": "1533965401.249068000" } ], "filename": "authrootseq.txt", "filenames": [ "authrootseq.txt" ], "transfers": [ { "url": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt", "client_ip": "192.168.1.95", "server_ip": "205.185.216.42", "tcp_stream": 1034, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 39486, "response_frame": 39491 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "text/plain", "size_bytes": 18, "artifact_id": "artifact-ae6fca3f6539068e97392b78", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 18, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 18, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "cd5a4d3fdd5bffc16bf959ef75cf37bc", "sha1": "33bf88d5b82df3723d5863c7d23445e345828904", "type": "http-exported-object", "sha256": "6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012", "evidence": [ { "tcp_stream": 26, "frame_number": 387, "display_filter": "frame.number == 387", "timestamp_epoch": "1533964519.601102000" } ], "filename": "ncsi.txt", "filenames": [ "ncsi.txt" ], "transfers": [ { "url": "http://www.msftncsi.com/ncsi.txt", "client_ip": "192.168.1.95", "server_ip": "198.70.71.161", "tcp_stream": 26, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 385, "response_frame": 387 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "text/plain", "size_bytes": 14, "artifact_id": "artifact-753be1cb63ec2c3783cdc2ae", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 14, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 14, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "1746e34576d009d1d4f799660eb6de0a", "sha1": "755878c2b6007d0684a81907889fbc4b1dc6bcc4", "type": "http-exported-object", "sha256": "1fc3656d141db778f4636a6beb9eb0623e7b2a072ddce6013ed96f44988b78b5", "evidence": [ { "tcp_stream": 1046, "frame_number": 39683, "display_filter": "frame.number == 39683", "timestamp_epoch": "1533965420.076875000" }, { "tcp_stream": 1047, "frame_number": 39701, "display_filter": "frame.number == 39701", "timestamp_epoch": "1533965436.380239000" }, { "tcp_stream": 1048, "frame_number": 39714, "display_filter": "frame.number == 39714", "timestamp_epoch": "1533965452.392999000" }, { "tcp_stream": 1049, "frame_number": 39727, "display_filter": "frame.number == 39727", "timestamp_epoch": "1533965468.742976000" }, { "tcp_stream": 1050, "frame_number": 39743, "display_filter": "frame.number == 39743", "timestamp_epoch": "1533965485.114304000" }, { "tcp_stream": 1051, "frame_number": 39756, "display_filter": "frame.number == 39756", "timestamp_epoch": "1533965501.157864000" }, { "tcp_stream": 1052, "frame_number": 39769, "display_filter": "frame.number == 39769", "timestamp_epoch": "1533965517.365174000" }, { "tcp_stream": 1053, "frame_number": 39783, "display_filter": "frame.number == 39783", "timestamp_epoch": "1533965533.927657000" }, { "tcp_stream": 1054, "frame_number": 39798, "display_filter": "frame.number == 39798", "timestamp_epoch": "1533965550.085388000" }, { "tcp_stream": 1055, "frame_number": 39811, "display_filter": "frame.number == 39811", "timestamp_epoch": "1533965566.285632000" }, { "tcp_stream": 1057, "frame_number": 39881, "display_filter": "frame.number == 39881", "timestamp_epoch": "1533965582.439568000" }, { "tcp_stream": 1058, "frame_number": 39897, "display_filter": "frame.number == 39897", "timestamp_epoch": "1533965598.592239000" }, { "tcp_stream": 1060, "frame_number": 39959, "display_filter": "frame.number == 39959", "timestamp_epoch": "1533965614.757970000" }, { "tcp_stream": 1061, "frame_number": 39972, "display_filter": "frame.number == 39972", "timestamp_epoch": "1533965630.764268000" }, { "tcp_stream": 1062, "frame_number": 39985, "display_filter": "frame.number == 39985", "timestamp_epoch": "1533965647.108796000" }, { "tcp_stream": 1063, "frame_number": 39998, "display_filter": "frame.number == 39998", "timestamp_epoch": "1533965663.151493000" }, { "tcp_stream": 1064, "frame_number": 40011, "display_filter": "frame.number == 40011", "timestamp_epoch": "1533965679.535130000" }, { "tcp_stream": 1065, "frame_number": 40024, "display_filter": "frame.number == 40024", "timestamp_epoch": "1533965696.067200000" }, { "tcp_stream": 1066, "frame_number": 40040, "display_filter": "frame.number == 40040", "timestamp_epoch": "1533965713.563675000" }, { "tcp_stream": 1067, "frame_number": 40053, "display_filter": "frame.number == 40053", "timestamp_epoch": "1533965729.425320000" }, { "tcp_stream": 1068, "frame_number": 40066, "display_filter": "frame.number == 40066", "timestamp_epoch": "1533965746.021717000" }, { "tcp_stream": 1069, "frame_number": 40080, "display_filter": "frame.number == 40080", "timestamp_epoch": "1533965762.113294000" }, { "tcp_stream": 1136, "frame_number": 43398, "display_filter": "frame.number == 43398", "timestamp_epoch": "1533965778.917904000" }, { "tcp_stream": 1228, "frame_number": 46902, "display_filter": "frame.number == 46902", "timestamp_epoch": "1533965794.805158000" }, { "tcp_stream": 1231, "frame_number": 46981, "display_filter": "frame.number == 46981", "timestamp_epoch": "1533965811.012931000" }, { "tcp_stream": 1232, "frame_number": 47002, "display_filter": "frame.number == 47002", "timestamp_epoch": "1533965827.059725000" }, { "tcp_stream": 1233, "frame_number": 47022, "display_filter": "frame.number == 47022", "timestamp_epoch": "1533965843.109897000" }, { "tcp_stream": 1234, "frame_number": 47115, "display_filter": "frame.number == 47115", "timestamp_epoch": "1533965859.247335000" }, { "tcp_stream": 1235, "frame_number": 47142, "display_filter": "frame.number == 47142", "timestamp_epoch": "1533965875.148895000" }, { "tcp_stream": 1236, "frame_number": 47155, "display_filter": "frame.number == 47155", "timestamp_epoch": "1533965891.227980000" } ], "filename": "dot(11).php", "filenames": [ "dot(11).php", "dot(13).php", "dot(15).php", "dot(17).php", "dot(19).php", "dot(21).php", "dot(23).php", "dot(25).php", "dot(27).php", "dot(29).php", "dot(31).php", "dot(33).php", "dot(35).php", "dot(37).php", "dot(39).php", "dot(41).php", "dot(43).php", "dot(45).php", "dot(47).php", "dot(49).php", "dot(5).php", "dot(51).php", "dot(53).php", "dot(55).php", "dot(57).php", "dot(59).php", "dot(61).php", "dot(63).php", "dot(65).php", "dot(7).php" ], "transfers": [ { "url": "http://185.68.93.18/dot.php", "client_ip": "192.168.1.95", "server_ip": "185.68.93.18", "tcp_stream": 1046, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 39681, "response_frame": 39683 }, { "url": "http://185.68.93.18/dot.php", "client_ip": "192.168.1.95", "server_ip": "185.68.93.18", "tcp_stream": 1047, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 39699, "response_frame": 39701 }, { "url": "http://185.68.93.18/dot.php", "client_ip": "192.168.1.95", "server_ip": "185.68.93.18", "tcp_stream": 1048, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 39712, "response_frame": 39714 }, { "url": "http://185.68.93.18/dot.php", "client_ip": "192.168.1.95", "server_ip": "185.68.93.18", "tcp_stream": 1049, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 39725, "response_frame": 39727 }, { "url": "http://185.68.93.18/dot.php", "client_ip": "192.168.1.95", "server_ip": "185.68.93.18", "tcp_stream": 1050, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 39741, "response_frame": 39743 }, { "url": "http://185.68.93.18/dot.php", "client_ip": "192.168.1.95", "server_ip": "185.68.93.18", "tcp_stream": 1051, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 39754, "response_frame": 39756 }, { "url": "http://185.68.93.18/dot.php", "client_ip": "192.168.1.95", "server_ip": "185.68.93.18", "tcp_stream": 1052, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 39767, "response_frame": 39769 }, { "url": "http://185.68.93.18/dot.php", "client_ip": "192.168.1.95", "server_ip": "185.68.93.18", "tcp_stream": 1053, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 39781, "response_frame": 39783 }, { "url": "http://185.68.93.18/dot.php", "client_ip": "192.168.1.95", "server_ip": "185.68.93.18", "tcp_stream": 1054, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 39796, "response_frame": 39798 }, { "url": "http://185.68.93.18/dot.php", "client_ip": "192.168.1.95", "server_ip": "185.68.93.18", "tcp_stream": 1055, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 39809, "response_frame": 39811 }, { "url": "http://185.68.93.18/dot.php", "client_ip": "192.168.1.95", "server_ip": "185.68.93.18", "tcp_stream": 1057, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 39879, "response_frame": 39881 }, { "url": "http://185.68.93.18/dot.php", "client_ip": "192.168.1.95", "server_ip": "185.68.93.18", "tcp_stream": 1058, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 39895, "response_frame": 39897 }, { "url": "http://185.68.93.18/dot.php", "client_ip": "192.168.1.95", "server_ip": "185.68.93.18", "tcp_stream": 1060, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 39951, "response_frame": 39959 }, { "url": "http://185.68.93.18/dot.php", "client_ip": "192.168.1.95", "server_ip": "185.68.93.18", "tcp_stream": 1061, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 39970, "response_frame": 39972 }, { "url": "http://185.68.93.18/dot.php", "client_ip": "192.168.1.95", "server_ip": "185.68.93.18", "tcp_stream": 1062, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 39983, "response_frame": 39985 }, { "url": "http://185.68.93.18/dot.php", "client_ip": "192.168.1.95", "server_ip": "185.68.93.18", "tcp_stream": 1063, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 39996, "response_frame": 39998 }, { "url": "http://185.68.93.18/dot.php", "client_ip": "192.168.1.95", "server_ip": "185.68.93.18", "tcp_stream": 1064, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 40009, "response_frame": 40011 }, { "url": "http://185.68.93.18/dot.php", "client_ip": "192.168.1.95", "server_ip": "185.68.93.18", "tcp_stream": 1065, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 40022, "response_frame": 40024 }, { "url": "http://185.68.93.18/dot.php", "client_ip": "192.168.1.95", "server_ip": "185.68.93.18", "tcp_stream": 1066, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 40038, "response_frame": 40040 }, { "url": "http://185.68.93.18/dot.php", "client_ip": "192.168.1.95", "server_ip": "185.68.93.18", "tcp_stream": 1067, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 40051, "response_frame": 40053 }, { "url": "http://185.68.93.18/dot.php", "client_ip": "192.168.1.95", "server_ip": "185.68.93.18", "tcp_stream": 1068, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 40064, "response_frame": 40066 }, { "url": "http://185.68.93.18/dot.php", "client_ip": "192.168.1.95", "server_ip": "185.68.93.18", "tcp_stream": 1069, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 40078, "response_frame": 40080 }, { "url": "http://185.68.93.18/dot.php", "client_ip": "192.168.1.95", "server_ip": "185.68.93.18", "tcp_stream": 1136, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 43076, "response_frame": 43398 }, { "url": "http://185.68.93.18/dot.php", "client_ip": "192.168.1.95", "server_ip": "185.68.93.18", "tcp_stream": 1228, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 46895, "response_frame": 46902 }, { "url": "http://185.68.93.18/dot.php", "client_ip": "192.168.1.95", "server_ip": "185.68.93.18", "tcp_stream": 1231, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 46979, "response_frame": 46981 }, { "url": "http://185.68.93.18/dot.php", "client_ip": "192.168.1.95", "server_ip": "185.68.93.18", "tcp_stream": 1232, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 47000, "response_frame": 47002 }, { "url": "http://185.68.93.18/dot.php", "client_ip": "192.168.1.95", "server_ip": "185.68.93.18", "tcp_stream": 1233, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 47020, "response_frame": 47022 }, { "url": "http://185.68.93.18/dot.php", "client_ip": "192.168.1.95", "server_ip": "185.68.93.18", "tcp_stream": 1234, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 47112, "response_frame": 47115 }, { "url": "http://185.68.93.18/dot.php", "client_ip": "192.168.1.95", "server_ip": "185.68.93.18", "tcp_stream": 1235, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 47140, "response_frame": 47142 }, { "url": "http://185.68.93.18/dot.php", "client_ip": "192.168.1.95", "server_ip": "185.68.93.18", "tcp_stream": 1236, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 47152, "response_frame": 47155 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 12, "artifact_id": "artifact-50c0cc5d5947e9ec159798f8", "occurrences": 31, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 12, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 12, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": true, "content_retained_by_analyzer": false }, { "md5": "c81e728d9d4c2f636f067f89cc14862c", "sha1": "da4b9237bacccdf19c0760cab7aec4a8359010b0", "type": "http-exported-object", "sha256": "d4735e3a265e16eee03f59718b9b5d03019c07d8b6c51f90da3a666eec13ab35", "evidence": [], "filename": "1.rar", "filenames": [ "1.rar" ], "transfers": [], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 1, "artifact_id": "artifact-b07df41d14272258bb1babc5", "occurrences": 1, "completeness": "unknown", "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 1, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false } ], "endpoints": [ { "ip": "0.0.0.0", "bytes_sent": 375, "ip_version": 4, "is_private": true, "endpoint_id": "endpoint-f598f30350734da35b956301", "packets_sent": 1, "mac_addresses": [ "f4:b5:20:68:b1:93" ], "bytes_received": 0, "evidence_frames": [ 1 ], "last_seen_epoch": "1533964508.767375", "first_seen_epoch": "1533964508.767375", "packets_received": 0 }, { "ip": "103.5.149.72", "bytes_sent": 1437100, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-9c89231f8e67737bfc525b6e", "packets_sent": 1007, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 110804, "evidence_frames": [ 40093, 40094, 40098, 40099, 40100 ], "last_seen_epoch": "1533965895.833467", "first_seen_epoch": "1533965768.496173", "packets_received": 995 }, { "ip": "103.5.149.77", "bytes_sent": 1418, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-6d07d526613f728edd1b2a36", "packets_sent": 20, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2017, "evidence_frames": [ 44702, 44898, 44899, 44900, 44901 ], "last_seen_epoch": "1533965791.711191", "first_seen_epoch": "1533965786.044259", "packets_received": 20 }, { "ip": "104.110.128.239", "bytes_sent": 22275, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-022b703eb24b49c013f09765", "packets_sent": 54, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 8149, "evidence_frames": [ 11962, 11963, 12012, 12013, 12016 ], "last_seen_epoch": "1533965205.193726", "first_seen_epoch": "1533964901.768522", "packets_received": 63 }, { "ip": "104.16.240.184", "bytes_sent": 3972, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-767888c3f0f37d98ad82e4bf", "packets_sent": 11, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 1020, "evidence_frames": [ 23972, 23973, 23978, 23979, 23981 ], "last_seen_epoch": "1533965044.773927", "first_seen_epoch": "1533964998.469747", "packets_received": 12 }, { "ip": "104.16.90.188", "bytes_sent": 4566, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-0e97ce488f5caab3b93e76be", "packets_sent": 11, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 998, "evidence_frames": [ 11430, 11431, 11482, 11483, 11485 ], "last_seen_epoch": "1533964947.482584", "first_seen_epoch": "1533964901.275725", "packets_received": 12 }, { "ip": "104.193.83.156", "bytes_sent": 12227, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-0ef6dd28d3b6f56deb309018", "packets_sent": 21, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2393, "evidence_frames": [ 16031, 16033, 16157, 16158, 16160 ], "last_seen_epoch": "1533964990.252033", "first_seen_epoch": "1533964908.406588", "packets_received": 23 }, { "ip": "104.20.21.239", "bytes_sent": 20580, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-92a5c40f6034610007412d56", "packets_sent": 51, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 7419, "evidence_frames": [ 3181, 3182, 3232, 3234, 3236 ], "last_seen_epoch": "1533964990.34463", "first_seen_epoch": "1533964552.352132", "packets_received": 60 }, { "ip": "104.24.246.16", "bytes_sent": 10324, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-a7ac6446b6b156fd54928f28", "packets_sent": 20, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2411, "evidence_frames": [ 26416, 26417, 26451, 26452, 26459 ], "last_seen_epoch": "1533965095.511028", "first_seen_epoch": "1533965032.678228", "packets_received": 22 }, { "ip": "104.25.163.34", "bytes_sent": 30257, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-04fdf341477fd4158f4adcc6", "packets_sent": 42, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 4755, "evidence_frames": [ 3342, 3343, 3464, 3474, 3476 ], "last_seen_epoch": "1533964990.413593", "first_seen_epoch": "1533964552.718626", "packets_received": 46 }, { "ip": "104.254.150.179", "bytes_sent": 10045, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-0ffe7a12214ff85b26e183d7", "packets_sent": 22, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 4762, "evidence_frames": [ 19912, 19913, 19915, 19916, 19917 ], "last_seen_epoch": "1533964990.236866", "first_seen_epoch": "1533964963.542804", "packets_received": 25 }, { "ip": "104.254.150.69", "bytes_sent": 61693, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-8cc9e99280d39ae646a8f36d", "packets_sent": 130, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 38571, "evidence_frames": [ 18192, 18193, 18221, 18222, 18223 ], "last_seen_epoch": "1533965205.074395", "first_seen_epoch": "1533964958.453469", "packets_received": 138 }, { "ip": "104.254.150.77", "bytes_sent": 140567, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-8111ba7efa0bc60b2f833773", "packets_sent": 522, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 166699, "evidence_frames": [ 8961, 8964, 9010, 9012, 9015 ], "last_seen_epoch": "1533965249.303972", "first_seen_epoch": "1533964898.931602", "packets_received": 577 }, { "ip": "104.36.113.17", "bytes_sent": 75462, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-8b74779459772b4d682b381c", "packets_sent": 217, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 85123, "evidence_frames": [ 11979, 11980, 12036, 12037, 12038 ], "last_seen_epoch": "1533965249.306554", "first_seen_epoch": "1533964901.784284", "packets_received": 206 }, { "ip": "104.36.113.23", "bytes_sent": 30876, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-88b1be055b8f22bb6d64be91", "packets_sent": 52, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 15523, "evidence_frames": [ 15931, 15932, 15933, 15934, 15935 ], "last_seen_epoch": "1533965249.303903", "first_seen_epoch": "1533964908.056895", "packets_received": 49 }, { "ip": "104.36.113.24", "bytes_sent": 30741, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-a302db5533562b7f9af69d98", "packets_sent": 81, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 25267, "evidence_frames": [ 16392, 16393, 16407, 16408, 16410 ], "last_seen_epoch": "1533965249.3084", "first_seen_epoch": "1533964908.88881", "packets_received": 85 }, { "ip": "107.178.242.85", "bytes_sent": 13635, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-5e7dd5d1fd26a841470ec79f", "packets_sent": 21, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2441, "evidence_frames": [ 31680, 31686, 31760, 31768, 31772 ], "last_seen_epoch": "1533965205.149957", "first_seen_epoch": "1533965100.798014", "packets_received": 24 }, { "ip": "107.178.254.65", "bytes_sent": 12304, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-b5445239479963b7f0ab5fd8", "packets_sent": 23, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 3206, "evidence_frames": [ 20341, 20342, 20380, 20381, 20384 ], "last_seen_epoch": "1533965095.51247", "first_seen_epoch": "1533964965.301971", "packets_received": 22 }, { "ip": "109.201.156.81", "bytes_sent": 131419, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-647c498ed6c7911181d67a85", "packets_sent": 128, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 13166, "evidence_frames": [ 40244, 40245, 40246, 40247, 40248 ], "last_seen_epoch": "1533965852.336571", "first_seen_epoch": "1533965770.576109", "packets_received": 139 }, { "ip": "109.232.197.110", "bytes_sent": 14433, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-173065f8b28db14dc23d3822", "packets_sent": 44, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 6873, "evidence_frames": [ 19260, 19261, 19354, 19355, 19356 ], "last_seen_epoch": "1533965205.072189", "first_seen_epoch": "1533964961.641452", "packets_received": 49 }, { "ip": "13.107.4.50", "bytes_sent": 6048, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-60b24aa8a9a38a6c42d69940", "packets_sent": 12, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2056, "evidence_frames": [ 27996, 27997, 28004, 28009, 28011 ], "last_seen_epoch": "1533965096.955615", "first_seen_epoch": "1533965036.570975", "packets_received": 20 }, { "ip": "13.33.106.254", "bytes_sent": 26143, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-fbf371dffaf03ca6329175d3", "packets_sent": 29, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2915, "evidence_frames": [ 5858, 5859, 5877, 5878, 5881 ], "last_seen_epoch": "1533964664.51531", "first_seen_epoch": "1533964559.423429", "packets_received": 32 }, { "ip": "13.33.107.160", "bytes_sent": 106064, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-2e5657da61fd41dcefc844ff", "packets_sent": 57, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 4839, "evidence_frames": [ 10624, 10625, 10671, 10673, 10674 ], "last_seen_epoch": "1533964990.407065", "first_seen_epoch": "1533964900.625288", "packets_received": 62 }, { "ip": "13.33.78.101", "bytes_sent": 209305, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-ea17b6631d8af15f125cc25d", "packets_sent": 141, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 13295, "evidence_frames": [ 20108, 20109, 20125, 20126, 20127 ], "last_seen_epoch": "1533965249.30533", "first_seen_epoch": "1533964964.634689", "packets_received": 139 }, { "ip": "13.33.78.186", "bytes_sent": 4050, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-3fe0e1a4e45f43d6b63229cf", "packets_sent": 8, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 826, "evidence_frames": [ 6240, 6241, 6265, 6266, 6267 ], "last_seen_epoch": "1533964620.357227", "first_seen_epoch": "1533964560.174007", "packets_received": 10 }, { "ip": "13.57.70.199", "bytes_sent": 4625, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-acf0dea929e48bdbc8a1bbef", "packets_sent": 12, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2439, "evidence_frames": [ 13501, 13541, 13548, 13560, 13561 ], "last_seen_epoch": "1533964990.272613", "first_seen_epoch": "1533964903.484122", "packets_received": 13 }, { "ip": "136.243.151.13", "bytes_sent": 15153, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-0bb6c99825258b6102c81b66", "packets_sent": 25, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 4647, "evidence_frames": [ 45341, 45342, 45584, 45585, 45586 ], "last_seen_epoch": "1533965792.577212", "first_seen_epoch": "1533965787.456309", "packets_received": 26 }, { "ip": "136.243.25.70", "bytes_sent": 49518, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-0637b91cee554d890a4f8e3e", "packets_sent": 123, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 19899, "evidence_frames": [ 606, 607, 710, 711, 712 ], "last_seen_epoch": "1533965249.30547", "first_seen_epoch": "1533964545.63126", "packets_received": 145 }, { "ip": "136.243.42.249", "bytes_sent": 34520, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-036f664f77c6d7349ebe8baa", "packets_sent": 42, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 8770, "evidence_frames": [ 9341, 9342, 9750, 9754, 9758 ], "last_seen_epoch": "1533965249.306126", "first_seen_epoch": "1533964899.270164", "packets_received": 45 }, { "ip": "142.93.61.37", "bytes_sent": 43838, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-4f547069c738b9ec14e39f2f", "packets_sent": 40, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 3499, "evidence_frames": [ 44222, 44225, 44350, 44351, 44352 ], "last_seen_epoch": "1533965852.336307", "first_seen_epoch": "1533965784.463646", "packets_received": 42 }, { "ip": "146.20.132.243", "bytes_sent": 35694, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-ee9c3ccc24102000eb15ebfd", "packets_sent": 82, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 14453, "evidence_frames": [ 15640, 15641, 15656, 15664, 15665 ], "last_seen_epoch": "1533964990.256324", "first_seen_epoch": "1533964906.968703", "packets_received": 91 }, { "ip": "146.20.133.87", "bytes_sent": 32860, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-4e056daa0dd7134e5d0316b4", "packets_sent": 56, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 11390, "evidence_frames": [ 14713, 14714, 14715, 14716, 14887 ], "last_seen_epoch": "1533964990.263166", "first_seen_epoch": "1533964904.706816", "packets_received": 62 }, { "ip": "148.251.82.59", "bytes_sent": 17850, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-465f8f9700b4828e3269f024", "packets_sent": 36, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 5182, "evidence_frames": [ 11484, 11489, 11531, 11532, 11828 ], "last_seen_epoch": "1533964990.282452", "first_seen_epoch": "1533964901.324205", "packets_received": 44 }, { "ip": "149.129.222.112", "bytes_sent": 107194, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-70d6a7fecf7a9e5df571d993", "packets_sent": 36, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2235, "evidence_frames": [ 7260, 7261, 7262, 7263, 7264 ], "last_seen_epoch": "1533964916.18851", "first_seen_epoch": "1533964850.057854", "packets_received": 29 }, { "ip": "149.174.66.131", "bytes_sent": 18165, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-318be771885673c0a36c2fc2", "packets_sent": 40, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 6223, "evidence_frames": [ 5894, 5895, 5929, 5932, 5934 ], "last_seen_epoch": "1533965095.512648", "first_seen_epoch": "1533964559.52613", "packets_received": 44 }, { "ip": "151.101.0.166", "bytes_sent": 11518, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-6ff2375b4f461839240e07a0", "packets_sent": 31, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 4424, "evidence_frames": [ 26421, 26422, 26453, 26454, 26461 ], "last_seen_epoch": "1533965205.177738", "first_seen_epoch": "1533965032.700887", "packets_received": 35 }, { "ip": "151.101.2.2", "bytes_sent": 31008, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-b974da1ef4b802ca80050997", "packets_sent": 42, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 5000, "evidence_frames": [ 13360, 13361, 13401, 13402, 13409 ], "last_seen_epoch": "1533965205.168084", "first_seen_epoch": "1533964903.247274", "packets_received": 43 }, { "ip": "151.101.2.49", "bytes_sent": 55525, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-1bb9378199575d296a0c8ce9", "packets_sent": 97, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 13163, "evidence_frames": [ 5156, 5157, 5196, 5202, 5206 ], "last_seen_epoch": "1533965205.193275", "first_seen_epoch": "1533964556.031731", "packets_received": 102 }, { "ip": "151.101.41.108", "bytes_sent": 24180, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-db283d5f7bae5ed0522e7b8a", "packets_sent": 27, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 3283, "evidence_frames": [ 23217, 23218, 23265, 23266, 23267 ], "last_seen_epoch": "1533965095.511445", "first_seen_epoch": "1533964997.082428", "packets_received": 29 }, { "ip": "151.101.53.108", "bytes_sent": 26639, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-2a10c32492acc1bf311ed2a4", "packets_sent": 28, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2995, "evidence_frames": [ 19306, 19307, 19346, 19347, 19348 ], "last_seen_epoch": "1533965095.513276", "first_seen_epoch": "1533964961.767708", "packets_received": 29 }, { "ip": "151.236.120.42", "bytes_sent": 329062, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-d366f95d77a9d38bc7bc803f", "packets_sent": 290, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 28503, "evidence_frames": [ 40225, 40228, 40230, 40231, 40235 ], "last_seen_epoch": "1533965846.842356", "first_seen_epoch": "1533965770.570159", "packets_received": 300 }, { "ip": "151.236.85.22", "bytes_sent": 143823, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-42f1cf7ab641b21abaece205", "packets_sent": 145, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 15045, "evidence_frames": [ 40194, 40195, 40196, 40197, 40198 ], "last_seen_epoch": "1533965852.336673", "first_seen_epoch": "1533965770.484932", "packets_received": 158 }, { "ip": "151.236.98.22", "bytes_sent": 290093, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-2e8a752d4e73967db6dbeb40", "packets_sent": 257, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 26279, "evidence_frames": [ 40226, 40227, 40229, 40234, 40238 ], "last_seen_epoch": "1533965796.870681", "first_seen_epoch": "1533965770.570161", "packets_received": 274 }, { "ip": "152.195.14.112", "bytes_sent": 8596, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-3e20687bf54cd7f1bdaec56d", "packets_sent": 20, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2537, "evidence_frames": [ 26645, 26646, 26666, 26667, 26668 ], "last_seen_epoch": "1533965095.509491", "first_seen_epoch": "1533965033.203672", "packets_received": 20 }, { "ip": "156.154.202.36", "bytes_sent": 9525, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-de84d8c85236e3dcb21835ed", "packets_sent": 18, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2725, "evidence_frames": [ 20231, 20236, 20329, 20333, 20339 ], "last_seen_epoch": "1533965095.513908", "first_seen_epoch": "1533964965.013479", "packets_received": 19 }, { "ip": "157.240.11.22", "bytes_sent": 93977, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-e186923ddac232347fce915e", "packets_sent": 69, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 5594, "evidence_frames": [ 43675, 43676, 43688, 43689, 43690 ], "last_seen_epoch": "1533965786.501232", "first_seen_epoch": "1533965783.129179", "packets_received": 73 }, { "ip": "161.170.239.188", "bytes_sent": 11117, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-031951338e878b5640fcc7bd", "packets_sent": 17, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2119, "evidence_frames": [ 19706, 19707, 19774, 19775, 19778 ], "last_seen_epoch": "1533965095.516055", "first_seen_epoch": "1533964962.898629", "packets_received": 18 }, { "ip": "162.210.199.69", "bytes_sent": 12377, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-3d29bda167857960308ea65d", "packets_sent": 34, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 5503, "evidence_frames": [ 10622, 10623, 10774, 10775, 10776 ], "last_seen_epoch": "1533965205.039202", "first_seen_epoch": "1533964900.624776", "packets_received": 42 }, { "ip": "172.217.0.42", "bytes_sent": 42149, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-0efa69905b7f1d2fb2f2ad36", "packets_sent": 42, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 3422, "evidence_frames": [ 612, 613, 620, 621, 622 ], "last_seen_epoch": "1533964664.5046", "first_seen_epoch": "1533964545.652189", "packets_received": 42 }, { "ip": "172.217.0.54", "bytes_sent": 178426, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-b3ecb5577345f67e8f9be603", "packets_sent": 122, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 9871, "evidence_frames": [ 5699, 5700, 5701, 5702, 5703 ], "last_seen_epoch": "1533964990.385003", "first_seen_epoch": "1533964558.771978", "packets_received": 127 }, { "ip": "172.217.6.66", "bytes_sent": 39886, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-4daaa2f3336fa705c988c5ec", "packets_sent": 102, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 21336, "evidence_frames": [ 5147, 5150, 5194, 5199, 5200 ], "last_seen_epoch": "1533965790.158148", "first_seen_epoch": "1533964556.027652", "packets_received": 111 }, { "ip": "172.217.6.78", "bytes_sent": 1252753, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-f98edaea9f77a14fdfd2a6be", "packets_sent": 760, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 66313, "evidence_frames": [ 3213, 3214, 3314, 3316, 3317 ], "last_seen_epoch": "1533964990.508293", "first_seen_epoch": "1533964552.430758", "packets_received": 753 }, { "ip": "173.0.153.44", "bytes_sent": 228422, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-4421c2eb23b14f664584f189", "packets_sent": 203, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 23046, "evidence_frames": [ 8127, 8128, 8389, 8392, 8395 ], "last_seen_epoch": "1533964990.304881", "first_seen_epoch": "1533964897.942562", "packets_received": 229 }, { "ip": "173.239.42.221", "bytes_sent": 10788, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-70271e51bbd6f7f561f0e8f9", "packets_sent": 19, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2683, "evidence_frames": [ 31679, 31683, 31831, 31832, 31834 ], "last_seen_epoch": "1533965205.219618", "first_seen_epoch": "1533965100.797631", "packets_received": 20 }, { "ip": "173.241.250.104", "bytes_sent": 9099, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-95f2d99b0089acbc5b771727", "packets_sent": 24, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 3891, "evidence_frames": [ 5873, 5875, 5910, 5911, 5915 ], "last_seen_epoch": "1533964664.426766", "first_seen_epoch": "1533964559.48631", "packets_received": 28 }, { "ip": "173.241.250.143", "bytes_sent": 39489, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-5ec55b25be66971f93c907b1", "packets_sent": 122, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 23621, "evidence_frames": [ 4899, 4900, 4922, 4924, 4925 ], "last_seen_epoch": "1533964990.300149", "first_seen_epoch": "1533964555.653264", "packets_received": 135 }, { "ip": "173.241.250.220", "bytes_sent": 179661, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-34ca7aa4e258ded1b0409c5a", "packets_sent": 187, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 26251, "evidence_frames": [ 618, 619, 648, 650, 651 ], "last_seen_epoch": "1533964990.311717", "first_seen_epoch": "1533964545.679168", "packets_received": 204 }, { "ip": "178.154.131.215", "bytes_sent": 125408, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-761e404516aea46433c24394", "packets_sent": 79, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 7339, "evidence_frames": [ 609, 610, 734, 735, 741 ], "last_seen_epoch": "1533964990.310595", "first_seen_epoch": "1533964545.638724", "packets_received": 86 }, { "ip": "18.218.6.11", "bytes_sent": 10204, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-229037e4677b1a7ed1406064", "packets_sent": 30, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 4924, "evidence_frames": [ 32845, 32846, 32862, 32863, 32864 ], "last_seen_epoch": "1533965249.30788", "first_seen_epoch": "1533965136.091467", "packets_received": 38 }, { "ip": "18.218.60.224", "bytes_sent": 12639, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-16adbea721b7455e79d5a09a", "packets_sent": 18, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2355, "evidence_frames": [ 35541, 35542, 35617, 35618, 35619 ], "last_seen_epoch": "1533965249.30887", "first_seen_epoch": "1533965160.370868", "packets_received": 22 }, { "ip": "184.26.122.58", "bytes_sent": 23570, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-02de347311f9244e19859cb3", "packets_sent": 24, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 4014, "evidence_frames": [ 16446, 16447, 16456, 16457, 16460 ], "last_seen_epoch": "1533965095.516625", "first_seen_epoch": "1533964909.104657", "packets_received": 26 }, { "ip": "185.167.164.37", "bytes_sent": 37684, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-7f042b0d9a9a88f045a62f79", "packets_sent": 101, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 13598, "evidence_frames": [ 8974, 8975, 9112, 9113, 9116 ], "last_seen_epoch": "1533965095.256126", "first_seen_epoch": "1533964898.937702", "packets_received": 116 }, { "ip": "185.167.164.39", "bytes_sent": 66203, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-793c6d526ad4bce4d01fc619", "packets_sent": 128, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 27389, "evidence_frames": [ 18766, 18768, 18888, 18889, 18890 ], "last_seen_epoch": "1533965249.307686", "first_seen_epoch": "1533964960.024897", "packets_received": 140 }, { "ip": "185.167.166.41", "bytes_sent": 169050, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-9075f130c574a48eed722319", "packets_sent": 132, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 12677, "evidence_frames": [ 19169, 19170, 19171, 19172, 19173 ], "last_seen_epoch": "1533965249.30488", "first_seen_epoch": "1533964960.870331", "packets_received": 124 }, { "ip": "185.180.13.28", "bytes_sent": 8301, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-c40d00dccde7747aa28d801e", "packets_sent": 19, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2761, "evidence_frames": [ 21153, 21154, 21423, 21424, 21425 ], "last_seen_epoch": "1533964990.234286", "first_seen_epoch": "1533964967.907274", "packets_received": 22 }, { "ip": "185.28.71.53", "bytes_sent": 2024198, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-667d259a696623c0d3fce371", "packets_sent": 1248, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 92666, "evidence_frames": [ 655, 656, 657, 658, 660 ], "last_seen_epoch": "1533964990.309888", "first_seen_epoch": "1533964545.747155", "packets_received": 1239 }, { "ip": "185.68.93.18", "bytes_sent": 20057, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-f4d0e248b12108fafded017b", "packets_sent": 193, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 28301, "evidence_frames": [ 39551, 39553, 39554, 39555, 39556 ], "last_seen_epoch": "1533965907.307885", "first_seen_epoch": "1533965406.683517", "packets_received": 224 }, { "ip": "185.86.137.43", "bytes_sent": 8591, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-5e066df9edf080bc4d4dc3a5", "packets_sent": 21, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2257, "evidence_frames": [ 27535, 27536, 27759, 27763, 27768 ], "last_seen_epoch": "1533965205.317518", "first_seen_epoch": "1533965035.693875", "packets_received": 20 }, { "ip": "185.99.9.117", "bytes_sent": 9608, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-ae0dbb7992e417db647730c3", "packets_sent": 13, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 1200, "evidence_frames": [ 46423, 46424, 46563, 46564, 46565 ], "last_seen_epoch": "1533965812.125932", "first_seen_epoch": "1533965791.277407", "packets_received": 15 }, { "ip": "192.168.1.1", "bytes_sent": 0, "ip_version": 4, "is_private": true, "endpoint_id": "endpoint-96bf5d0bef4914d9cd0035ba", "packets_sent": 0, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 6000, "evidence_frames": [ 8, 9, 10, 176, 177 ], "last_seen_epoch": "1533965831.770624", "first_seen_epoch": "1533964508.857262", "packets_received": 57 }, { "ip": "192.168.1.254", "bytes_sent": 2052, "ip_version": 4, "is_private": true, "endpoint_id": "endpoint-3125b6a0988e045499df7775", "packets_sent": 6, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 369, "evidence_frames": [ 2, 289, 6563, 7258, 39646 ], "last_seen_epoch": "1533965768.477603", "first_seen_epoch": "1533964508.776328", "packets_received": 1 }, { "ip": "192.168.1.255", "bytes_sent": 0, "ip_version": 4, "is_private": true, "endpoint_id": "endpoint-6263f70e93411cf48ee1af66", "packets_sent": 0, "mac_addresses": [ "ff:ff:ff:ff:ff:ff" ], "bytes_received": 2976, "evidence_frames": [ 299, 300, 301, 303, 304 ], "last_seen_epoch": "1533965777.36695", "first_seen_epoch": "1533964513.421398", "packets_received": 30 }, { "ip": "192.168.1.6", "bytes_sent": 140806, "ip_version": 4, "is_private": true, "endpoint_id": "endpoint-afebea7b2b466b78275e7eba", "packets_sent": 651, "mac_addresses": [ "a4:1f:72:c2:09:6a" ], "bytes_received": 124736, "evidence_frames": [ 6, 7, 13, 14, 15 ], "last_seen_epoch": "1533965798.750795", "first_seen_epoch": "1533964508.8339", "packets_received": 682 }, { "ip": "192.168.1.95", "bytes_sent": 3166179, "ip_version": 4, "is_private": true, "endpoint_id": "endpoint-4bd6d2028d635065bd4427e4", "packets_sent": 23781, "mac_addresses": [ "f4:b5:20:68:b1:93" ], "bytes_received": 26082781, "evidence_frames": [ 2, 3, 4, 5, 6 ], "last_seen_epoch": "1533965907.307885", "first_seen_epoch": "1533964508.776328", "packets_received": 23395 }, { "ip": "192.229.163.25", "bytes_sent": 48418, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-abb614c29d63c34a27a25e6d", "packets_sent": 38, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 3954, "evidence_frames": [ 43672, 43673, 43694, 43696, 43698 ], "last_seen_epoch": "1533965844.349571", "first_seen_epoch": "1533965783.113408", "packets_received": 41 }, { "ip": "192.229.210.158", "bytes_sent": 8442197, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-25303387203505f588e1e171", "packets_sent": 3730, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 200873, "evidence_frames": [ 20117, 20118, 20133, 20134, 20135 ], "last_seen_epoch": "1533965249.308067", "first_seen_epoch": "1533964964.706776", "packets_received": 3148 }, { "ip": "192.35.177.64", "bytes_sent": 2720, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-c862fccdb71432a75183cec5", "packets_sent": 6, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 878, "evidence_frames": [ 8584, 8587, 8631, 8632, 8633 ], "last_seen_epoch": "1533964961.521069", "first_seen_epoch": "1533964898.485786", "packets_received": 10 }, { "ip": "194.226.130.228", "bytes_sent": 1418, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-af28107fbe1c06fb0079627a", "packets_sent": 7, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 1254, "evidence_frames": [ 43644, 43645, 43723, 43724, 43725 ], "last_seen_epoch": "1533965829.564234", "first_seen_epoch": "1533965783.028698", "packets_received": 9 }, { "ip": "194.226.130.229", "bytes_sent": 15448, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-03cddf0601f80c8aa5f8141c", "packets_sent": 39, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 6592, "evidence_frames": [ 3306, 3307, 3541, 3546, 3553 ], "last_seen_epoch": "1533964990.302407", "first_seen_epoch": "1533964552.640245", "packets_received": 47 }, { "ip": "195.244.31.10", "bytes_sent": 7028, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-2b201ac4e9ff888b51833ad2", "packets_sent": 13, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 1928, "evidence_frames": [ 13599, 13747, 13749, 13770, 13772 ], "last_seen_epoch": "1533964990.270902", "first_seen_epoch": "1533964903.57737", "packets_received": 14 }, { "ip": "198.23.90.60", "bytes_sent": 17078, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-f86b77896493a2172c6a39fa", "packets_sent": 38, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 5261, "evidence_frames": [ 5874, 5876, 5904, 5905, 5906 ], "last_seen_epoch": "1533965095.510487", "first_seen_epoch": "1533964559.486403", "packets_received": 42 }, { "ip": "198.54.12.145", "bytes_sent": 8390, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-e5b6f852014ed69eb621ea33", "packets_sent": 20, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 3216, "evidence_frames": [ 19709, 19710, 19766, 19767, 19769 ], "last_seen_epoch": "1533964995.180039", "first_seen_epoch": "1533964962.90301", "packets_received": 20 }, { "ip": "198.70.71.144", "bytes_sent": 2774, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-dea21ef28dbfb6dcd09234b1", "packets_sent": 6, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 1028, "evidence_frames": [ 4277, 4285, 4327, 4330, 4331 ], "last_seen_epoch": "1533964620.356851", "first_seen_epoch": "1533964554.078325", "packets_received": 10 }, { "ip": "198.70.71.161", "bytes_sent": 473, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-fea510955f24a7a939502045", "packets_sent": 5, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 397, "evidence_frames": [ 382, 383, 384, 385, 386 ], "last_seen_epoch": "1533964519.601928", "first_seen_epoch": "1533964519.505521", "packets_received": 5 }, { "ip": "199.38.167.128", "bytes_sent": 29592, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-bd84088b661bbadf4d331890", "packets_sent": 76, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 11604, "evidence_frames": [ 6314, 6315, 6338, 6339, 6340 ], "last_seen_epoch": "1533965044.773117", "first_seen_epoch": "1533964560.554068", "packets_received": 78 }, { "ip": "199.59.149.201", "bytes_sent": 10011, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-455981e410a168c31c87097f", "packets_sent": 20, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 5475, "evidence_frames": [ 44344, 44345, 44619, 44621, 44622 ], "last_seen_epoch": "1533965787.190205", "first_seen_epoch": "1533965785.002143", "packets_received": 21 }, { "ip": "204.11.109.68", "bytes_sent": 24291, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-0d6ddc3604a42e58038c3191", "packets_sent": 41, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 6617, "evidence_frames": [ 18643, 18644, 18703, 18704, 18705 ], "last_seen_epoch": "1533965205.179526", "first_seen_epoch": "1533964959.509834", "packets_received": 45 }, { "ip": "204.2.197.201", "bytes_sent": 11877, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-cc2f497301818cb79714f900", "packets_sent": 21, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2217, "evidence_frames": [ 18641, 18642, 18734, 18735, 18736 ], "last_seen_epoch": "1533964990.24012", "first_seen_epoch": "1533964959.509316", "packets_received": 20 }, { "ip": "204.2.250.100", "bytes_sent": 12172, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-d197d23b329b674603fa633c", "packets_sent": 20, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 3990, "evidence_frames": [ 13019, 13020, 13092, 13093, 13098 ], "last_seen_epoch": "1533964990.372349", "first_seen_epoch": "1533964902.981284", "packets_received": 22 }, { "ip": "204.79.197.200", "bytes_sent": 12117, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-c8c32fdee3d41df607e8e45b", "packets_sent": 16, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2095, "evidence_frames": [ 19677, 19678, 19749, 19750, 19753 ], "last_seen_epoch": "1533965086.308506", "first_seen_epoch": "1533964962.858565", "packets_received": 16 }, { "ip": "205.180.87.137", "bytes_sent": 9592, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-d746dadd1566059e9e365766", "packets_sent": 19, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2904, "evidence_frames": [ 16040, 16041, 16101, 16102, 16103 ], "last_seen_epoch": "1533964908.781577", "first_seen_epoch": "1533964908.426287", "packets_received": 21 }, { "ip": "205.180.87.204", "bytes_sent": 18812, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-d83e686e4672afff7ef05111", "packets_sent": 40, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 5698, "evidence_frames": [ 26807, 26808, 26834, 26835, 26842 ], "last_seen_epoch": "1533965036.218732", "first_seen_epoch": "1533965033.629919", "packets_received": 43 }, { "ip": "205.185.216.10", "bytes_sent": 348872, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-7e00dc81bbeeaafd5e1fe4ec", "packets_sent": 215, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 15528, "evidence_frames": [ 15187, 15188, 15189, 15190, 15191 ], "last_seen_epoch": "1533964990.260531", "first_seen_epoch": "1533964906.188846", "packets_received": 186 }, { "ip": "205.185.216.42", "bytes_sent": 156549, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-49df34c828873e2deb177044", "packets_sent": 107, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 7693, "evidence_frames": [ 7516, 7517, 7544, 7545, 7546 ], "last_seen_epoch": "1533965520.76087", "first_seen_epoch": "1533964897.325081", "packets_received": 97 }, { "ip": "207.244.102.143", "bytes_sent": 40244, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-f771ab8d6cb47abe16de1194", "packets_sent": 96, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 12434, "evidence_frames": [ 18190, 18191, 18250, 18251, 18252 ], "last_seen_epoch": "1533965205.073727", "first_seen_epoch": "1533964958.451691", "packets_received": 111 }, { "ip": "207.244.80.166", "bytes_sent": 541172, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-486e2120153152f85d51d729", "packets_sent": 451, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 50390, "evidence_frames": [ 544, 545, 546, 547, 548 ], "last_seen_epoch": "1533964990.312322", "first_seen_epoch": "1533964544.69751", "packets_received": 455 }, { "ip": "208.185.50.80", "bytes_sent": 17769, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-68084cdd5ee7a095294ce5b8", "packets_sent": 52, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 13743, "evidence_frames": [ 18790, 18791, 18905, 18910, 18914 ], "last_seen_epoch": "1533965249.304452", "first_seen_epoch": "1533964960.050067", "packets_received": 53 }, { "ip": "209.191.163.209", "bytes_sent": 13190, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-8fc74dd03daa64e114403837", "packets_sent": 23, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2822, "evidence_frames": [ 31684, 31685, 31786, 31787, 31788 ], "last_seen_epoch": "1533965205.053843", "first_seen_epoch": "1533965100.798951", "packets_received": 23 }, { "ip": "209.58.136.30", "bytes_sent": 12598, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-7cd08df52beddfee465f2b9f", "packets_sent": 24, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 3080, "evidence_frames": [ 23087, 23088, 23110, 23111, 23112 ], "last_seen_epoch": "1533965095.229097", "first_seen_epoch": "1533964996.619396", "packets_received": 27 }, { "ip": "213.155.156.164", "bytes_sent": 7888, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-b6e0d110fbae2075d495e57f", "packets_sent": 16, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2185, "evidence_frames": [ 35525, 35527, 35684, 35685, 35686 ], "last_seen_epoch": "1533965249.308414", "first_seen_epoch": "1533965160.355508", "packets_received": 19 }, { "ip": "213.180.193.90", "bytes_sent": 265621, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-ba7b1f4481993f43e078383f", "packets_sent": 174, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 19651, "evidence_frames": [ 3199, 3200, 3425, 3426, 3428 ], "last_seen_epoch": "1533964990.306491", "first_seen_epoch": "1533964552.406064", "packets_received": 183 }, { "ip": "216.115.100.123", "bytes_sent": 24503, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-f426f75f231166ed037adc37", "packets_sent": 27, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2931, "evidence_frames": [ 18743, 18744, 18833, 18834, 18849 ], "last_seen_epoch": "1533965095.512755", "first_seen_epoch": "1533964959.981697", "packets_received": 31 }, { "ip": "216.200.232.221", "bytes_sent": 26003, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-416f83b51316af9d9bb8bf2d", "packets_sent": 64, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 10657, "evidence_frames": [ 5124, 5128, 5224, 5228, 5229 ], "last_seen_epoch": "1533965205.19727", "first_seen_epoch": "1533964555.986776", "packets_received": 71 }, { "ip": "216.52.31.73", "bytes_sent": 13666, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-49efc722db47600c8dc2cc58", "packets_sent": 22, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 3330, "evidence_frames": [ 30804, 30805, 31172, 31173, 31178 ], "last_seen_epoch": "1533965205.058759", "first_seen_epoch": "1533965099.27953", "packets_received": 24 }, { "ip": "216.58.192.1", "bytes_sent": 600732, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-48407d6d6f3dd2e078984236", "packets_sent": 488, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 44007, "evidence_frames": [ 4937, 4938, 4984, 4985, 4986 ], "last_seen_epoch": "1533965789.672194", "first_seen_epoch": "1533964555.714588", "packets_received": 505 }, { "ip": "216.58.192.10", "bytes_sent": 634947, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-2520addd64c3e58eafe0d27d", "packets_sent": 389, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 24551, "evidence_frames": [ 2430, 2433, 2513, 2514, 2515 ], "last_seen_epoch": "1533965786.714848", "first_seen_epoch": "1533964549.759899", "packets_received": 324 }, { "ip": "216.58.192.14", "bytes_sent": 79782, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-536bbeac2e34e9e95ab2a5c4", "packets_sent": 125, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 18019, "evidence_frames": [ 3328, 3329, 3445, 3447, 3448 ], "last_seen_epoch": "1533965790.494167", "first_seen_epoch": "1533964552.700698", "packets_received": 136 }, { "ip": "216.58.192.2", "bytes_sent": 352394, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-69803ddcb09abce1340d599f", "packets_sent": 437, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 108520, "evidence_frames": [ 3940, 3942, 4021, 4023, 4026 ], "last_seen_epoch": "1533965787.64486", "first_seen_epoch": "1533964553.577535", "packets_received": 438 }, { "ip": "216.58.192.3", "bytes_sent": 214759, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-4c92dd3660a44b4e51d3e6c5", "packets_sent": 175, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 15192, "evidence_frames": [ 3201, 3202, 3203, 3256, 3257 ], "last_seen_epoch": "1533965788.592257", "first_seen_epoch": "1533964552.406364", "packets_received": 181 }, { "ip": "216.58.192.4", "bytes_sent": 23277, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-437a66620eda4c878aa3bf2f", "packets_sent": 63, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 8764, "evidence_frames": [ 4753, 4754, 4769, 4770, 4772 ], "last_seen_epoch": "1533965799.829564", "first_seen_epoch": "1533964555.308004", "packets_received": 71 }, { "ip": "216.58.192.6", "bytes_sent": 327853, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-f02db536a0e5e4007c677bb3", "packets_sent": 227, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 22423, "evidence_frames": [ 5457, 5458, 5534, 5535, 5537 ], "last_seen_epoch": "1533965095.522062", "first_seen_epoch": "1533964556.91027", "packets_received": 228 }, { "ip": "216.58.192.8", "bytes_sent": 54023, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-d58945cff85df4da2738719f", "packets_sent": 34, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2348, "evidence_frames": [ 43663, 43664, 43681, 43685, 43686 ], "last_seen_epoch": "1533965783.936684", "first_seen_epoch": "1533965783.091622", "packets_received": 34 }, { "ip": "216.58.194.162", "bytes_sent": 451568, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-a01c30fe05df738c74209054", "packets_sent": 757, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 161025, "evidence_frames": [ 3186, 3187, 3233, 3235, 3238 ], "last_seen_epoch": "1533965791.350153", "first_seen_epoch": "1533964552.354455", "packets_received": 787 }, { "ip": "224.0.0.22", "bytes_sent": 0, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-13ed83b9f6bc8c747e338eec", "packets_sent": 0, "mac_addresses": [ "01:00:5e:00:00:16" ], "bytes_received": 900, "evidence_frames": [ 3, 4, 12, 18, 126 ], "last_seen_epoch": "1533965410.637143", "first_seen_epoch": "1533964508.783571", "packets_received": 15 }, { "ip": "224.0.0.252", "bytes_sent": 0, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-17482ae226615f7a1e7dcd4b", "packets_sent": 0, "mac_addresses": [ "01:00:5e:00:00:fc" ], "bytes_received": 840, "evidence_frames": [ 5, 11, 17, 23, 287 ], "last_seen_epoch": "1533965768.638881", "first_seen_epoch": "1533964508.786149", "packets_received": 12 }, { "ip": "23.108.108.218", "bytes_sent": 11401, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-844da6c939c1fa9a41943d81", "packets_sent": 16, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2209, "evidence_frames": [ 46078, 46079, 46095, 46096, 46099 ], "last_seen_epoch": "1533965850.288721", "first_seen_epoch": "1533965789.701868", "packets_received": 17 }, { "ip": "23.20.36.175", "bytes_sent": 7903, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-bb5939d1bd1d8c1bdb70b6c1", "packets_sent": 19, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2389, "evidence_frames": [ 35557, 35558, 35633, 35634, 35635 ], "last_seen_epoch": "1533965249.309001", "first_seen_epoch": "1533965160.383567", "packets_received": 21 }, { "ip": "23.213.38.151", "bytes_sent": 11577, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-6bfb526dcf1f55fcab144645", "packets_sent": 19, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2425, "evidence_frames": [ 14602, 14603, 14663, 14668, 14675 ], "last_seen_epoch": "1533964990.346014", "first_seen_epoch": "1533964904.630024", "packets_received": 21 }, { "ip": "23.220.174.162", "bytes_sent": 151471, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-e23a94a71eb3bcdc23687f54", "packets_sent": 120, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 14693, "evidence_frames": [ 8149, 8151, 8373, 8374, 8375 ], "last_seen_epoch": "1533964990.448796", "first_seen_epoch": "1533964897.94955", "packets_received": 127 }, { "ip": "23.220.187.187", "bytes_sent": 44782, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-af9761593cd1565c4b31a949", "packets_sent": 49, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 5886, "evidence_frames": [ 12843, 12844, 12906, 12908, 12916 ], "last_seen_epoch": "1533965095.513028", "first_seen_epoch": "1533964902.809632", "packets_received": 53 }, { "ip": "23.35.180.245", "bytes_sent": 118990, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-76fae5da6fdb3c244fea07df", "packets_sent": 74, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 5968, "evidence_frames": [ 12261, 12262, 12418, 12419, 12423 ], "last_seen_epoch": "1533964990.371906", "first_seen_epoch": "1533964902.009954", "packets_received": 75 }, { "ip": "23.35.182.113", "bytes_sent": 89640, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-6cffd9646e8c96bbd9d2de79", "packets_sent": 56, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 5463, "evidence_frames": [ 13837, 13839, 13840, 13921, 13922 ], "last_seen_epoch": "1533964990.345772", "first_seen_epoch": "1533964903.746859", "packets_received": 50 }, { "ip": "23.43.176.205", "bytes_sent": 3168, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-85b8536e95d841340a063857", "packets_sent": 7, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 866, "evidence_frames": [ 5373, 5374, 5381, 5382, 5383 ], "last_seen_epoch": "1533964620.356855", "first_seen_epoch": "1533964556.455784", "packets_received": 10 }, { "ip": "23.54.20.214", "bytes_sent": 38619, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-ca60936c8545ee9709605930", "packets_sent": 34, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 3277, "evidence_frames": [ 19314, 19315, 19362, 19363, 19364 ], "last_seen_epoch": "1533965095.511481", "first_seen_epoch": "1533964961.79301", "packets_received": 34 }, { "ip": "23.54.20.74", "bytes_sent": 149473, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-fc59c57e8836d7623db84e9f", "packets_sent": 119, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 11315, "evidence_frames": [ 32848, 32849, 32850, 32851, 32852 ], "last_seen_epoch": "1533965249.303235", "first_seen_epoch": "1533965136.095154", "packets_received": 101 }, { "ip": "23.54.21.179", "bytes_sent": 11493, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-0998e064a0f4fbea14333ddd", "packets_sent": 18, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2381, "evidence_frames": [ 23643, 23645, 23697, 23698, 23699 ], "last_seen_epoch": "1533965095.509312", "first_seen_epoch": "1533964997.827407", "packets_received": 22 }, { "ip": "23.54.21.180", "bytes_sent": 27765, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-dfd84015e2a51393e693f713", "packets_sent": 34, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 5297, "evidence_frames": [ 15829, 15830, 15847, 15848, 15849 ], "last_seen_epoch": "1533965095.516415", "first_seen_epoch": "1533964907.716214", "packets_received": 30 }, { "ip": "23.54.21.240", "bytes_sent": 85318, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-fc1b9fe20a73756caa6fef45", "packets_sent": 58, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 4734, "evidence_frames": [ 32737, 32738, 32741, 32742, 32743 ], "last_seen_epoch": "1533965205.148642", "first_seen_epoch": "1533965135.44051", "packets_received": 53 }, { "ip": "23.54.22.209", "bytes_sent": 35009, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-eb618537c441de5c81696058", "packets_sent": 30, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2915, "evidence_frames": [ 11293, 11294, 11382, 11384, 11393 ], "last_seen_epoch": "1533964990.382691", "first_seen_epoch": "1533964901.155561", "packets_received": 32 }, { "ip": "23.54.22.27", "bytes_sent": 11344, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-8eba8ea5db9b4a10be46ac16", "packets_sent": 20, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2850, "evidence_frames": [ 27330, 27331, 27372, 27373, 27374 ], "last_seen_epoch": "1533965205.178675", "first_seen_epoch": "1533965035.427984", "packets_received": 22 }, { "ip": "23.54.23.55", "bytes_sent": 192320, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-82a5e3185d418e8d7145dce3", "packets_sent": 192, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 55016, "evidence_frames": [ 11932, 11935, 11955, 11956, 11958 ], "last_seen_epoch": "1533965249.307853", "first_seen_epoch": "1533964901.699525", "packets_received": 181 }, { "ip": "23.55.114.34", "bytes_sent": 8980, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-b84cfd978981cf721d55fbdd", "packets_sent": 18, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2344, "evidence_frames": [ 24045, 24046, 24075, 24078, 24079 ], "last_seen_epoch": "1533965095.509897", "first_seen_epoch": "1533964999.51303", "packets_received": 20 }, { "ip": "23.55.50.209", "bytes_sent": 25644, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-2f9883c04372f383e800ecde", "packets_sent": 49, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 6576, "evidence_frames": [ 3337, 3341, 3462, 3470, 3475 ], "last_seen_epoch": "1533964990.438057", "first_seen_epoch": "1533964552.717515", "packets_received": 53 }, { "ip": "23.73.225.194", "bytes_sent": 14509, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-93db7c536b04ea7b6eaaec9e", "packets_sent": 21, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2392, "evidence_frames": [ 9755, 9756, 9857, 9858, 9859 ], "last_seen_epoch": "1533964990.396795", "first_seen_epoch": "1533964899.625925", "packets_received": 24 }, { "ip": "23.73.231.65", "bytes_sent": 12759, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-808897e2d012d9d7e4c5e355", "packets_sent": 39, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 6249, "evidence_frames": [ 26418, 26419, 26457, 26458, 26465 ], "last_seen_epoch": "1533965205.069167", "first_seen_epoch": "1533965032.678846", "packets_received": 43 }, { "ip": "23.73.239.75", "bytes_sent": 557915, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-e1df46af0c22b2303e7c9e01", "packets_sent": 319, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 37200, "evidence_frames": [ 10641, 10642, 10685, 10686, 10687 ], "last_seen_epoch": "1533965095.519659", "first_seen_epoch": "1533964900.661935", "packets_received": 303 }, { "ip": "23.8.170.84", "bytes_sent": 16843, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-06985b593fd13088ece61f11", "packets_sent": 38, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 4842, "evidence_frames": [ 14659, 14660, 14768, 14771, 14772 ], "last_seen_epoch": "1533965205.167953", "first_seen_epoch": "1533964904.684961", "packets_received": 43 }, { "ip": "255.255.255.255", "bytes_sent": 0, "ip_version": 4, "is_private": true, "endpoint_id": "endpoint-be1f2b1956abeaa3bcbf415a", "packets_sent": 0, "mac_addresses": [ "ff:ff:ff:ff:ff:ff" ], "bytes_received": 1743, "evidence_frames": [ 1, 288, 6562, 7257, 40091 ], "last_seen_epoch": "1533965768.477452", "first_seen_epoch": "1533964508.767375", "packets_received": 5 }, { "ip": "34.194.201.62", "bytes_sent": 11695, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-d93186f96db2bf1220c4aaf3", "packets_sent": 18, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2849, "evidence_frames": [ 14392, 14393, 14449, 14450, 14453 ], "last_seen_epoch": "1533964990.407587", "first_seen_epoch": "1533964904.34527", "packets_received": 20 }, { "ip": "34.198.191.149", "bytes_sent": 11631, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-9c873ad592707ea6deee2705", "packets_sent": 19, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2409, "evidence_frames": [ 27566, 27567, 27703, 27704, 27712 ], "last_seen_epoch": "1533965205.06126", "first_seen_epoch": "1533965035.727015", "packets_received": 23 }, { "ip": "34.207.5.71", "bytes_sent": 16859, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-5c6fa580793daf6bb3b10c3f", "packets_sent": 27, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 5136, "evidence_frames": [ 18569, 18570, 18691, 18692, 18693 ], "last_seen_epoch": "1533964990.240993", "first_seen_epoch": "1533964959.366109", "packets_received": 26 }, { "ip": "34.211.69.152", "bytes_sent": 13394, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-664f866421d6683f11269e8f", "packets_sent": 32, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 5028, "evidence_frames": [ 14648, 14649, 14754, 14755, 14756 ], "last_seen_epoch": "1533965095.250267", "first_seen_epoch": "1533964904.668086", "packets_received": 41 }, { "ip": "34.213.12.32", "bytes_sent": 25784, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-2275741febf53a41cd2e58ee", "packets_sent": 164, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 42991, "evidence_frames": [ 19232, 19233, 19234, 19235, 19236 ], "last_seen_epoch": "1533965747.941057", "first_seen_epoch": "1533964961.388359", "packets_received": 169 }, { "ip": "34.234.149.11", "bytes_sent": 12043, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-70c035693fdce8274208ff80", "packets_sent": 23, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2689, "evidence_frames": [ 30669, 30673, 31059, 31060, 31062 ], "last_seen_epoch": "1533965205.060492", "first_seen_epoch": "1533965099.047942", "packets_received": 27 }, { "ip": "34.236.123.105", "bytes_sent": 12871, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-3356dc041387778f61255195", "packets_sent": 23, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2461, "evidence_frames": [ 27325, 27326, 27380, 27381, 27384 ], "last_seen_epoch": "1533965205.066808", "first_seen_epoch": "1533965035.407165", "packets_received": 23 }, { "ip": "34.236.230.194", "bytes_sent": 12563, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-f4c2d66d5d56c3c245ac6179", "packets_sent": 20, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2423, "evidence_frames": [ 26732, 26733, 26762, 26764, 26766 ], "last_seen_epoch": "1533965095.215086", "first_seen_epoch": "1533965033.483449", "packets_received": 23 }, { "ip": "34.237.234.13", "bytes_sent": 16691, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-6c29619fdd9834a84dcf6177", "packets_sent": 55, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 9843, "evidence_frames": [ 19620, 19622, 19627, 19628, 19629 ], "last_seen_epoch": "1533965205.071348", "first_seen_epoch": "1533964962.606175", "packets_received": 63 }, { "ip": "34.246.244.104", "bytes_sent": 25008, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-d0966234460db7d46b9fc56e", "packets_sent": 45, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 6242, "evidence_frames": [ 5861, 5862, 5990, 5991, 5992 ], "last_seen_epoch": "1533964990.269262", "first_seen_epoch": "1533964559.446933", "packets_received": 52 }, { "ip": "35.164.209.30", "bytes_sent": 12418, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-6af0750b4f310c03eb581ad0", "packets_sent": 20, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2617, "evidence_frames": [ 13568, 13597, 13669, 13670, 13671 ], "last_seen_epoch": "1533964990.271637", "first_seen_epoch": "1533964903.56336", "packets_received": 23 }, { "ip": "35.164.52.21", "bytes_sent": 43651, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-dac38ec3e17e54dd78f67bef", "packets_sent": 54, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 18447, "evidence_frames": [ 17898, 17899, 17960, 17961, 17963 ], "last_seen_epoch": "1533965249.305775", "first_seen_epoch": "1533964957.475692", "packets_received": 57 }, { "ip": "35.171.141.177", "bytes_sent": 16039, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-e46bcfa4ae085f162354c42a", "packets_sent": 27, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2927, "evidence_frames": [ 17350, 17351, 17381, 17382, 17384 ], "last_seen_epoch": "1533965095.241693", "first_seen_epoch": "1533964956.316181", "packets_received": 30 }, { "ip": "35.185.244.37", "bytes_sent": 19215, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-64830bb57f7f8c7348a3955a", "packets_sent": 46, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 8147, "evidence_frames": [ 8980, 8981, 9055, 9056, 9058 ], "last_seen_epoch": "1533965095.255567", "first_seen_epoch": "1533964898.947613", "packets_received": 53 }, { "ip": "35.186.202.217", "bytes_sent": 11563, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-1eec5c514145224ad2b41ca5", "packets_sent": 16, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2135, "evidence_frames": [ 27537, 27538, 27614, 27617, 27619 ], "last_seen_epoch": "1533965205.179179", "first_seen_epoch": "1533965035.694361", "packets_received": 19 }, { "ip": "35.186.208.100", "bytes_sent": 13284, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-c53c97afc8237afb553e148e", "packets_sent": 22, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 3138, "evidence_frames": [ 10022, 10023, 10218, 10221, 10224 ], "last_seen_epoch": "1533964990.396047", "first_seen_epoch": "1533964899.857844", "packets_received": 24 }, { "ip": "35.186.239.238", "bytes_sent": 12213, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-46990f600e2992257ea54c1c", "packets_sent": 13, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 1991, "evidence_frames": [ 33924, 33925, 34012, 34015, 34023 ], "last_seen_epoch": "1533965249.307326", "first_seen_epoch": "1533965157.847056", "packets_received": 17 }, { "ip": "35.190.74.53", "bytes_sent": 11156, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-6ad013a8b66416117ce39048", "packets_sent": 22, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2736, "evidence_frames": [ 26730, 26731, 26752, 26753, 26754 ], "last_seen_epoch": "1533965095.503116", "first_seen_epoch": "1533965033.483011", "packets_received": 22 }, { "ip": "35.190.91.160", "bytes_sent": 9465, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-414192812853c62efdc8ce6d", "packets_sent": 20, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2633, "evidence_frames": [ 20729, 20730, 20970, 20971, 20973 ], "last_seen_epoch": "1533965095.512158", "first_seen_epoch": "1533964966.309425", "packets_received": 22 }, { "ip": "35.201.123.46", "bytes_sent": 8107, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-79d1a5246ab5215a37b19968", "packets_sent": 16, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2135, "evidence_frames": [ 35526, 35529, 35581, 35582, 35583 ], "last_seen_epoch": "1533965249.308671", "first_seen_epoch": "1533965160.355835", "packets_received": 18 }, { "ip": "35.227.197.177", "bytes_sent": 18777, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-fa86f7bfdbb7600031853767", "packets_sent": 42, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 6316, "evidence_frames": [ 20035, 20036, 20037, 20038, 20039 ], "last_seen_epoch": "1533965205.168172", "first_seen_epoch": "1533964964.155119", "packets_received": 45 }, { "ip": "37.157.2.234", "bytes_sent": 9963, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-2edb4750a8e8beec4e5f3c59", "packets_sent": 19, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2457, "evidence_frames": [ 23650, 23652, 23824, 23826, 23829 ], "last_seen_epoch": "1533965095.221647", "first_seen_epoch": "1533964997.832397", "packets_received": 23 }, { "ip": "38.106.10.132", "bytes_sent": 12699, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-d3a406a66c9d7b08bc0cc3a6", "packets_sent": 20, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2417, "evidence_frames": [ 27599, 27601, 27666, 27667, 27669 ], "last_seen_epoch": "1533965205.060748", "first_seen_epoch": "1533965035.759295", "packets_received": 23 }, { "ip": "38.106.34.105", "bytes_sent": 7947, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-e9b859480110c7bd95ef9296", "packets_sent": 17, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2289, "evidence_frames": [ 27361, 27362, 27398, 27399, 27401 ], "last_seen_epoch": "1533965205.067048", "first_seen_epoch": "1533965035.498711", "packets_received": 20 }, { "ip": "4.78.226.232", "bytes_sent": 12775, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-1dff0ff12ac64472c4833158", "packets_sent": 19, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2261, "evidence_frames": [ 14618, 14619, 14735, 14739, 14741 ], "last_seen_epoch": "1533964990.382502", "first_seen_epoch": "1533964904.638951", "packets_received": 21 }, { "ip": "4.78.226.233", "bytes_sent": 13504, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-097c8aed723ee14a55477d47", "packets_sent": 24, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 3044, "evidence_frames": [ 23036, 23037, 23078, 23079, 23080 ], "last_seen_epoch": "1533965095.516211", "first_seen_epoch": "1533964996.4758", "packets_received": 25 }, { "ip": "4.78.226.234", "bytes_sent": 12877, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-ed8c2fc6a63dcde470c2d055", "packets_sent": 20, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2341, "evidence_frames": [ 23302, 23303, 23390, 23391, 23392 ], "last_seen_epoch": "1533965095.514865", "first_seen_epoch": "1533964997.294806", "packets_received": 21 }, { "ip": "46.161.36.8", "bytes_sent": 9819, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-25add2a3ef48f547fcce2b2e", "packets_sent": 21, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2681, "evidence_frames": [ 11796, 11799, 11986, 11987, 12000 ], "last_seen_epoch": "1533964990.283236", "first_seen_epoch": "1533964901.575975", "packets_received": 24 }, { "ip": "5.39.44.195", "bytes_sent": 9436, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-b13fea384f45937b743db688", "packets_sent": 20, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2948, "evidence_frames": [ 27588, 27590, 27793, 27794, 27795 ], "last_seen_epoch": "1533965095.208127", "first_seen_epoch": "1533965035.750093", "packets_received": 24 }, { "ip": "50.16.201.198", "bytes_sent": 18296, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-afaee696fd4201729a5ab3a0", "packets_sent": 64, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 10742, "evidence_frames": [ 6155, 6156, 6208, 6209, 6210 ], "last_seen_epoch": "1533964990.542224", "first_seen_epoch": "1533964559.91108", "packets_received": 67 }, { "ip": "52.11.229.48", "bytes_sent": 15446, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-251f56217c408f01de382fd8", "packets_sent": 37, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 5534, "evidence_frames": [ 26737, 26738, 26775, 26776, 26777 ], "last_seen_epoch": "1533965205.067808", "first_seen_epoch": "1533965033.497082", "packets_received": 44 }, { "ip": "52.20.63.23", "bytes_sent": 8615, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-3807a648e96db881ea0b9474", "packets_sent": 20, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2645, "evidence_frames": [ 23629, 23630, 23712, 23714, 23717 ], "last_seen_epoch": "1533965095.222956", "first_seen_epoch": "1533964997.80587", "packets_received": 24 }, { "ip": "52.201.177.113", "bytes_sent": 12275, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-acb0da1cf7f5f0376e2ccd5b", "packets_sent": 20, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2491, "evidence_frames": [ 31707, 31708, 31842, 31843, 31844 ], "last_seen_epoch": "1533965205.05519", "first_seen_epoch": "1533965100.819514", "packets_received": 23 }, { "ip": "52.203.231.138", "bytes_sent": 12547, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-8e55256f74f24f2c07a05ced", "packets_sent": 21, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2549, "evidence_frames": [ 27022, 27023, 27055, 27056, 27059 ], "last_seen_epoch": "1533965095.211455", "first_seen_epoch": "1533965034.136295", "packets_received": 22 }, { "ip": "52.206.38.25", "bytes_sent": 11769, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-6ab3ebad919e5022c7a2278d", "packets_sent": 51, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 7029, "evidence_frames": [ 23298, 23299, 23415, 23416, 23418 ], "last_seen_epoch": "1533965205.070209", "first_seen_epoch": "1533964997.292463", "packets_received": 62 }, { "ip": "52.21.201.75", "bytes_sent": 12660, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-54c436de04f84ca18dba6f03", "packets_sent": 22, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 3168, "evidence_frames": [ 23690, 23691, 23784, 23792, 23798 ], "last_seen_epoch": "1533965095.222286", "first_seen_epoch": "1533964997.891654", "packets_received": 26 }, { "ip": "52.211.165.177", "bytes_sent": 11507, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-e752a8da7ff67f7d5d8c660b", "packets_sent": 17, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2423, "evidence_frames": [ 35549, 35551, 35698, 35699, 35704 ], "last_seen_epoch": "1533965205.038622", "first_seen_epoch": "1533965160.37197", "packets_received": 21 }, { "ip": "52.22.112.153", "bytes_sent": 13296, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-83b99e7c50b9c1c18042e962", "packets_sent": 24, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 3160, "evidence_frames": [ 27333, 27334, 27429, 27431, 27434 ], "last_seen_epoch": "1533965205.066188", "first_seen_epoch": "1533965035.435396", "packets_received": 27 }, { "ip": "52.24.61.237", "bytes_sent": 13970, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-9e57ee697064ad738604a60d", "packets_sent": 31, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 4236, "evidence_frames": [ 32702, 32703, 32706, 32707, 32708 ], "last_seen_epoch": "1533965249.308145", "first_seen_epoch": "1533965134.867429", "packets_received": 36 }, { "ip": "52.26.87.58", "bytes_sent": 14943, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-d75ebb487be9198a5efa11fb", "packets_sent": 40, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 6397, "evidence_frames": [ 18203, 18204, 18258, 18259, 18260 ], "last_seen_epoch": "1533965249.302863", "first_seen_epoch": "1533964958.478682", "packets_received": 48 }, { "ip": "52.27.237.90", "bytes_sent": 12357, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-68aee5ec8e04825afefbecdb", "packets_sent": 21, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2567, "evidence_frames": [ 17694, 17695, 17776, 17777, 17779 ], "last_seen_epoch": "1533964990.244265", "first_seen_epoch": "1533964957.012056", "packets_received": 24 }, { "ip": "52.33.44.132", "bytes_sent": 9640, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-6b156306f7aa19243e082e3e", "packets_sent": 32, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 4808, "evidence_frames": [ 32990, 32995, 33018, 33020, 33021 ], "last_seen_epoch": "1533965249.30347", "first_seen_epoch": "1533965136.795294", "packets_received": 36 }, { "ip": "52.39.151.69", "bytes_sent": 13268, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-ce45afd4461b0e6cab6a29aa", "packets_sent": 24, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 3392, "evidence_frames": [ 23039, 23040, 23060, 23061, 23062 ], "last_seen_epoch": "1533965205.070439", "first_seen_epoch": "1533964996.476257", "packets_received": 28 }, { "ip": "52.4.175.160", "bytes_sent": 13061, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-0bd068bf5e10679be7d9c323", "packets_sent": 23, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 3361, "evidence_frames": [ 33989, 33993, 34258, 34259, 34262 ], "last_seen_epoch": "1533965249.307972", "first_seen_epoch": "1533965157.915985", "packets_received": 26 }, { "ip": "52.42.116.214", "bytes_sent": 25704, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-245c484ba6304d2dbcfae438", "packets_sent": 46, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 6196, "evidence_frames": [ 26413, 26415, 26455, 26456, 26463 ], "last_seen_epoch": "1533965205.068875", "first_seen_epoch": "1533965032.677679", "packets_received": 54 }, { "ip": "52.44.165.199", "bytes_sent": 78946, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-be51eaa286fb197ce6175b67", "packets_sent": 140, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 33106, "evidence_frames": [ 17856, 17857, 17944, 17945, 17946 ], "last_seen_epoch": "1533965249.305908", "first_seen_epoch": "1533964957.359399", "packets_received": 143 }, { "ip": "52.44.44.54", "bytes_sent": 26654, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-0e90352034edd70156d17b64", "packets_sent": 63, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 15438, "evidence_frames": [ 16035, 16036, 16136, 16147, 16152 ], "last_seen_epoch": "1533965205.057152", "first_seen_epoch": "1533964908.4092", "packets_received": 68 }, { "ip": "52.52.136.196", "bytes_sent": 12397, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-ac9f035626d6588927c80163", "packets_sent": 22, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 3051, "evidence_frames": [ 24229, 24230, 24241, 24242, 24243 ], "last_seen_epoch": "1533965095.218477", "first_seen_epoch": "1533965001.683247", "packets_received": 25 }, { "ip": "52.58.174.155", "bytes_sent": 12429, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-1b366dd6615e17a21d56af56", "packets_sent": 20, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2571, "evidence_frames": [ 27343, 27350, 27498, 27500, 27504 ], "last_seen_epoch": "1533965205.062958", "first_seen_epoch": "1533965035.447468", "packets_received": 25 }, { "ip": "52.74.108.147", "bytes_sent": 11915, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-52793dd03a3bf9c1a2e5b61b", "packets_sent": 17, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2249, "evidence_frames": [ 23150, 23151, 23241, 23242, 23243 ], "last_seen_epoch": "1533965095.522622", "first_seen_epoch": "1533964996.948924", "packets_received": 19 }, { "ip": "52.8.202.139", "bytes_sent": 32241, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-4e04f5a0e5cb100f528fc286", "packets_sent": 53, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 10669, "evidence_frames": [ 20072, 20073, 20078, 20079, 20080 ], "last_seen_epoch": "1533965249.302372", "first_seen_epoch": "1533964964.452241", "packets_received": 58 }, { "ip": "52.8.226.99", "bytes_sent": 12956, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-8f69a9787cce333287bd3feb", "packets_sent": 26, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 3210, "evidence_frames": [ 30692, 30693, 31018, 31019, 31023 ], "last_seen_epoch": "1533965205.059852", "first_seen_epoch": "1533965099.094739", "packets_received": 28 }, { "ip": "52.89.90.109", "bytes_sent": 12557, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-7c9b04537e27cba33f4c1fc3", "packets_sent": 27, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 3957, "evidence_frames": [ 8959, 8960, 9037, 9038, 9039 ], "last_seen_epoch": "1533964990.297512", "first_seen_epoch": "1533964898.931066", "packets_received": 31 }, { "ip": "52.9.59.235", "bytes_sent": 12627, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-ddf0c7228766c11fd02fb907", "packets_sent": 20, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2311, "evidence_frames": [ 30814, 30815, 31170, 31174, 31175 ], "last_seen_epoch": "1533965205.168219", "first_seen_epoch": "1533965099.291353", "packets_received": 21 }, { "ip": "52.9.78.114", "bytes_sent": 28896, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-7325430a102d3f45aa27e3aa", "packets_sent": 76, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 9786, "evidence_frames": [ 14642, 14644, 14733, 14736, 14737 ], "last_seen_epoch": "1533965855.332717", "first_seen_epoch": "1533964904.666565", "packets_received": 89 }, { "ip": "52.94.232.32", "bytes_sent": 17335, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-684466ce47129cafaf9612ff", "packets_sent": 44, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 7172, "evidence_frames": [ 8962, 8963, 9081, 9083, 9084 ], "last_seen_epoch": "1533965095.254852", "first_seen_epoch": "1533964898.931932", "packets_received": 51 }, { "ip": "54.148.146.218", "bytes_sent": 8311, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-2192a6ef2a98089499761d68", "packets_sent": 18, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2377, "evidence_frames": [ 27529, 27539, 27630, 27632, 27635 ], "last_seen_epoch": "1533965205.062083", "first_seen_epoch": "1533965035.692125", "packets_received": 22 }, { "ip": "54.175.110.202", "bytes_sent": 12317, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-c79f9108e171ba30dde7b1cd", "packets_sent": 20, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2751, "evidence_frames": [ 11250, 11251, 11405, 11406, 11407 ], "last_seen_epoch": "1533964990.285367", "first_seen_epoch": "1533964901.127329", "packets_received": 24 }, { "ip": "54.176.157.57", "bytes_sent": 48776, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-790dc03efdfe3e21cc125515", "packets_sent": 68, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 16798, "evidence_frames": [ 12106, 12107, 12190, 12191, 12192 ], "last_seen_epoch": "1533964990.279388", "first_seen_epoch": "1533964901.907311", "packets_received": 68 }, { "ip": "54.183.210.45", "bytes_sent": 43932, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-1d5beb2cf86220ced3cd4c78", "packets_sent": 75, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 29986, "evidence_frames": [ 19067, 19068, 19089, 19091, 19094 ], "last_seen_epoch": "1533965249.306262", "first_seen_epoch": "1533964960.516781", "packets_received": 76 }, { "ip": "54.183.248.197", "bytes_sent": 8081, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-c5a59ae6379805e0f1bb38c6", "packets_sent": 21, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2737, "evidence_frames": [ 20233, 20235, 20283, 20284, 20285 ], "last_seen_epoch": "1533965095.231728", "first_seen_epoch": "1533964965.013486", "packets_received": 24 }, { "ip": "54.183.95.126", "bytes_sent": 21014, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-68aada05f1cc37bd8b42ee23", "packets_sent": 57, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 14004, "evidence_frames": [ 8977, 8978, 9004, 9005, 9013 ], "last_seen_epoch": "1533965249.302371", "first_seen_epoch": "1533964898.939323", "packets_received": 65 }, { "ip": "54.186.116.83", "bytes_sent": 39825, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-5673418549a9a15bdeb9540a", "packets_sent": 81, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 19749, "evidence_frames": [ 5144, 5146, 5240, 5242, 5243 ], "last_seen_epoch": "1533965249.30295", "first_seen_epoch": "1533964556.026569", "packets_received": 90 }, { "ip": "54.186.237.130", "bytes_sent": 14206, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-849e1c3fe5cc2fb1e2c06f66", "packets_sent": 35, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 4828, "evidence_frames": [ 14622, 14623, 14718, 14720, 14722 ], "last_seen_epoch": "1533965095.249528", "first_seen_epoch": "1533964904.640362", "packets_received": 43 }, { "ip": "54.187.167.76", "bytes_sent": 8892, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-2cbb8dd9c6f99bf27707120d", "packets_sent": 20, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2621, "evidence_frames": [ 27930, 27931, 27942, 27943, 27945 ], "last_seen_epoch": "1533965095.207013", "first_seen_epoch": "1533965036.25643", "packets_received": 24 }, { "ip": "54.191.20.146", "bytes_sent": 12199, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-5d8056d0e6811c9b32ed1b7b", "packets_sent": 23, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2745, "evidence_frames": [ 20237, 20238, 20292, 20298, 20302 ], "last_seen_epoch": "1533965095.232364", "first_seen_epoch": "1533964965.014079", "packets_received": 25 }, { "ip": "54.191.223.36", "bytes_sent": 8103, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-0c0ab6dceba1c698432f6667", "packets_sent": 18, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2633, "evidence_frames": [ 24038, 24039, 24061, 24062, 24066 ], "last_seen_epoch": "1533965095.220538", "first_seen_epoch": "1533964999.45839", "packets_received": 22 }, { "ip": "54.191.4.242", "bytes_sent": 13909, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-cf69f71f4852edb801e7911d", "packets_sent": 24, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 3857, "evidence_frames": [ 14620, 14621, 14717, 14719, 14721 ], "last_seen_epoch": "1533964990.267237", "first_seen_epoch": "1533964904.639532", "packets_received": 28 }, { "ip": "54.193.113.6", "bytes_sent": 14075, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-83d45decebf3e54ddde870f1", "packets_sent": 19, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2327, "evidence_frames": [ 27345, 27347, 27382, 27383, 27386 ], "last_seen_epoch": "1533965205.063513", "first_seen_epoch": "1533965035.448363", "packets_received": 21 }, { "ip": "54.196.242.147", "bytes_sent": 5479, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-79cd646c8a4e8bac7198a41f", "packets_sent": 19, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2832, "evidence_frames": [ 23636, 23637, 23748, 23752, 23754 ], "last_seen_epoch": "1533965009.484657", "first_seen_epoch": "1533964997.81269", "packets_received": 17 }, { "ip": "54.209.46.223", "bytes_sent": 11952, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-8e791e98283399480401da3d", "packets_sent": 24, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 4374, "evidence_frames": [ 19703, 19704, 19797, 19798, 19802 ], "last_seen_epoch": "1533965095.233898", "first_seen_epoch": "1533964962.89698", "packets_received": 28 }, { "ip": "54.209.71.223", "bytes_sent": 11897, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-4dd0f80f75ede490175b558d", "packets_sent": 19, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2567, "evidence_frames": [ 10607, 10608, 10672, 10676, 10679 ], "last_seen_epoch": "1533964990.287963", "first_seen_epoch": "1533964900.584861", "packets_received": 23 }, { "ip": "54.214.11.239", "bytes_sent": 12528, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-1718bac52c0f8aeb25e3ff2c", "packets_sent": 25, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 3684, "evidence_frames": [ 15560, 15564, 15594, 15595, 15596 ], "last_seen_epoch": "1533964990.257396", "first_seen_epoch": "1533964906.748157", "packets_received": 29 }, { "ip": "54.217.217.143", "bytes_sent": 13361, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-5c1a0f7e610f91d9ad2f8151", "packets_sent": 22, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 3685, "evidence_frames": [ 31691, 31692, 31855, 31856, 31860 ], "last_seen_epoch": "1533965205.052304", "first_seen_epoch": "1533965100.799756", "packets_received": 27 }, { "ip": "54.236.177.89", "bytes_sent": 13415, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-9a2505ffebc0db812f2c929c", "packets_sent": 21, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2427, "evidence_frames": [ 26734, 26735, 26781, 26782, 26785 ], "last_seen_epoch": "1533965095.214209", "first_seen_epoch": "1533965033.483919", "packets_received": 23 }, { "ip": "54.241.31.242", "bytes_sent": 11524, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-db49be5851ea9cf4def0d918", "packets_sent": 21, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 3038, "evidence_frames": [ 27327, 27328, 27359, 27360, 27364 ], "last_seen_epoch": "1533965205.063976", "first_seen_epoch": "1533965035.407827", "packets_received": 24 }, { "ip": "54.246.133.167", "bytes_sent": 9440, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-099ef61b3e7ce090f2643b99", "packets_sent": 24, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 3418, "evidence_frames": [ 16525, 16526, 16530, 16531, 16532 ], "last_seen_epoch": "1533964990.249861", "first_seen_epoch": "1533964909.720227", "packets_received": 27 }, { "ip": "54.69.70.7", "bytes_sent": 22284, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-05bee004a461565e838f67b8", "packets_sent": 43, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 5350, "evidence_frames": [ 23600, 23603, 23666, 23667, 23670 ], "last_seen_epoch": "1533965205.06962", "first_seen_epoch": "1533964997.758667", "packets_received": 50 }, { "ip": "54.84.105.44", "bytes_sent": 13754, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-6dc5eda60efa578b432dd6bd", "packets_sent": 22, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 3606, "evidence_frames": [ 24041, 24042, 24097, 24100, 24101 ], "last_seen_epoch": "1533965095.219738", "first_seen_epoch": "1533964999.468186", "packets_received": 26 }, { "ip": "54.92.93.205", "bytes_sent": 8370, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-16be6e54131f7e0731658d9c", "packets_sent": 16, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2123, "evidence_frames": [ 35518, 35519, 35637, 35638, 35639 ], "last_seen_epoch": "1533965249.308576", "first_seen_epoch": "1533965160.353894", "packets_received": 18 }, { "ip": "63.251.109.87", "bytes_sent": 110320, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-95d73cf01d05b851c557bffa", "packets_sent": 232, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 33416, "evidence_frames": [ 32963, 32964, 32978, 32979, 32980 ], "last_seen_epoch": "1533965249.301878", "first_seen_epoch": "1533965136.68011", "packets_received": 244 }, { "ip": "63.251.252.12", "bytes_sent": 14148, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-24384ba500b530b0447205e6", "packets_sent": 25, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 3702, "evidence_frames": [ 20241, 20242, 20287, 20289, 20293 ], "last_seen_epoch": "1533964990.235861", "first_seen_epoch": "1533964965.014931", "packets_received": 26 }, { "ip": "63.251.253.231", "bytes_sent": 8909, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-133c25985b1547ee691fba37", "packets_sent": 18, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2397, "evidence_frames": [ 31840, 31841, 31956, 31957, 31958 ], "last_seen_epoch": "1533965205.052799", "first_seen_epoch": "1533965100.981016", "packets_received": 23 }, { "ip": "64.125.223.109", "bytes_sent": 10100, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-f73c17e398375dde2a4de14a", "packets_sent": 18, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2321, "evidence_frames": [ 32220, 32221, 32222, 32223, 32224 ], "last_seen_epoch": "1533965205.046088", "first_seen_epoch": "1533965102.185284", "packets_received": 19 }, { "ip": "64.233.184.94", "bytes_sent": 40286, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-5aa461822092d48d47dd7f07", "packets_sent": 147, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 53311, "evidence_frames": [ 14629, 14630, 14861, 14862, 14865 ], "last_seen_epoch": "1533965249.303825", "first_seen_epoch": "1533964904.642425", "packets_received": 146 }, { "ip": "64.38.119.27", "bytes_sent": 13129, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-3fd14c67fc5478a7744ccd61", "packets_sent": 17, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2597, "evidence_frames": [ 30667, 30668, 30974, 30977, 30978 ], "last_seen_epoch": "1533965205.178762", "first_seen_epoch": "1533965099.047537", "packets_received": 19 }, { "ip": "64.41.197.55", "bytes_sent": 53618, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-62064cb464353fb67d9d82c8", "packets_sent": 275, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 51674, "evidence_frames": [ 12802, 12803, 12879, 12880, 12883 ], "last_seen_epoch": "1533964955.188066", "first_seen_epoch": "1533964902.766735", "packets_received": 302 }, { "ip": "64.7.205.2", "bytes_sent": 4567, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-7abbc5259221de5b7d36b95c", "packets_sent": 12, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2026, "evidence_frames": [ 13550, 13609, 13610, 13611, 13612 ], "last_seen_epoch": "1533964990.272187", "first_seen_epoch": "1533964903.539719", "packets_received": 13 }, { "ip": "67.195.229.45", "bytes_sent": 20148, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-f800d8db6881582ebf8cbb84", "packets_sent": 40, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 4874, "evidence_frames": [ 6274, 6275, 6295, 6296, 6297 ], "last_seen_epoch": "1533964990.344632", "first_seen_epoch": "1533964560.30575", "packets_received": 44 }, { "ip": "69.168.106.81", "bytes_sent": 11497, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-5f5629ff3d8c7787af7334f8", "packets_sent": 19, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2515, "evidence_frames": [ 20563, 20564, 20738, 20739, 20741 ], "last_seen_epoch": "1533965095.230321", "first_seen_epoch": "1533964965.689886", "packets_received": 23 }, { "ip": "69.174.248.224", "bytes_sent": 8406, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-a4ece22f16a3b0cf3862cf38", "packets_sent": 19, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2397, "evidence_frames": [ 23327, 23328, 23398, 23399, 23402 ], "last_seen_epoch": "1533965095.225801", "first_seen_epoch": "1533964997.329929", "packets_received": 22 }, { "ip": "69.174.248.228", "bytes_sent": 32940, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-b14500baf9d016598b13688c", "packets_sent": 73, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 9656, "evidence_frames": [ 5867, 5868, 5896, 5897, 5898 ], "last_seen_epoch": "1533964990.240547", "first_seen_epoch": "1533964559.465366", "packets_received": 88 }, { "ip": "69.194.244.11", "bytes_sent": 22369, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-3866602da4cf2e3508c5432e", "packets_sent": 59, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 8933, "evidence_frames": [ 5148, 5149, 5195, 5201, 5205 ], "last_seen_epoch": "1533965095.247857", "first_seen_epoch": "1533964556.027653", "packets_received": 68 }, { "ip": "70.42.132.5", "bytes_sent": 12295, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-bc3bf19a3b7b9c83b899a264", "packets_sent": 20, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2697, "evidence_frames": [ 31705, 31706, 31817, 31818, 31819 ], "last_seen_epoch": "1533965205.054295", "first_seen_epoch": "1533965100.819138", "packets_received": 21 }, { "ip": "72.21.81.200", "bytes_sent": 32030, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-7fc2389d8fee24d44d5f2b73", "packets_sent": 46, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 5450, "evidence_frames": [ 6514, 6515, 6516, 6517, 6518 ], "last_seen_epoch": "1533965893.89847", "first_seen_epoch": "1533964574.366978", "packets_received": 49 }, { "ip": "72.21.91.113", "bytes_sent": 20138, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-8268d857ad0b5c2f6c1e3b7c", "packets_sent": 22, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2375, "evidence_frames": [ 19338, 19339, 19372, 19373, 19374 ], "last_seen_epoch": "1533965095.51265", "first_seen_epoch": "1533964961.81597", "packets_received": 22 }, { "ip": "72.5.64.63", "bytes_sent": 26668, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-5e99e1582275af8b6940d1f2", "packets_sent": 45, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 6060, "evidence_frames": [ 26822, 26823, 26864, 26865, 26870 ], "last_seen_epoch": "1533965249.307758", "first_seen_epoch": "1533965033.69587", "packets_received": 44 }, { "ip": "74.119.117.100", "bytes_sent": 990, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-5cff7cb6dde70769780f2995", "packets_sent": 6, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 726, "evidence_frames": [ 43660, 43661, 43678, 43679, 43680 ], "last_seen_epoch": "1533965797.636964", "first_seen_epoch": "1533965783.084914", "packets_received": 6 }, { "ip": "74.119.117.129", "bytes_sent": 31537, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-2c987883dfaa39b5f1274635", "packets_sent": 32, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 3788, "evidence_frames": [ 15405, 15406, 15559, 15562, 15565 ], "last_seen_epoch": "1533964990.346106", "first_seen_epoch": "1533964906.565378", "packets_received": 32 }, { "ip": "74.119.117.70", "bytes_sent": 3509, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-b912a888fdb16833614e0fe7", "packets_sent": 10, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 1941, "evidence_frames": [ 13518, 13591, 13594, 13603, 13605 ], "last_seen_epoch": "1533964918.712026", "first_seen_epoch": "1533964903.515763", "packets_received": 10 }, { "ip": "74.119.117.94", "bytes_sent": 8168, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-3bb1a6dc64f209ecb40f51d6", "packets_sent": 28, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 4268, "evidence_frames": [ 16004, 16005, 16059, 16062, 16063 ], "last_seen_epoch": "1533965012.654601", "first_seen_epoch": "1533964908.388066", "packets_received": 27 }, { "ip": "74.125.195.154", "bytes_sent": 29449, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-c4ddd1e386f06fec7e9a13e1", "packets_sent": 44, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 10318, "evidence_frames": [ 32654, 32655, 32658, 32659, 32660 ], "last_seen_epoch": "1533965249.307094", "first_seen_epoch": "1533965134.235835", "packets_received": 46 }, { "ip": "74.125.195.155", "bytes_sent": 11926, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-1216b35ed5e94e37b8db7af3", "packets_sent": 26, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 4805, "evidence_frames": [ 45076, 45077, 45275, 45281, 45283 ], "last_seen_epoch": "1533965790.59716", "first_seen_epoch": "1533965786.809416", "packets_received": 29 }, { "ip": "74.125.195.156", "bytes_sent": 9321, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-b7bafe44862725322a3b7aaa", "packets_sent": 31, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 4220, "evidence_frames": [ 4328, 4329, 4401, 4403, 4404 ], "last_seen_epoch": "1533964990.433219", "first_seen_epoch": "1533964554.233669", "packets_received": 35 }, { "ip": "74.214.196.133", "bytes_sent": 4830, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-54a5c0c10e0d82ced94f421a", "packets_sent": 12, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2046, "evidence_frames": [ 13596, 13626, 13629, 13633, 13635 ], "last_seen_epoch": "1533964990.373056", "first_seen_epoch": "1533964903.573835", "packets_received": 12 }, { "ip": "74.217.250.126", "bytes_sent": 12189, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-9d7fe915806b3cbacdb470f5", "packets_sent": 19, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2541, "evidence_frames": [ 30783, 30784, 31201, 31202, 31205 ], "last_seen_epoch": "1533965205.057669", "first_seen_epoch": "1533965099.270448", "packets_received": 23 }, { "ip": "74.6.34.27", "bytes_sent": 46544, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-2abc2949f3e9e339564e9768", "packets_sent": 90, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 12357, "evidence_frames": [ 5134, 5135, 5179, 5182, 5184 ], "last_seen_epoch": "1533965795.576993", "first_seen_epoch": "1533964555.990036", "packets_received": 105 }, { "ip": "77.88.21.38", "bytes_sent": 7270, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-e1b63c613204fd7d719aff1a", "packets_sent": 31, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 4701, "evidence_frames": [ 7090, 7091, 7092, 7093, 7094 ], "last_seen_epoch": "1533964686.038026", "first_seen_epoch": "1533964677.422353", "packets_received": 20 }, { "ip": "8.247.90.250", "bytes_sent": 36075, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-a65a72c50863f85dfc0b6e2e", "packets_sent": 27, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 3281, "evidence_frames": [ 9797, 9802, 9955, 9956, 9957 ], "last_seen_epoch": "1533964990.292654", "first_seen_epoch": "1533964899.641197", "packets_received": 31 }, { "ip": "8.39.36.143", "bytes_sent": 126372, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-08cac3750c524c02839a087d", "packets_sent": 235, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 72974, "evidence_frames": [ 16603, 16604, 16605, 16606, 16607 ], "last_seen_epoch": "1533965205.193539", "first_seen_epoch": "1533964910.202514", "packets_received": 231 }, { "ip": "8.39.36.145", "bytes_sent": 8112, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-d3a24e1016ec0c30f4fb2596", "packets_sent": 17, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2641, "evidence_frames": [ 14750, 14751, 14803, 14804, 14809 ], "last_seen_epoch": "1533964990.344528", "first_seen_epoch": "1533964904.737024", "packets_received": 18 }, { "ip": "8.39.36.172", "bytes_sent": 19173, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-d43bc0969039d14d8ab95ecf", "packets_sent": 51, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 9722, "evidence_frames": [ 16559, 16560, 16561, 16586, 16587 ], "last_seen_epoch": "1533965095.516233", "first_seen_epoch": "1533964910.093917", "packets_received": 52 }, { "ip": "8.41.222.241", "bytes_sent": 31980, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-cde6505efcb94bca3ed56607", "packets_sent": 59, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 13314, "evidence_frames": [ 18184, 18185, 18234, 18235, 18236 ], "last_seen_epoch": "1533965249.302643", "first_seen_epoch": "1533964958.435561", "packets_received": 65 }, { "ip": "85.114.159.93", "bytes_sent": 10493, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-d1d657d139d9592d3bfc4c6f", "packets_sent": 16, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2189, "evidence_frames": [ 35528, 35530, 35695, 35701, 35706 ], "last_seen_epoch": "1533965249.308731", "first_seen_epoch": "1533965160.357968", "packets_received": 19 }, { "ip": "87.240.129.133", "bytes_sent": 67649, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-1ef9c2890df39c9c0d0ab5b2", "packets_sent": 48, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 4207, "evidence_frames": [ 615, 616, 743, 744, 747 ], "last_seen_epoch": "1533965831.410148", "first_seen_epoch": "1533964545.654493", "packets_received": 51 }, { "ip": "87.250.251.37", "bytes_sent": 29679, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-ed7233d95c61846e9c845668", "packets_sent": 81, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 5547, "evidence_frames": [ 6568, 6569, 6570, 6571, 6572 ], "last_seen_epoch": "1533965572.650397", "first_seen_epoch": "1533964577.228352", "packets_received": 56 }, { "ip": "88.212.196.103", "bytes_sent": 1147, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-243d2291a6e3c0444997d059", "packets_sent": 9, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 1465, "evidence_frames": [ 43655, 43656, 43742, 43743, 43744 ], "last_seen_epoch": "1533965783.849312", "first_seen_epoch": "1533965783.077482", "packets_received": 12 }, { "ip": "88.212.196.123", "bytes_sent": 11382, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-c7455ec4073bdc41bda5f03a", "packets_sent": 34, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 5086, "evidence_frames": [ 3299, 3300, 3526, 3528, 3529 ], "last_seen_epoch": "1533964990.302766", "first_seen_epoch": "1533964552.62779", "packets_received": 36 }, { "ip": "89.223.92.202", "bytes_sent": 120, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-4c5c24f206277e3caa4d6ed5", "packets_sent": 2, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 194, "evidence_frames": [ 39599, 39662, 39664, 39669, 39670 ], "last_seen_epoch": "1533965418.156358", "first_seen_epoch": "1533965407.583245", "packets_received": 3 }, { "ip": "91.216.130.21", "bytes_sent": 226627, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-40077ab903e28693e020ec19", "packets_sent": 179, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 18445, "evidence_frames": [ 40232, 40233, 40236, 40240, 40241 ], "last_seen_epoch": "1533965866.731663", "first_seen_epoch": "1533965770.571792", "packets_received": 188 }, { "ip": "91.216.130.22", "bytes_sent": 283747, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-e98769b6c5789ca338eab363", "packets_sent": 205, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 21264, "evidence_frames": [ 40216, 40217, 40218, 40219, 40220 ], "last_seen_epoch": "1533965866.711641", "first_seen_epoch": "1533965770.562862", "packets_received": 209 }, { "ip": "93.158.134.119", "bytes_sent": 87275, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-6d0536ed8356781dac478de2", "packets_sent": 110, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 22763, "evidence_frames": [ 3311, 3312, 3542, 3544, 3547 ], "last_seen_epoch": "1533965846.80779", "first_seen_epoch": "1533964552.684399", "packets_received": 116 }, { "ip": "93.158.134.38", "bytes_sent": 7096, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-852e2b89db94be076137b26b", "packets_sent": 28, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 3073, "evidence_frames": [ 39905, 39906, 39907, 39908, 39909 ], "last_seen_epoch": "1533965614.751986", "first_seen_epoch": "1533965605.967018", "packets_received": 19 }, { "ip": "93.158.134.90", "bytes_sent": 10830, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-11b7945d11f2f82baa6d1328", "packets_sent": 20, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2359, "evidence_frames": [ 43652, 43653, 43732, 43733, 43734 ], "last_seen_epoch": "1533965844.349839", "first_seen_epoch": "1533965783.061296", "packets_received": 22 }, { "ip": "94.31.29.138", "bytes_sent": 70795, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-f0d88b4ff477a4eeb53a4560", "packets_sent": 44, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 3746, "evidence_frames": [ 17310, 17311, 17314, 17315, 17316 ], "last_seen_epoch": "1533964990.245219", "first_seen_epoch": "1533964955.901813", "packets_received": 38 }, { "ip": "94.31.29.250", "bytes_sent": 116983, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-21b116182c685b7805549221", "packets_sent": 77, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 5621, "evidence_frames": [ 18286, 18287, 18314, 18315, 18317 ], "last_seen_epoch": "1533965095.238452", "first_seen_epoch": "1533964958.606113", "packets_received": 76 }, { "ip": "95.142.20.17", "bytes_sent": 30851, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-330d3d047dfc4c210212cc0a", "packets_sent": 29, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 3493, "evidence_frames": [ 8629, 8630, 8798, 8800, 8801 ], "last_seen_epoch": "1533964990.301359", "first_seen_epoch": "1533964898.548718", "packets_received": 34 }, { "ip": "95.142.20.29", "bytes_sent": 12501, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-6ae6bca29afe4f89d204c4d2", "packets_sent": 24, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 3837, "evidence_frames": [ 10633, 10634, 10871, 10873, 10874 ], "last_seen_epoch": "1533964990.286335", "first_seen_epoch": "1533964900.644102", "packets_received": 28 }, { "ip": "98.136.101.121", "bytes_sent": 27049, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-955bb92d9065362f0797e9b8", "packets_sent": 59, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 7280, "evidence_frames": [ 6114, 6125, 6167, 6168, 6169 ], "last_seen_epoch": "1533965249.307518", "first_seen_epoch": "1533964559.84168", "packets_received": 65 } ], "identities": [ { "type": "account", "value": "mikhail.petrov", "bindings": [ { "account": "", "owner_ip": "192.168.1.95", "frame_number": 403, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "192.168.1.6", "conversation_src": "192.168.1.95" }, { "account": "", "owner_ip": "192.168.1.95", "frame_number": 411, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "192.168.1.6", "conversation_src": "192.168.1.95" }, { "account": "", "owner_ip": "192.168.1.95", "frame_number": 412, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "192.168.1.95", "conversation_src": "192.168.1.6" }, { "account": "", "owner_ip": "192.168.1.95", "frame_number": 422, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "192.168.1.95", "conversation_src": "192.168.1.6" }, { "account": "", "owner_ip": "192.168.1.95", "frame_number": 434, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "192.168.1.95", "conversation_src": "192.168.1.6" }, { "account": "", "owner_ip": "192.168.1.95", "frame_number": 466, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "192.168.1.95", "conversation_src": "192.168.1.6" }, { "account": "", "owner_ip": "192.168.1.95", "frame_number": 498, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "192.168.1.95", "conversation_src": "192.168.1.6" }, { "account": "", "owner_ip": "192.168.1.95", "frame_number": 508, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "192.168.1.95", "conversation_src": "192.168.1.6" } ], "evidence": [ { "tcp_stream": 27, "frame_number": 403, "display_filter": "frame.number == 403", "timestamp_epoch": "1533964528.919101000" }, { "tcp_stream": 28, "frame_number": 411, "display_filter": "frame.number == 411", "timestamp_epoch": "1533964528.934261000" }, { "tcp_stream": 28, "frame_number": 412, "display_filter": "frame.number == 412", "timestamp_epoch": "1533964528.934957000" }, { "tcp_stream": 29, "frame_number": 422, "display_filter": "frame.number == 422", "timestamp_epoch": "1533964528.936758000" }, { "tcp_stream": 30, "frame_number": 434, "display_filter": "frame.number == 434", "timestamp_epoch": "1533964528.983073000" }, { "tcp_stream": 32, "frame_number": 466, "display_filter": "frame.number == 466", "timestamp_epoch": "1533964529.522121000" }, { "tcp_stream": 35, "frame_number": 498, "display_filter": "frame.number == 498", "timestamp_epoch": "1533964529.549664000" }, { "tcp_stream": 36, "frame_number": 508, "display_filter": "frame.number == 508", "timestamp_epoch": "1533964529.550742000" } ], "raw_values": [ "mikhail.petrov" ], "identity_id": "identity-71d2f6ef05c3b0064bfb2dd6", "ip_addresses": [ "192.168.1.95" ], "mac_addresses": [ "f4:b5:20:68:b1:93" ] }, { "type": "account", "value": "petrov2018-pc$", "bindings": [ { "account": "", "owner_ip": "192.168.1.95", "frame_number": 38, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "192.168.1.6", "conversation_src": "192.168.1.95" }, { "account": "", "owner_ip": "192.168.1.95", "frame_number": 46, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "192.168.1.6", "conversation_src": "192.168.1.95" }, { "account": "", "owner_ip": "192.168.1.95", "frame_number": 47, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "192.168.1.95", "conversation_src": "192.168.1.6" }, { "account": "", "owner_ip": "192.168.1.95", "frame_number": 57, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "192.168.1.95", "conversation_src": "192.168.1.6" }, { "account": "", "owner_ip": "192.168.1.95", "frame_number": 67, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "192.168.1.95", "conversation_src": "192.168.1.6" }, { "account": "", "owner_ip": "192.168.1.95", "frame_number": 91, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "192.168.1.95", "conversation_src": "192.168.1.6" }, { "account": "", "owner_ip": "192.168.1.95", "frame_number": 135, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "192.168.1.6", "conversation_src": "192.168.1.95" }, { "account": "", "owner_ip": "192.168.1.95", "frame_number": 143, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "192.168.1.6", "conversation_src": "192.168.1.95" }, { "account": "", "owner_ip": "192.168.1.95", "frame_number": 144, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "192.168.1.95", "conversation_src": "192.168.1.6" }, { "account": "", "owner_ip": "192.168.1.95", "frame_number": 155, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "192.168.1.95", "conversation_src": "192.168.1.6" }, { "account": "", "owner_ip": "192.168.1.95", "frame_number": 197, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "192.168.1.95", "conversation_src": "192.168.1.6" }, { "account": "", "owner_ip": "192.168.1.95", "frame_number": 210, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "192.168.1.95", "conversation_src": "192.168.1.6" }, { "account": "", "owner_ip": "192.168.1.95", "frame_number": 245, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "192.168.1.95", "conversation_src": "192.168.1.6" }, { "account": "", "owner_ip": "192.168.1.95", "frame_number": 255, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "192.168.1.95", "conversation_src": "192.168.1.6" }, { "account": "", "owner_ip": "192.168.1.95", "frame_number": 344, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "192.168.1.6", "conversation_src": "192.168.1.95" }, { "account": "", "owner_ip": "192.168.1.95", "frame_number": 352, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "192.168.1.6", "conversation_src": "192.168.1.95" }, { "account": "", "owner_ip": "192.168.1.95", "frame_number": 353, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "192.168.1.95", "conversation_src": "192.168.1.6" }, { "account": "", "owner_ip": "192.168.1.95", "frame_number": 363, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "192.168.1.95", "conversation_src": "192.168.1.6" }, { "account": "", "owner_ip": "192.168.1.95", "frame_number": 39570, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "192.168.1.95", "conversation_src": "192.168.1.6" } ], "evidence": [ { "tcp_stream": 1, "frame_number": 38, "display_filter": "frame.number == 38", "timestamp_epoch": "1533964509.200672000" }, { "tcp_stream": 2, "frame_number": 46, "display_filter": "frame.number == 46", "timestamp_epoch": "1533964509.218414000" }, { "tcp_stream": 2, "frame_number": 47, "display_filter": "frame.number == 47", "timestamp_epoch": "1533964509.219117000" }, { "tcp_stream": 3, "frame_number": 57, "display_filter": "frame.number == 57", "timestamp_epoch": "1533964509.222037000" }, { "tcp_stream": 4, "frame_number": 67, "display_filter": "frame.number == 67", "timestamp_epoch": "1533964509.223327000" }, { "tcp_stream": 6, "frame_number": 91, "display_filter": "frame.number == 91", "timestamp_epoch": "1533964509.291837000" }, { "tcp_stream": 10, "frame_number": 135, "display_filter": "frame.number == 135", "timestamp_epoch": "1533964509.597072000" }, { "tcp_stream": 11, "frame_number": 143, "display_filter": "frame.number == 143", "timestamp_epoch": "1533964509.615867000" }, { "tcp_stream": 11, "frame_number": 144, "display_filter": "frame.number == 144", "timestamp_epoch": "1533964509.616682000" }, { "tcp_stream": 12, "frame_number": 155, "display_filter": "frame.number == 155", "timestamp_epoch": "1533964509.618759000" }, { "tcp_stream": 14, "frame_number": 197, "display_filter": "frame.number == 197", "timestamp_epoch": "1533964510.602342000" }, { "tcp_stream": 15, "frame_number": 210, "display_filter": "frame.number == 210", "timestamp_epoch": "1533964510.607697000" }, { "tcp_stream": 19, "frame_number": 245, "display_filter": "frame.number == 245", "timestamp_epoch": "1533964510.616786000" }, { "tcp_stream": 20, "frame_number": 255, "display_filter": "frame.number == 255", "timestamp_epoch": "1533964510.617934000" }, { "tcp_stream": 23, "frame_number": 344, "display_filter": "frame.number == 344", "timestamp_epoch": "1533964517.023963000" }, { "tcp_stream": 24, "frame_number": 352, "display_filter": "frame.number == 352", "timestamp_epoch": "1533964517.040030000" }, { "tcp_stream": 24, "frame_number": 353, "display_filter": "frame.number == 353", "timestamp_epoch": "1533964517.040651000" }, { "tcp_stream": 25, "frame_number": 363, "display_filter": "frame.number == 363", "timestamp_epoch": "1533964517.042917000" }, { "tcp_stream": 1038, "frame_number": 39570, "display_filter": "frame.number == 39570", "timestamp_epoch": "1533965407.385519000" } ], "raw_values": [ "PETROV2018-PC$", "petrov2018-pc$" ], "identity_id": "identity-2c97e5af1376b26c8664ece9", "ip_addresses": [ "192.168.1.95" ], "mac_addresses": [ "f4:b5:20:68:b1:93" ] }, { "type": "hostname", "value": "Petrov2018-PC", "bindings": [ { "account": "", "owner_ip": "0.0.0.0", "frame_number": 1, "relationship": "dhcp-client-assertion", "source_field": "dhcp.option.hostname", "conversation_dst": "255.255.255.255", "conversation_src": "0.0.0.0" }, { "account": "", "owner_ip": "0.0.0.0", "frame_number": 288, "relationship": "dhcp-client-assertion", "source_field": "dhcp.option.hostname", "conversation_dst": "255.255.255.255", "conversation_src": "192.168.1.95" }, { "account": "", "owner_ip": "0.0.0.0", "frame_number": 6562, "relationship": "dhcp-client-assertion", "source_field": "dhcp.option.hostname", "conversation_dst": "255.255.255.255", "conversation_src": "192.168.1.95" }, { "account": "", "owner_ip": "0.0.0.0", "frame_number": 7257, "relationship": "dhcp-client-assertion", "source_field": "dhcp.option.hostname", "conversation_dst": "255.255.255.255", "conversation_src": "192.168.1.95" }, { "account": "", "owner_ip": "0.0.0.0", "frame_number": 39646, "relationship": "dhcp-client-assertion", "source_field": "dhcp.option.hostname", "conversation_dst": "192.168.1.254", "conversation_src": "192.168.1.95" }, { "account": "", "owner_ip": "0.0.0.0", "frame_number": 40091, "relationship": "dhcp-client-assertion", "source_field": "dhcp.option.hostname", "conversation_dst": "255.255.255.255", "conversation_src": "192.168.1.95" }, { "account": "", "owner_ip": "192.168.1.95", "frame_number": 8, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "192.168.1.1", "conversation_src": "192.168.1.95" }, { "account": "", "owner_ip": "192.168.1.95", "frame_number": 10, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "192.168.1.1", "conversation_src": "192.168.1.95" }, { "account": "", "owner_ip": "192.168.1.95", "frame_number": 176, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "192.168.1.1", "conversation_src": "192.168.1.95" }, { "account": "", "owner_ip": "192.168.1.95", "frame_number": 178, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "192.168.1.1", "conversation_src": "192.168.1.95" }, { "account": "", "owner_ip": "192.168.1.95", "frame_number": 282, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "192.168.1.1", "conversation_src": "192.168.1.95" }, { "account": "", "owner_ip": "192.168.1.95", "frame_number": 284, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "192.168.1.1", "conversation_src": "192.168.1.95" }, { "account": "", "owner_ip": "192.168.1.95", "frame_number": 299, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "192.168.1.255", "conversation_src": "192.168.1.95" }, { "account": "", "owner_ip": "192.168.1.95", "frame_number": 301, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "192.168.1.255", "conversation_src": "192.168.1.95" }, { "account": "", "owner_ip": "192.168.1.95", "frame_number": 303, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "192.168.1.255", "conversation_src": "192.168.1.95" }, { "account": "", "owner_ip": "192.168.1.95", "frame_number": 305, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "192.168.1.255", "conversation_src": "192.168.1.95" }, { "account": "", "owner_ip": "192.168.1.95", "frame_number": 306, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "192.168.1.255", "conversation_src": "192.168.1.95" }, { "account": "", "owner_ip": "192.168.1.95", "frame_number": 308, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "192.168.1.255", "conversation_src": "192.168.1.95" }, { "account": "", "owner_ip": "192.168.1.95", "frame_number": 310, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "192.168.1.255", "conversation_src": "192.168.1.95" }, { "account": "", "owner_ip": "192.168.1.95", "frame_number": 312, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "192.168.1.255", "conversation_src": "192.168.1.95" } ], "evidence": [ { "udp_stream": 0, "frame_number": 1, "display_filter": "frame.number == 1", "timestamp_epoch": "1533964508.767375000" }, { "udp_stream": 16, "frame_number": 288, "display_filter": "frame.number == 288", "timestamp_epoch": "1533964512.090074000" }, { "udp_stream": 16, "frame_number": 6562, "display_filter": "frame.number == 6562", "timestamp_epoch": "1533964576.241584000" }, { "udp_stream": 16, "frame_number": 7257, "display_filter": "frame.number == 7257", "timestamp_epoch": "1533964849.660910000" }, { "udp_stream": 1, "frame_number": 39646, "display_filter": "frame.number == 39646", "timestamp_epoch": "1533965410.161108000" }, { "udp_stream": 16, "frame_number": 40091, "display_filter": "frame.number == 40091", "timestamp_epoch": "1533965768.477452000" }, { "udp_stream": 4, "frame_number": 8, "display_filter": "frame.number == 8", "timestamp_epoch": "1533964508.857262000" }, { "udp_stream": 4, "frame_number": 10, "display_filter": "frame.number == 10", "timestamp_epoch": "1533964508.857840000" }, { "udp_stream": 4, "frame_number": 176, "display_filter": "frame.number == 176", "timestamp_epoch": "1533964510.357620000" }, { "udp_stream": 4, "frame_number": 178, "display_filter": "frame.number == 178", "timestamp_epoch": "1533964510.357785000" }, { "udp_stream": 4, "frame_number": 282, "display_filter": "frame.number == 282", "timestamp_epoch": "1533964511.878807000" }, { "udp_stream": 4, "frame_number": 284, "display_filter": "frame.number == 284", "timestamp_epoch": "1533964511.879054000" }, { "udp_stream": 20, "frame_number": 299, "display_filter": "frame.number == 299", "timestamp_epoch": "1533964513.421398000" }, { "udp_stream": 20, "frame_number": 301, "display_filter": "frame.number == 301", "timestamp_epoch": "1533964513.421498000" }, { "udp_stream": 20, "frame_number": 303, "display_filter": "frame.number == 303", "timestamp_epoch": "1533964514.186813000" }, { "udp_stream": 20, "frame_number": 305, "display_filter": "frame.number == 305", "timestamp_epoch": "1533964514.187295000" }, { "udp_stream": 20, "frame_number": 306, "display_filter": "frame.number == 306", "timestamp_epoch": "1533964514.952231000" }, { "udp_stream": 20, "frame_number": 308, "display_filter": "frame.number == 308", "timestamp_epoch": "1533964514.952423000" }, { "udp_stream": 20, "frame_number": 310, "display_filter": "frame.number == 310", "timestamp_epoch": "1533964515.716471000" }, { "udp_stream": 20, "frame_number": 312, "display_filter": "frame.number == 312", "timestamp_epoch": "1533964515.716708000" } ], "raw_values": [ "PETROV2018-PC<00>,PETROV2018-PC<00> (Workstation/Redirector)", "PETROV2018-PC<20>,PETROV2018-PC<20> (Server service)", "Petrov2018-PC" ], "identity_id": "identity-76ebf5d1062beb41778dfad8", "ip_addresses": [ "192.168.1.95" ], "mac_addresses": [ "f4:b5:20:68:b1:93", "f4:b5:20:68:b1:93,f4:b5:20:68:b1:93" ] }, { "type": "netbios-group", "value": "SPUTNIKHOUSE", "bindings": [ { "account": "", "owner_ip": null, "frame_number": 9, "relationship": "group-membership-not-hostname", "source_field": "nbns.name", "conversation_dst": "192.168.1.1", "conversation_src": "192.168.1.95" }, { "account": "", "owner_ip": null, "frame_number": 177, "relationship": "group-membership-not-hostname", "source_field": "nbns.name", "conversation_dst": "192.168.1.1", "conversation_src": "192.168.1.95" }, { "account": "", "owner_ip": null, "frame_number": 283, "relationship": "group-membership-not-hostname", "source_field": "nbns.name", "conversation_dst": "192.168.1.1", "conversation_src": "192.168.1.95" }, { "account": "", "owner_ip": null, "frame_number": 300, "relationship": "group-membership-not-hostname", "source_field": "nbns.name", "conversation_dst": "192.168.1.255", "conversation_src": "192.168.1.95" }, { "account": "", "owner_ip": null, "frame_number": 304, "relationship": "group-membership-not-hostname", "source_field": "nbns.name", "conversation_dst": "192.168.1.255", "conversation_src": "192.168.1.95" }, { "account": "", "owner_ip": null, "frame_number": 307, "relationship": "group-membership-not-hostname", "source_field": "nbns.name", "conversation_dst": "192.168.1.255", "conversation_src": "192.168.1.95" }, { "account": "", "owner_ip": null, "frame_number": 311, "relationship": "group-membership-not-hostname", "source_field": "nbns.name", "conversation_dst": "192.168.1.255", "conversation_src": "192.168.1.95" } ], "evidence": [ { "udp_stream": 4, "frame_number": 9, "display_filter": "frame.number == 9", "timestamp_epoch": "1533964508.857599000" }, { "udp_stream": 4, "frame_number": 177, "display_filter": "frame.number == 177", "timestamp_epoch": "1533964510.357623000" }, { "udp_stream": 4, "frame_number": 283, "display_filter": "frame.number == 283", "timestamp_epoch": "1533964511.878872000" }, { "udp_stream": 20, "frame_number": 300, "display_filter": "frame.number == 300", "timestamp_epoch": "1533964513.421410000" }, { "udp_stream": 20, "frame_number": 304, "display_filter": "frame.number == 304", "timestamp_epoch": "1533964514.187084000" }, { "udp_stream": 20, "frame_number": 307, "display_filter": "frame.number == 307", "timestamp_epoch": "1533964514.952244000" }, { "udp_stream": 20, "frame_number": 311, "display_filter": "frame.number == 311", "timestamp_epoch": "1533964515.716483000" } ], "raw_values": [ "SPUTNIKHOUSE<00>,SPUTNIKHOUSE<00> (Workstation/Redirector)" ], "identity_id": "identity-49b6a3edaab93ca5f58c0437", "ip_addresses": [], "mac_addresses": [] } ], "actor_leads": [], "observables": [ { "type": "domain", "roles": [ "dns-cname" ], "value": "1605158521.rsc.cdn77.org", "evidence": [ { "udp_stream": 221, "frame_number": 21150, "display_filter": "frame.number == 21150", "timestamp_epoch": "1533964967.906377000" } ], "is_private": null, "observable_id": "observable-76583fca897523fee7e5fcf4", "last_seen_epoch": "1533964967.906377000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964967.906377000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "2886.tm.zedo.com", "evidence": [ { "udp_stream": 108, "frame_number": 9478, "display_filter": "frame.number == 9478", "timestamp_epoch": "1533964899.379243000" }, { "udp_stream": 108, "frame_number": 9752, "display_filter": "frame.number == 9752", "timestamp_epoch": "1533964899.625132000" }, { "tcp_stream": 262, "frame_number": 9929, "display_filter": "frame.number == 9929", "timestamp_epoch": "1533964899.746035000" }, { "tcp_stream": 263, "frame_number": 9933, "display_filter": "frame.number == 9933", "timestamp_epoch": "1533964899.746839000" } ], "is_private": null, "observable_id": "observable-934e2627f9334c71757cb2a7", "last_seen_epoch": "1533964899.746839000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964899.379243000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "506163eff52ac0e798da9465b8af1d86.lswcdn.net", "evidence": [ { "udp_stream": 33, "frame_number": 649, "display_filter": "frame.number == 649", "timestamp_epoch": "1533964545.745951000" } ], "is_private": null, "observable_id": "observable-fe10fa0795e6b4e516999708", "last_seen_epoch": "1533964545.745951000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964545.745951000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "a.company-target.com", "evidence": [ { "udp_stream": 109, "frame_number": 9971, "display_filter": "frame.number == 9971", "timestamp_epoch": "1533964899.767493000" }, { "udp_stream": 109, "frame_number": 10021, "display_filter": "frame.number == 10021", "timestamp_epoch": "1533964899.857368000" }, { "tcp_stream": 266, "frame_number": 10224, "display_filter": "frame.number == 10224", "timestamp_epoch": "1533964899.986592000" }, { "tcp_stream": 267, "frame_number": 10240, "display_filter": "frame.number == 10240", "timestamp_epoch": "1533964899.991848000" } ], "is_private": null, "observable_id": "observable-f777454fc3bd916acbb09b8e", "last_seen_epoch": "1533964899.991848000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964899.767493000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "a.tribalfusion.com", "evidence": [ { "udp_stream": 193, "frame_number": 18475, "display_filter": "frame.number == 18475", "timestamp_epoch": "1533964959.057459000" }, { "udp_stream": 193, "frame_number": 18627, "display_filter": "frame.number == 18627", "timestamp_epoch": "1533964959.502881000" }, { "tcp_stream": 532, "frame_number": 18707, "display_filter": "frame.number == 18707", "timestamp_epoch": "1533964959.880531000" }, { "tcp_stream": 531, "frame_number": 18708, "display_filter": "frame.number == 18708", "timestamp_epoch": "1533964959.880813000" }, { "tcp_stream": 816, "frame_number": 30631, "display_filter": "frame.number == 30631", "timestamp_epoch": "1533965099.029671000" }, { "tcp_stream": 817, "frame_number": 30642, "display_filter": "frame.number == 30642", "timestamp_epoch": "1533965099.044869000" } ], "is_private": null, "observable_id": "observable-10222abcad79cdccbc816638", "last_seen_epoch": "1533965099.044869000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964959.057459000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "a1.adform.net", "evidence": [ { "udp_stream": 195, "frame_number": 18665, "display_filter": "frame.number == 18665", "timestamp_epoch": "1533964959.603319000" }, { "udp_stream": 195, "frame_number": 18760, "display_filter": "frame.number == 18760", "timestamp_epoch": "1533964960.021343000" }, { "tcp_stream": 538, "frame_number": 18890, "display_filter": "frame.number == 18890", "timestamp_epoch": "1533964960.194958000" }, { "tcp_stream": 537, "frame_number": 18894, "display_filter": "frame.number == 18894", "timestamp_epoch": "1533964960.196730000" }, { "tcp_stream": 724, "frame_number": 27001, "display_filter": "frame.number == 27001", "timestamp_epoch": "1533965034.057886000" }, { "tcp_stream": 723, "frame_number": 27008, "display_filter": "frame.number == 27008", "timestamp_epoch": "1533965034.073971000" }, { "tcp_stream": 792, "frame_number": 29613, "display_filter": "frame.number == 29613", "timestamp_epoch": "1533965096.865848000" }, { "tcp_stream": 793, "frame_number": 29617, "display_filter": "frame.number == 29617", "timestamp_epoch": "1533965096.882289000" }, { "tcp_stream": 947, "frame_number": 34722, "display_filter": "frame.number == 34722", "timestamp_epoch": "1533965158.851379000" }, { "tcp_stream": 946, "frame_number": 34726, "display_filter": "frame.number == 34726", "timestamp_epoch": "1533965158.851787000" }, { "tcp_stream": 1026, "frame_number": 39185, "display_filter": "frame.number == 39185", "timestamp_epoch": "1533965245.934643000" }, { "tcp_stream": 1027, "frame_number": 39201, "display_filter": "frame.number == 39201", "timestamp_epoch": "1533965245.953287000" } ], "is_private": null, "observable_id": "observable-fbb47adf15a799bb788dab4c", "last_seen_epoch": "1533965245.953287000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964959.603319000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "a1.seadform.net", "evidence": [ { "udp_stream": 255, "frame_number": 27153, "display_filter": "frame.number == 27153", "timestamp_epoch": "1533965034.720415000" }, { "udp_stream": 255, "frame_number": 27166, "display_filter": "frame.number == 27166", "timestamp_epoch": "1533965034.849432000" }, { "tcp_stream": 732, "frame_number": 27225, "display_filter": "frame.number == 27225", "timestamp_epoch": "1533965034.998139000" }, { "tcp_stream": 731, "frame_number": 27231, "display_filter": "frame.number == 27231", "timestamp_epoch": "1533965035.004157000" } ], "is_private": null, "observable_id": "observable-dcebfe608057869781e73cab", "last_seen_epoch": "1533965035.004157000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965034.720415000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "aa.agkn.com", "evidence": [ { "udp_stream": 180, "frame_number": 20176, "display_filter": "frame.number == 20176", "timestamp_epoch": "1533964964.882244000" }, { "udp_stream": 180, "frame_number": 20228, "display_filter": "frame.number == 20228", "timestamp_epoch": "1533964965.012614000" }, { "tcp_stream": 588, "frame_number": 20344, "display_filter": "frame.number == 20344", "timestamp_epoch": "1533964965.302742000" }, { "tcp_stream": 585, "frame_number": 20348, "display_filter": "frame.number == 20348", "timestamp_epoch": "1533964965.303088000" } ], "is_private": null, "observable_id": "observable-2f1304c9b5a98cd310d5a050", "last_seen_epoch": "1533964965.303088000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964964.882244000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "acdn.adnxs.com", "evidence": [ { "udp_stream": 201, "frame_number": 19272, "display_filter": "frame.number == 19272", "timestamp_epoch": "1533964961.686987000" }, { "udp_stream": 201, "frame_number": 19305, "display_filter": "frame.number == 19305", "timestamp_epoch": "1533964961.766961000" }, { "tcp_stream": 554, "frame_number": 19349, "display_filter": "frame.number == 19349", "timestamp_epoch": "1533964961.843188000" }, { "tcp_stream": 555, "frame_number": 19352, "display_filter": "frame.number == 19352", "timestamp_epoch": "1533964961.843951000" } ], "is_private": null, "observable_id": "observable-d77642f1caea417e65b2c887", "last_seen_epoch": "1533964961.843951000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964961.686987000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "ad.360yield.com", "evidence": [ { "udp_stream": 120, "frame_number": 23571, "display_filter": "frame.number == 23571", "timestamp_epoch": "1533964997.745387000" }, { "udp_stream": 120, "frame_number": 23682, "display_filter": "frame.number == 23682", "timestamp_epoch": "1533964997.887170000" }, { "tcp_stream": 663, "frame_number": 23812, "display_filter": "frame.number == 23812", "timestamp_epoch": "1533964998.060581000" }, { "tcp_stream": 662, "frame_number": 23818, "display_filter": "frame.number == 23818", "timestamp_epoch": "1533964998.062358000" } ], "is_private": null, "observable_id": "observable-5068e3d77075aadc4713431e", "last_seen_epoch": "1533964998.062358000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964997.745387000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "ad.lkqd.net", "evidence": [ { "udp_stream": 160, "frame_number": 15185, "display_filter": "frame.number == 15185", "timestamp_epoch": "1533964905.944747000" }, { "udp_stream": 160, "frame_number": 15186, "display_filter": "frame.number == 15186", "timestamp_epoch": "1533964906.152257000" }, { "tcp_stream": 417, "frame_number": 15195, "display_filter": "frame.number == 15195", "timestamp_epoch": "1533964906.256898000" }, { "tcp_stream": 418, "frame_number": 15199, "display_filter": "frame.number == 15199", "timestamp_epoch": "1533964906.257378000" }, { "tcp_stream": 420, "frame_number": 15205, "display_filter": "frame.number == 15205", "timestamp_epoch": "1533964906.258704000" }, { "tcp_stream": 419, "frame_number": 15206, "display_filter": "frame.number == 15206", "timestamp_epoch": "1533964906.258705000" }, { "tcp_stream": 421, "frame_number": 15211, "display_filter": "frame.number == 15211", "timestamp_epoch": "1533964906.272741000" }, { "tcp_stream": 422, "frame_number": 15221, "display_filter": "frame.number == 15221", "timestamp_epoch": "1533964906.310134000" } ], "is_private": null, "observable_id": "observable-d40ace90662479f3f4ca0111", "last_seen_epoch": "1533964906.310134000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964905.944747000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "ad.sxp.smartclip.net", "evidence": [ { "udp_stream": 285, "frame_number": 31611, "display_filter": "frame.number == 31611", "timestamp_epoch": "1533965100.695737000" }, { "udp_stream": 285, "frame_number": 31674, "display_filter": "frame.number == 31674", "timestamp_epoch": "1533965100.796522000" }, { "tcp_stream": 867, "frame_number": 31863, "display_filter": "frame.number == 31863", "timestamp_epoch": "1533965101.066755000" }, { "tcp_stream": 866, "frame_number": 31866, "display_filter": "frame.number == 31866", "timestamp_epoch": "1533965101.066759000" } ], "is_private": null, "observable_id": "observable-8ac8395c06607fe22abab7c7", "last_seen_epoch": "1533965101.066759000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965100.695737000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "ad.turn.com", "evidence": [ { "udp_stream": 62, "frame_number": 5077, "display_filter": "frame.number == 5077", "timestamp_epoch": "1533964555.920423000" }, { "udp_stream": 62, "frame_number": 5145, "display_filter": "frame.number == 5145", "timestamp_epoch": "1533964556.026779000" }, { "tcp_stream": 122, "frame_number": 5211, "display_filter": "frame.number == 5211", "timestamp_epoch": "1533964556.093873000" }, { "tcp_stream": 123, "frame_number": 5216, "display_filter": "frame.number == 5216", "timestamp_epoch": "1533964556.094416000" }, { "tcp_stream": 440, "frame_number": 15992, "display_filter": "frame.number == 15992", "timestamp_epoch": "1533964908.383881000" }, { "tcp_stream": 439, "frame_number": 16000, "display_filter": "frame.number == 16000", "timestamp_epoch": "1533964908.387288000" }, { "tcp_stream": 692, "frame_number": 26354, "display_filter": "frame.number == 26354", "timestamp_epoch": "1533965032.538900000" }, { "tcp_stream": 693, "frame_number": 26356, "display_filter": "frame.number == 26356", "timestamp_epoch": "1533965032.542361000" } ], "is_private": null, "observable_id": "observable-beb6113bbe9119ab1a034569", "last_seen_epoch": "1533965032.542361000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964555.920423000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "ad.turn.com.akadns.net", "evidence": [ { "udp_stream": 62, "frame_number": 5145, "display_filter": "frame.number == 5145", "timestamp_epoch": "1533964556.026779000" } ], "is_private": null, "observable_id": "observable-a5bb793866c2afcb813d62d8", "last_seen_epoch": "1533964556.026779000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964556.026779000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "ade.googlesyndication.com", "evidence": [ { "udp_stream": 177, "frame_number": 16943, "display_filter": "frame.number == 16943", "timestamp_epoch": "1533964912.828553000" }, { "udp_stream": 177, "frame_number": 16951, "display_filter": "frame.number == 16951", "timestamp_epoch": "1533964912.917076000" }, { "tcp_stream": 485, "frame_number": 16958, "display_filter": "frame.number == 16958", "timestamp_epoch": "1533964912.979369000" }, { "tcp_stream": 486, "frame_number": 16962, "display_filter": "frame.number == 16962", "timestamp_epoch": "1533964912.980377000" }, { "tcp_stream": 685, "frame_number": 25293, "display_filter": "frame.number == 25293", "timestamp_epoch": "1533965023.576293000" }, { "tcp_stream": 684, "frame_number": 25294, "display_filter": "frame.number == 25294", "timestamp_epoch": "1533965023.576308000" }, { "tcp_stream": 919, "frame_number": 33424, "display_filter": "frame.number == 33424", "timestamp_epoch": "1533965142.863003000" }, { "tcp_stream": 920, "frame_number": 33426, "display_filter": "frame.number == 33426", "timestamp_epoch": "1533965142.863666000" } ], "is_private": null, "observable_id": "observable-2a62c6218d8e77b494a02db1", "last_seen_epoch": "1533965142.863666000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964912.828553000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "ads-bid.l.doubleclick.net", "evidence": [ { "udp_stream": 289, "frame_number": 32653, "display_filter": "frame.number == 32653", "timestamp_epoch": "1533965134.234653000" } ], "is_private": null, "observable_id": "observable-7aeb5097eb572f241799e07a", "last_seen_epoch": "1533965134.234653000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965134.234653000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "ads-east1-132899269.us-east-1.elb.amazonaws.com", "evidence": [ { "udp_stream": 182, "frame_number": 17855, "display_filter": "frame.number == 17855", "timestamp_epoch": "1533964957.358759000" } ], "is_private": null, "observable_id": "observable-0f7ce750d04ffb0fcf24d428", "last_seen_epoch": "1533964957.358759000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964957.358759000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "ads-sc2-lb9.adsymptotic.com", "evidence": [ { "udp_stream": 288, "frame_number": 32219, "display_filter": "frame.number == 32219", "timestamp_epoch": "1533965102.184319000" } ], "is_private": null, "observable_id": "observable-f2b1a270b75af79f4c286e81", "last_seen_epoch": "1533965102.184319000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965102.184319000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "ads.adaptv.advertising.com", "evidence": [ { "udp_stream": 197, "frame_number": 19011, "display_filter": "frame.number == 19011", "timestamp_epoch": "1533964960.452739000" }, { "udp_stream": 197, "frame_number": 19066, "display_filter": "frame.number == 19066", "timestamp_epoch": "1533964960.516077000" }, { "tcp_stream": 545, "frame_number": 19099, "display_filter": "frame.number == 19099", "timestamp_epoch": "1533964960.618867000" }, { "tcp_stream": 546, "frame_number": 19103, "display_filter": "frame.number == 19103", "timestamp_epoch": "1533964960.619216000" } ], "is_private": null, "observable_id": "observable-1431f11394a076d5106bd8b9", "last_seen_epoch": "1533964960.619216000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964960.452739000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "ads.creative-serving.com", "evidence": [ { "udp_stream": 274, "frame_number": 30393, "display_filter": "frame.number == 30393", "timestamp_epoch": "1533965098.617525000" }, { "udp_stream": 274, "frame_number": 30691, "display_filter": "frame.number == 30691", "timestamp_epoch": "1533965099.093757000" }, { "tcp_stream": 833, "frame_number": 31026, "display_filter": "frame.number == 31026", "timestamp_epoch": "1533965099.746688000" }, { "tcp_stream": 832, "frame_number": 31035, "display_filter": "frame.number == 31035", "timestamp_epoch": "1533965099.754724000" } ], "is_private": null, "observable_id": "observable-0301b278b153e90a49cdbcbd", "last_seen_epoch": "1533965099.754724000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965098.617525000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "ads.deliverimp.com", "evidence": [ { "udp_stream": 117, "frame_number": 10975, "display_filter": "frame.number == 10975", "timestamp_epoch": "1533964900.961738000" }, { "udp_stream": 117, "frame_number": 11114, "display_filter": "frame.number == 11114", "timestamp_epoch": "1533964901.056360000" }, { "tcp_stream": 288, "frame_number": 11409, "display_filter": "frame.number == 11409", "timestamp_epoch": "1533964901.242573000" }, { "tcp_stream": 289, "frame_number": 11411, "display_filter": "frame.number == 11411", "timestamp_epoch": "1533964901.243326000" } ], "is_private": null, "observable_id": "observable-1c113eb07020d9064f3519eb", "last_seen_epoch": "1533964901.243326000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964900.961738000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "ads.lfstmedia.com", "evidence": [ { "udp_stream": 282, "frame_number": 31608, "display_filter": "frame.number == 31608", "timestamp_epoch": "1533965100.695068000" }, { "udp_stream": 282, "frame_number": 31833, "display_filter": "frame.number == 31833", "timestamp_epoch": "1533965100.973117000" }, { "tcp_stream": 873, "frame_number": 31960, "display_filter": "frame.number == 31960", "timestamp_epoch": "1533965101.211552000" }, { "tcp_stream": 872, "frame_number": 31962, "display_filter": "frame.number == 31962", "timestamp_epoch": "1533965101.211676000" } ], "is_private": null, "observable_id": "observable-4ab618521f66e8ca2f522a1f", "last_seen_epoch": "1533965101.211676000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965100.695068000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "ads.pubmatic.com", "evidence": [ { "udp_stream": 164, "frame_number": 15784, "display_filter": "frame.number == 15784", "timestamp_epoch": "1533964907.606307000" }, { "udp_stream": 164, "frame_number": 15826, "display_filter": "frame.number == 15826", "timestamp_epoch": "1533964907.702394000" }, { "tcp_stream": 435, "frame_number": 15851, "display_filter": "frame.number == 15851", "timestamp_epoch": "1533964907.775575000" }, { "tcp_stream": 436, "frame_number": 15853, "display_filter": "frame.number == 15853", "timestamp_epoch": "1533964907.776016000" } ], "is_private": null, "observable_id": "observable-8d783fe4d6467f6d8473f1fa", "last_seen_epoch": "1533964907.776016000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964907.606307000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "ads.rubiconproject.com", "evidence": [ { "udp_stream": 136, "frame_number": 12778, "display_filter": "frame.number == 12778", "timestamp_epoch": "1533964902.711278000" }, { "udp_stream": 136, "frame_number": 12842, "display_filter": "frame.number == 12842", "timestamp_epoch": "1533964902.809158000" }, { "tcp_stream": 333, "frame_number": 12923, "display_filter": "frame.number == 12923", "timestamp_epoch": "1533964902.867200000" }, { "tcp_stream": 332, "frame_number": 12930, "display_filter": "frame.number == 12930", "timestamp_epoch": "1533964902.870165000" } ], "is_private": null, "observable_id": "observable-1bd0579a2c166a0a875f00ee", "last_seen_epoch": "1533964902.870165000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964902.711278000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "ads.scorecardresearch.com", "evidence": [ { "udp_stream": 149, "frame_number": 14513, "display_filter": "frame.number == 14513", "timestamp_epoch": "1533964904.540196000" }, { "udp_stream": 149, "frame_number": 14601, "display_filter": "frame.number == 14601", "timestamp_epoch": "1533964904.629602000" }, { "tcp_stream": 392, "frame_number": 14680, "display_filter": "frame.number == 14680", "timestamp_epoch": "1533964904.690554000" }, { "tcp_stream": 391, "frame_number": 14701, "display_filter": "frame.number == 14701", "timestamp_epoch": "1533964904.697213000" } ], "is_private": null, "observable_id": "observable-3a62ea6ed897542e9266e274", "last_seen_epoch": "1533964904.697213000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964904.540196000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "ads.stickyadstv.com", "evidence": [ { "udp_stream": 257, "frame_number": 27300, "display_filter": "frame.number == 27300", "timestamp_epoch": "1533965035.315723000" }, { "udp_stream": 257, "frame_number": 27357, "display_filter": "frame.number == 27357", "timestamp_epoch": "1533965035.496495000" }, { "tcp_stream": 749, "frame_number": 27403, "display_filter": "frame.number == 27403", "timestamp_epoch": "1533965035.568002000" }, { "tcp_stream": 748, "frame_number": 27404, "display_filter": "frame.number == 27404", "timestamp_epoch": "1533965035.568078000" } ], "is_private": null, "observable_id": "observable-733b2479d76b6a3b6565c633", "last_seen_epoch": "1533965035.568078000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965035.315723000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "ads.yahoo.com", "evidence": [ { "udp_stream": 81, "frame_number": 6084, "display_filter": "frame.number == 6084", "timestamp_epoch": "1533964559.791256000" }, { "udp_stream": 81, "frame_number": 6113, "display_filter": "frame.number == 6113", "timestamp_epoch": "1533964559.840586000" }, { "tcp_stream": 153, "frame_number": 6171, "display_filter": "frame.number == 6171", "timestamp_epoch": "1533964559.929820000" }, { "tcp_stream": 152, "frame_number": 6172, "display_filter": "frame.number == 6172", "timestamp_epoch": "1533964559.929935000" }, { "tcp_stream": 479, "frame_number": 16747, "display_filter": "frame.number == 16747", "timestamp_epoch": "1533964910.427694000" }, { "tcp_stream": 480, "frame_number": 16750, "display_filter": "frame.number == 16750", "timestamp_epoch": "1533964910.428144000" }, { "tcp_stream": 938, "frame_number": 33913, "display_filter": "frame.number == 33913", "timestamp_epoch": "1533965157.843534000" }, { "tcp_stream": 939, "frame_number": 33928, "display_filter": "frame.number == 33928", "timestamp_epoch": "1533965157.852767000" } ], "is_private": null, "observable_id": "observable-6532c7f57b1bf4d31af9b9aa", "last_seen_epoch": "1533965157.852767000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964559.791256000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "adserver.adtech.advertising.com", "evidence": [ { "udp_stream": 247, "frame_number": 26598, "display_filter": "frame.number == 26598", "timestamp_epoch": "1533965032.986172000" }, { "udp_stream": 247, "frame_number": 26644, "display_filter": "frame.number == 26644", "timestamp_epoch": "1533965033.203044000" }, { "tcp_stream": 707, "frame_number": 26670, "display_filter": "frame.number == 26670", "timestamp_epoch": "1533965033.324564000" }, { "tcp_stream": 706, "frame_number": 26672, "display_filter": "frame.number == 26672", "timestamp_epoch": "1533965033.324943000" } ], "is_private": null, "observable_id": "observable-ddb670955e1ae440d1b2174a", "last_seen_epoch": "1533965033.324943000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965032.986172000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "adservice.google.com", "evidence": [ { "udp_stream": 53, "frame_number": 3792, "display_filter": "frame.number == 3792", "timestamp_epoch": "1533964553.383949000" }, { "udp_stream": 53, "frame_number": 3925, "display_filter": "frame.number == 3925", "timestamp_epoch": "1533964553.575811000" }, { "udp_stream": 345, "frame_number": 43722, "display_filter": "frame.number == 43722", "timestamp_epoch": "1533965783.242495000" }, { "udp_stream": 345, "frame_number": 43840, "display_filter": "frame.number == 43840", "timestamp_epoch": "1533965783.630277000" }, { "tcp_stream": 99, "frame_number": 4029, "display_filter": "frame.number == 4029", "timestamp_epoch": "1533964553.660668000" }, { "tcp_stream": 100, "frame_number": 4031, "display_filter": "frame.number == 4031", "timestamp_epoch": "1533964553.662840000" }, { "tcp_stream": 197, "frame_number": 7831, "display_filter": "frame.number == 7831", "timestamp_epoch": "1533964897.703908000" }, { "tcp_stream": 196, "frame_number": 7833, "display_filter": "frame.number == 7833", "timestamp_epoch": "1533964897.704223000" }, { "tcp_stream": 497, "frame_number": 17533, "display_filter": "frame.number == 17533", "timestamp_epoch": "1533964956.641278000" }, { "tcp_stream": 1156, "frame_number": 43919, "display_filter": "frame.number == 43919", "timestamp_epoch": "1533965783.792386000" }, { "tcp_stream": 1155, "frame_number": 43925, "display_filter": "frame.number == 43925", "timestamp_epoch": "1533965783.794083000" } ], "is_private": null, "observable_id": "observable-ac850e4b152503246c39a787", "last_seen_epoch": "1533965783.794083000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964553.383949000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "adventori.com", "evidence": [ { "udp_stream": 269, "frame_number": 27493, "display_filter": "frame.number == 27493", "timestamp_epoch": "1533965035.666698000" }, { "udp_stream": 269, "frame_number": 27577, "display_filter": "frame.number == 27577", "timestamp_epoch": "1533965035.747708000" }, { "tcp_stream": 766, "frame_number": 27799, "display_filter": "frame.number == 27799", "timestamp_epoch": "1533965035.970037000" }, { "tcp_stream": 764, "frame_number": 27801, "display_filter": "frame.number == 27801", "timestamp_epoch": "1533965035.970486000" } ], "is_private": null, "observable_id": "observable-4eaccdae1741c28f56c7ec19", "last_seen_epoch": "1533965035.970486000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965035.666698000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "ag.innovid.com", "evidence": [ { "udp_stream": 296, "frame_number": 32965, "display_filter": "frame.number == 32965", "timestamp_epoch": "1533965136.705665000" }, { "udp_stream": 296, "frame_number": 32987, "display_filter": "frame.number == 32987", "timestamp_epoch": "1533965136.794310000" }, { "tcp_stream": 902, "frame_number": 33021, "display_filter": "frame.number == 33021", "timestamp_epoch": "1533965136.873817000" }, { "tcp_stream": 903, "frame_number": 33027, "display_filter": "frame.number == 33027", "timestamp_epoch": "1533965136.880761000" }, { "tcp_stream": 1006, "frame_number": 38861, "display_filter": "frame.number == 38861", "timestamp_epoch": "1533965240.375708000" }, { "tcp_stream": 1007, "frame_number": 38864, "display_filter": "frame.number == 38864", "timestamp_epoch": "1533965240.375840000" } ], "is_private": null, "observable_id": "observable-2729e512305fa7b5b9910e38", "last_seen_epoch": "1533965240.375840000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965136.705665000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "ajax.googleapis.com", "evidence": [ { "udp_stream": 30, "frame_number": 594, "display_filter": "frame.number == 594", "timestamp_epoch": "1533964545.561585000" }, { "udp_stream": 30, "frame_number": 611, "display_filter": "frame.number == 611", "timestamp_epoch": "1533964545.651017000" }, { "tcp_stream": 48, "frame_number": 624, "display_filter": "frame.number == 624", "timestamp_epoch": "1533964545.709230000" }, { "tcp_stream": 47, "frame_number": 626, "display_filter": "frame.number == 626", "timestamp_epoch": "1533964545.709442000" } ], "is_private": null, "observable_id": "observable-bc47abb78996bf01806765d8", "last_seen_epoch": "1533964545.709442000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964545.561585000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "alb-vpc-pixel-tracker-front-prod-1906776940.us-east-1.elb.amazonaws.com", "evidence": [ { "udp_stream": 248, "frame_number": 26728, "display_filter": "frame.number == 26728", "timestamp_epoch": "1533965033.481510000" }, { "udp_stream": 254, "frame_number": 27021, "display_filter": "frame.number == 27021", "timestamp_epoch": "1533965034.135661000" } ], "is_private": null, "observable_id": "observable-394c6e831c76b7ab1e8c8645", "last_seen_epoch": "1533965034.135661000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965033.481510000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "an.yandex.ru", "evidence": [ { "udp_stream": 44, "frame_number": 3129, "display_filter": "frame.number == 3129", "timestamp_epoch": "1533964552.232112000" }, { "udp_stream": 44, "frame_number": 3197, "display_filter": "frame.number == 3197", "timestamp_epoch": "1533964552.405569000" }, { "udp_stream": 337, "frame_number": 43638, "display_filter": "frame.number == 43638", "timestamp_epoch": "1533965783.001053000" }, { "udp_stream": 337, "frame_number": 43651, "display_filter": "frame.number == 43651", "timestamp_epoch": "1533965783.060399000" }, { "tcp_stream": 71, "frame_number": 3430, "display_filter": "frame.number == 3430", "timestamp_epoch": "1533964552.803227000" }, { "tcp_stream": 72, "frame_number": 3432, "display_filter": "frame.number == 3432", "timestamp_epoch": "1533964552.803334000" }, { "tcp_stream": 201, "frame_number": 8338, "display_filter": "frame.number == 8338", "timestamp_epoch": "1533964898.152886000" }, { "tcp_stream": 200, "frame_number": 8340, "display_filter": "frame.number == 8340", "timestamp_epoch": "1533964898.153065000" }, { "tcp_stream": 1142, "frame_number": 43734, "display_filter": "frame.number == 43734", "timestamp_epoch": "1533965783.300133000" }, { "tcp_stream": 1141, "frame_number": 43738, "display_filter": "frame.number == 43738", "timestamp_epoch": "1533965783.307821000" } ], "is_private": null, "observable_id": "observable-e7bc633a5f29e1c198ad7cf0", "last_seen_epoch": "1533965783.307821000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964552.232112000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "api.bing.com", "evidence": [ { "udp_stream": 35, "frame_number": 2028, "display_filter": "frame.number == 2028", "timestamp_epoch": "1533964548.338132000" }, { "udp_stream": 36, "frame_number": 2029, "display_filter": "frame.number == 2029", "timestamp_epoch": "1533964548.338135000" }, { "udp_stream": 35, "frame_number": 2030, "display_filter": "frame.number == 2030", "timestamp_epoch": "1533964548.338547000" }, { "udp_stream": 36, "frame_number": 2032, "display_filter": "frame.number == 2032", "timestamp_epoch": "1533964548.338743000" }, { "udp_stream": 330, "frame_number": 41222, "display_filter": "frame.number == 41222", "timestamp_epoch": "1533965772.517902000" }, { "udp_stream": 331, "frame_number": 41223, "display_filter": "frame.number == 41223", "timestamp_epoch": "1533965772.517905000" }, { "udp_stream": 331, "frame_number": 41443, "display_filter": "frame.number == 41443", "timestamp_epoch": "1533965773.530763000" }, { "udp_stream": 330, "frame_number": 41444, "display_filter": "frame.number == 41444", "timestamp_epoch": "1533965773.530766000" }, { "udp_stream": 331, "frame_number": 41615, "display_filter": "frame.number == 41615", "timestamp_epoch": "1533965774.364547000" }, { "udp_stream": 331, "frame_number": 41618, "display_filter": "frame.number == 41618", "timestamp_epoch": "1533965774.364689000" }, { "udp_stream": 330, "frame_number": 41619, "display_filter": "frame.number == 41619", "timestamp_epoch": "1533965774.364956000" } ], "is_private": null, "observable_id": "observable-fb09fb4860e00c952245fa40", "last_seen_epoch": "1533965774.364956000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964548.338132000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "apnx-match.dotomi.com", "evidence": [ { "udp_stream": 267, "frame_number": 27461, "display_filter": "frame.number == 27461", "timestamp_epoch": "1533965035.641721000" }, { "udp_stream": 267, "frame_number": 27573, "display_filter": "frame.number == 27573", "timestamp_epoch": "1533965035.747066000" }, { "tcp_stream": 765, "frame_number": 27656, "display_filter": "frame.number == 27656", "timestamp_epoch": "1533965035.831325000" }, { "tcp_stream": 767, "frame_number": 27657, "display_filter": "frame.number == 27657", "timestamp_epoch": "1533965035.831578000" } ], "is_private": null, "observable_id": "observable-ba07179d2d5eb2f6a67c1c96", "last_seen_epoch": "1533965035.831578000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965035.641721000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "appnexus-partners.tremorhub.com", "evidence": [ { "udp_stream": 258, "frame_number": 27302, "display_filter": "frame.number == 27302", "timestamp_epoch": "1533965035.335814000" }, { "udp_stream": 258, "frame_number": 27323, "display_filter": "frame.number == 27323", "timestamp_epoch": "1533965035.406624000" }, { "tcp_stream": 736, "frame_number": 27388, "display_filter": "frame.number == 27388", "timestamp_epoch": "1533965035.527917000" }, { "tcp_stream": 737, "frame_number": 27391, "display_filter": "frame.number == 27391", "timestamp_epoch": "1533965035.528278000" } ], "is_private": null, "observable_id": "observable-5db37a40b09aea568541b17c", "last_seen_epoch": "1533965035.528278000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965035.335814000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "apps.digsigtrust.com", "evidence": [ { "udp_stream": 95, "frame_number": 8582, "display_filter": "frame.number == 8582", "timestamp_epoch": "1533964898.485160000" }, { "udp_stream": 94, "frame_number": 8583, "display_filter": "frame.number == 8583", "timestamp_epoch": "1533964898.485161000" } ], "is_private": null, "observable_id": "observable-1b348bfc7c6c49215ee89197", "last_seen_epoch": "1533964898.485161000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964898.485160000" }, { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "apps.identrust.com", "evidence": [ { "udp_stream": 94, "frame_number": 8557, "display_filter": "frame.number == 8557", "timestamp_epoch": "1533964898.439074000" }, { "udp_stream": 95, "frame_number": 8558, "display_filter": "frame.number == 8558", "timestamp_epoch": "1533964898.441696000" }, { "udp_stream": 95, "frame_number": 8582, "display_filter": "frame.number == 8582", "timestamp_epoch": "1533964898.485160000" }, { "udp_stream": 94, "frame_number": 8583, "display_filter": "frame.number == 8583", "timestamp_epoch": "1533964898.485161000" }, { "tcp_stream": 218, "frame_number": 8633, "display_filter": "frame.number == 8633", "timestamp_epoch": "1533964898.552621000" }, { "tcp_stream": 217, "frame_number": 8637, "display_filter": "frame.number == 8637", "timestamp_epoch": "1533964898.553823000" } ], "is_private": null, "observable_id": "observable-32914d384f2d694bc5e1387c", "last_seen_epoch": "1533964898.553823000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964898.439074000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "b1-lsw-use1.zemanta.com", "evidence": [ { "udp_stream": 113, "frame_number": 10616, "display_filter": "frame.number == 10616", "timestamp_epoch": "1533964900.621029000" } ], "is_private": null, "observable_id": "observable-c7d7561fc45fc5da5cd46bfe", "last_seen_epoch": "1533964900.621029000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964900.621029000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "b1sync.zemanta.com", "evidence": [ { "udp_stream": 113, "frame_number": 10583, "display_filter": "frame.number == 10583", "timestamp_epoch": "1533964900.526430000" }, { "udp_stream": 113, "frame_number": 10616, "display_filter": "frame.number == 10616", "timestamp_epoch": "1533964900.621029000" }, { "tcp_stream": 271, "frame_number": 10780, "display_filter": "frame.number == 10780", "timestamp_epoch": "1533964900.763909000" }, { "tcp_stream": 272, "frame_number": 10781, "display_filter": "frame.number == 10781", "timestamp_epoch": "1533964900.763991000" }, { "tcp_stream": 940, "frame_number": 33999, "display_filter": "frame.number == 33999", "timestamp_epoch": "1533965157.918564000" }, { "tcp_stream": 941, "frame_number": 34002, "display_filter": "frame.number == 34002", "timestamp_epoch": "1533965157.918784000" } ], "is_private": null, "observable_id": "observable-0e180111e55812a0780becb3", "last_seen_epoch": "1533965157.918784000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964900.526430000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "bcp.crwdcntrl.net", "evidence": [ { "udp_stream": 212, "frame_number": 20064, "display_filter": "frame.number == 20064", "timestamp_epoch": "1533964964.377258000" }, { "udp_stream": 212, "frame_number": 20071, "display_filter": "frame.number == 20071", "timestamp_epoch": "1533964964.450971000" }, { "tcp_stream": 579, "frame_number": 20080, "display_filter": "frame.number == 20080", "timestamp_epoch": "1533964964.502301000" }, { "tcp_stream": 580, "frame_number": 20084, "display_filter": "frame.number == 20084", "timestamp_epoch": "1533964964.511697000" }, { "tcp_stream": 880, "frame_number": 32283, "display_filter": "frame.number == 32283", "timestamp_epoch": "1533965106.594419000" }, { "tcp_stream": 881, "frame_number": 32285, "display_filter": "frame.number == 32285", "timestamp_epoch": "1533965106.594543000" } ], "is_private": null, "observable_id": "observable-3ce86d37873aa1ed1d48cfbe", "last_seen_epoch": "1533965106.594543000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964964.377258000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "beacon-cdn.walmart.com.akadns.net", "evidence": [ { "udp_stream": 208, "frame_number": 19705, "display_filter": "frame.number == 19705", "timestamp_epoch": "1533964962.898059000" } ], "is_private": null, "observable_id": "observable-588ed136aab83456eb3f8e7a", "last_seen_epoch": "1533964962.898059000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964962.898059000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "beacon.tru.am", "evidence": [ { "udp_stream": 93, "frame_number": 8439, "display_filter": "frame.number == 8439", "timestamp_epoch": "1533964898.292183000" }, { "udp_stream": 93, "frame_number": 8506, "display_filter": "frame.number == 8506", "timestamp_epoch": "1533964898.378728000" }, { "tcp_stream": 216, "frame_number": 8555, "display_filter": "frame.number == 8555", "timestamp_epoch": "1533964898.435467000" } ], "is_private": null, "observable_id": "observable-039607d4ead2613692c45d40", "last_seen_epoch": "1533964898.435467000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964898.292183000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "beacon.walmart.com", "evidence": [ { "udp_stream": 208, "frame_number": 19654, "display_filter": "frame.number == 19654", "timestamp_epoch": "1533964962.787413000" }, { "udp_stream": 208, "frame_number": 19705, "display_filter": "frame.number == 19705", "timestamp_epoch": "1533964962.898059000" }, { "tcp_stream": 568, "frame_number": 19781, "display_filter": "frame.number == 19781", "timestamp_epoch": "1533964963.001566000" }, { "tcp_stream": 569, "frame_number": 19782, "display_filter": "frame.number == 19782", "timestamp_epoch": "1533964963.001718000" } ], "is_private": null, "observable_id": "observable-fdd558bc7afada9660d6acb1", "last_seen_epoch": "1533964963.001718000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964962.787413000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "bh.contextweb.com", "evidence": [ { "udp_stream": 246, "frame_number": 26371, "display_filter": "frame.number == 26371", "timestamp_epoch": "1533965032.576510000" }, { "udp_stream": 246, "frame_number": 26420, "display_filter": "frame.number == 26420", "timestamp_epoch": "1533965032.696494000" }, { "tcp_stream": 705, "frame_number": 26476, "display_filter": "frame.number == 26476", "timestamp_epoch": "1533965032.793471000" }, { "tcp_stream": 704, "frame_number": 26479, "display_filter": "frame.number == 26479", "timestamp_epoch": "1533965032.793850000" }, { "tcp_stream": 821, "frame_number": 30658, "display_filter": "frame.number == 30658", "timestamp_epoch": "1533965099.046863000" }, { "tcp_stream": 820, "frame_number": 30659, "display_filter": "frame.number == 30659", "timestamp_epoch": "1533965099.046897000" } ], "is_private": null, "observable_id": "observable-e5148f17e6b2740d58ed8ab7", "last_seen_epoch": "1533965099.046897000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965032.576510000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "bid.contextweb.com", "evidence": [ { "udp_stream": 144, "frame_number": 13486, "display_filter": "frame.number == 13486", "timestamp_epoch": "1533964903.479648000" }, { "udp_stream": 144, "frame_number": 13593, "display_filter": "frame.number == 13593", "timestamp_epoch": "1533964903.573032000" }, { "tcp_stream": 355, "frame_number": 13633, "display_filter": "frame.number == 13633", "timestamp_epoch": "1533964903.624634000" } ], "is_private": null, "observable_id": "observable-0f5c0dd3987f243ffa61b174", "last_seen_epoch": "1533964903.624634000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964903.479648000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "bid.g.doubleclick.net", "evidence": [ { "udp_stream": 289, "frame_number": 32650, "display_filter": "frame.number == 32650", "timestamp_epoch": "1533965134.154546000" }, { "udp_stream": 289, "frame_number": 32653, "display_filter": "frame.number == 32653", "timestamp_epoch": "1533965134.234653000" }, { "tcp_stream": 888, "frame_number": 32660, "display_filter": "frame.number == 32660", "timestamp_epoch": "1533965134.316392000" }, { "tcp_stream": 889, "frame_number": 32664, "display_filter": "frame.number == 32664", "timestamp_epoch": "1533965134.321488000" }, { "tcp_stream": 994, "frame_number": 38696, "display_filter": "frame.number == 38696", "timestamp_epoch": "1533965238.697191000" }, { "tcp_stream": 995, "frame_number": 38698, "display_filter": "frame.number == 38698", "timestamp_epoch": "1533965238.697273000" } ], "is_private": null, "observable_id": "observable-295eb88469c855b00c376e7c", "last_seen_epoch": "1533965238.697273000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965134.154546000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "bidder.criteo.com", "evidence": [ { "udp_stream": 143, "frame_number": 13464, "display_filter": "frame.number == 13464", "timestamp_epoch": "1533964903.460980000" }, { "udp_stream": 143, "frame_number": 13517, "display_filter": "frame.number == 13517", "timestamp_epoch": "1533964903.515128000" }, { "tcp_stream": 350, "frame_number": 13603, "display_filter": "frame.number == 13603", "timestamp_epoch": "1533964903.580609000" } ], "is_private": null, "observable_id": "observable-49569d00ad9a501d3e711a9f", "last_seen_epoch": "1533964903.580609000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964903.460980000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "bttrack.com", "evidence": [ { "udp_stream": 275, "frame_number": 30402, "display_filter": "frame.number == 30402", "timestamp_epoch": "1533965098.634262000" }, { "udp_stream": 275, "frame_number": 30649, "display_filter": "frame.number == 30649", "timestamp_epoch": "1533965099.045804000" }, { "tcp_stream": 829, "frame_number": 30979, "display_filter": "frame.number == 30979", "timestamp_epoch": "1533965099.657732000" }, { "tcp_stream": 828, "frame_number": 30991, "display_filter": "frame.number == 30991", "timestamp_epoch": "1533965099.664719000" } ], "is_private": null, "observable_id": "observable-cc14587a63bbb378e587abf2", "last_seen_epoch": "1533965099.664719000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965098.634262000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "c.bing.com", "evidence": [ { "udp_stream": 206, "frame_number": 19648, "display_filter": "frame.number == 19648", "timestamp_epoch": "1533964962.773029000" }, { "udp_stream": 206, "frame_number": 19673, "display_filter": "frame.number == 19673", "timestamp_epoch": "1533964962.856769000" }, { "tcp_stream": 564, "frame_number": 19753, "display_filter": "frame.number == 19753", "timestamp_epoch": "1533964962.972433000" }, { "tcp_stream": 565, "frame_number": 19773, "display_filter": "frame.number == 19773", "timestamp_epoch": "1533964963.000514000" } ], "is_private": null, "observable_id": "observable-8a95b938f3ca8ce1d9af9b6d", "last_seen_epoch": "1533964963.000514000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964962.773029000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "c1.adform.net", "evidence": [ { "udp_stream": 97, "frame_number": 8909, "display_filter": "frame.number == 8909", "timestamp_epoch": "1533964898.852948000" }, { "udp_stream": 97, "frame_number": 8972, "display_filter": "frame.number == 8972", "timestamp_epoch": "1533964898.937210000" }, { "tcp_stream": 239, "frame_number": 9121, "display_filter": "frame.number == 9121", "timestamp_epoch": "1533964899.068592000" }, { "tcp_stream": 238, "frame_number": 9156, "display_filter": "frame.number == 9156", "timestamp_epoch": "1533964899.081075000" }, { "tcp_stream": 519, "frame_number": 18603, "display_filter": "frame.number == 18603", "timestamp_epoch": "1533964959.399499000" }, { "tcp_stream": 520, "frame_number": 18604, "display_filter": "frame.number == 18604", "timestamp_epoch": "1533964959.399749000" }, { "tcp_stream": 632, "frame_number": 23357, "display_filter": "frame.number == 23357", "timestamp_epoch": "1533964997.363620000" }, { "tcp_stream": 633, "frame_number": 23372, "display_filter": "frame.number == 23372", "timestamp_epoch": "1533964997.375633000" }, { "tcp_stream": 694, "frame_number": 26437, "display_filter": "frame.number == 26437", "timestamp_epoch": "1533965032.719353000" }, { "tcp_stream": 695, "frame_number": 26443, "display_filter": "frame.number == 26443", "timestamp_epoch": "1533965032.721397000" } ], "is_private": null, "observable_id": "observable-3e636082c043f30c46c39c71", "last_seen_epoch": "1533965032.721397000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964898.852948000" }, { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "cacerts.digicert.com", "evidence": [ { "udp_stream": 236, "frame_number": 23933, "display_filter": "frame.number == 23933", "timestamp_epoch": "1533964998.322007000" }, { "udp_stream": 237, "frame_number": 23938, "display_filter": "frame.number == 23938", "timestamp_epoch": "1533964998.332011000" }, { "udp_stream": 237, "frame_number": 23970, "display_filter": "frame.number == 23970", "timestamp_epoch": "1533964998.468790000" }, { "udp_stream": 236, "frame_number": 23971, "display_filter": "frame.number == 23971", "timestamp_epoch": "1533964998.468958000" }, { "tcp_stream": 665, "frame_number": 23982, "display_filter": "frame.number == 23982", "timestamp_epoch": "1533964998.555480000" }, { "tcp_stream": 664, "frame_number": 23985, "display_filter": "frame.number == 23985", "timestamp_epoch": "1533964998.555964000" } ], "is_private": null, "observable_id": "observable-07b01bc6376db90653fd692d", "last_seen_epoch": "1533964998.555964000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964998.322007000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "cdn-na.onthe.io", "evidence": [ { "udp_stream": 349, "frame_number": 44215, "display_filter": "frame.number == 44215", "timestamp_epoch": "1533965784.462482000" } ], "is_private": null, "observable_id": "observable-7fd2b9f7ba17bd1af4deacb9", "last_seen_epoch": "1533965784.462482000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965784.462482000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "cdn-ssl.vidible.tv", "evidence": [ { "udp_stream": 194, "frame_number": 18662, "display_filter": "frame.number == 18662", "timestamp_epoch": "1533964959.545185000" }, { "udp_stream": 194, "frame_number": 18742, "display_filter": "frame.number == 18742", "timestamp_epoch": "1533964959.980701000" }, { "tcp_stream": 535, "frame_number": 18856, "display_filter": "frame.number == 18856", "timestamp_epoch": "1533964960.141466000" }, { "tcp_stream": 536, "frame_number": 18857, "display_filter": "frame.number == 18857", "timestamp_epoch": "1533964960.142493000" } ], "is_private": null, "observable_id": "observable-3ef2c5743cff9c02351ac73c", "last_seen_epoch": "1533964960.142493000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964959.545185000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "cdn.adnxs.com", "evidence": [ { "udp_stream": 203, "frame_number": 19274, "display_filter": "frame.number == 19274", "timestamp_epoch": "1533964961.688095000" }, { "udp_stream": 203, "frame_number": 19312, "display_filter": "frame.number == 19312", "timestamp_epoch": "1533964961.782585000" }, { "tcp_stream": 556, "frame_number": 19365, "display_filter": "frame.number == 19365", "timestamp_epoch": "1533964961.847417000" }, { "tcp_stream": 557, "frame_number": 19368, "display_filter": "frame.number == 19368", "timestamp_epoch": "1533964961.847994000" } ], "is_private": null, "observable_id": "observable-447080e31c06cfe2a882149e", "last_seen_epoch": "1533964961.847994000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964961.688095000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "cdn.digicertcdn.com", "evidence": [ { "udp_stream": 237, "frame_number": 23970, "display_filter": "frame.number == 23970", "timestamp_epoch": "1533964998.468790000" }, { "udp_stream": 236, "frame_number": 23971, "display_filter": "frame.number == 23971", "timestamp_epoch": "1533964998.468958000" } ], "is_private": null, "observable_id": "observable-37f64cba6c320580e3093220", "last_seen_epoch": "1533964998.468958000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964998.468790000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "cdn.doubleverify.com", "evidence": [ { "udp_stream": 292, "frame_number": 32836, "display_filter": "frame.number == 32836", "timestamp_epoch": "1533965136.002564000" }, { "udp_stream": 292, "frame_number": 32847, "display_filter": "frame.number == 32847", "timestamp_epoch": "1533965136.094373000" }, { "tcp_stream": 896, "frame_number": 32852, "display_filter": "frame.number == 32852", "timestamp_epoch": "1533965136.154989000" }, { "tcp_stream": 897, "frame_number": 32856, "display_filter": "frame.number == 32856", "timestamp_epoch": "1533965136.162089000" }, { "tcp_stream": 1014, "frame_number": 38980, "display_filter": "frame.number == 38980", "timestamp_epoch": "1533965240.725595000" }, { "tcp_stream": 1015, "frame_number": 38982, "display_filter": "frame.number == 38982", "timestamp_epoch": "1533965240.725799000" } ], "is_private": null, "observable_id": "observable-4e7524f4352ae53c36402823", "last_seen_epoch": "1533965240.725799000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965136.002564000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "cdn.jsdelivr.net", "evidence": [ { "udp_stream": 178, "frame_number": 17308, "display_filter": "frame.number == 17308", "timestamp_epoch": "1533964955.786374000" }, { "udp_stream": 178, "frame_number": 17309, "display_filter": "frame.number == 17309", "timestamp_epoch": "1533964955.900897000" }, { "tcp_stream": 491, "frame_number": 17318, "display_filter": "frame.number == 17318", "timestamp_epoch": "1533964955.947846000" }, { "tcp_stream": 492, "frame_number": 17319, "display_filter": "frame.number == 17319", "timestamp_epoch": "1533964955.947973000" } ], "is_private": null, "observable_id": "observable-f1ef276d2e5165b1376b7de6", "last_seen_epoch": "1533964955.947973000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964955.786374000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "cdn.marphezis.com", "evidence": [ { "udp_stream": 107, "frame_number": 9410, "display_filter": "frame.number == 9410", "timestamp_epoch": "1533964899.326173000" }, { "udp_stream": 107, "frame_number": 9794, "display_filter": "frame.number == 9794", "timestamp_epoch": "1533964899.640925000" }, { "tcp_stream": 264, "frame_number": 9963, "display_filter": "frame.number == 9963", "timestamp_epoch": "1533964899.757726000" }, { "tcp_stream": 265, "frame_number": 9965, "display_filter": "frame.number == 9965", "timestamp_epoch": "1533964899.757871000" } ], "is_private": null, "observable_id": "observable-698ca1b7965a743c2cf40d8b", "last_seen_epoch": "1533964899.757871000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964899.326173000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "cdn.onthe.io", "evidence": [ { "udp_stream": 349, "frame_number": 44127, "display_filter": "frame.number == 44127", "timestamp_epoch": "1533965784.244464000" }, { "udp_stream": 349, "frame_number": 44215, "display_filter": "frame.number == 44215", "timestamp_epoch": "1533965784.462482000" }, { "tcp_stream": 1167, "frame_number": 44352, "display_filter": "frame.number == 44352", "timestamp_epoch": "1533965785.008624000" }, { "tcp_stream": 1170, "frame_number": 44364, "display_filter": "frame.number == 44364", "timestamp_epoch": "1533965785.009620000" } ], "is_private": null, "observable_id": "observable-11caa9a42f5f0ef5cf7f4a52", "last_seen_epoch": "1533965785.009620000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965784.244464000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "cdn1.tass.ru", "evidence": [ { "udp_stream": 325, "frame_number": 40131, "display_filter": "frame.number == 40131", "timestamp_epoch": "1533965770.288010000" }, { "udp_stream": 325, "frame_number": 40223, "display_filter": "frame.number == 40223", "timestamp_epoch": "1533965770.569360000" }, { "tcp_stream": 1097, "frame_number": 40425, "display_filter": "frame.number == 40425", "timestamp_epoch": "1533965770.853120000" }, { "tcp_stream": 1107, "frame_number": 40437, "display_filter": "frame.number == 40437", "timestamp_epoch": "1533965770.856915000" }, { "tcp_stream": 1098, "frame_number": 40445, "display_filter": "frame.number == 40445", "timestamp_epoch": "1533965770.857931000" }, { "tcp_stream": 1106, "frame_number": 40449, "display_filter": "frame.number == 40449", "timestamp_epoch": "1533965770.860090000" }, { "tcp_stream": 1105, "frame_number": 40453, "display_filter": "frame.number == 40453", "timestamp_epoch": "1533965770.862012000" }, { "tcp_stream": 1101, "frame_number": 40457, "display_filter": "frame.number == 40457", "timestamp_epoch": "1533965770.865615000" }, { "tcp_stream": 1116, "frame_number": 40959, "display_filter": "frame.number == 40959", "timestamp_epoch": "1533965773.747726000" } ], "is_private": null, "observable_id": "observable-8f5e8915ac6812872d813d28", "last_seen_epoch": "1533965773.747726000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965770.288010000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "cdn2.tass.ru", "evidence": [ { "udp_stream": 327, "frame_number": 40133, "display_filter": "frame.number == 40133", "timestamp_epoch": "1533965770.289999000" }, { "udp_stream": 327, "frame_number": 40215, "display_filter": "frame.number == 40215", "timestamp_epoch": "1533965770.562042000" }, { "tcp_stream": 1084, "frame_number": 40305, "display_filter": "frame.number == 40305", "timestamp_epoch": "1533965770.800734000" }, { "tcp_stream": 1085, "frame_number": 40317, "display_filter": "frame.number == 40317", "timestamp_epoch": "1533965770.802376000" }, { "tcp_stream": 1086, "frame_number": 40318, "display_filter": "frame.number == 40318", "timestamp_epoch": "1533965770.802377000" }, { "tcp_stream": 1088, "frame_number": 40329, "display_filter": "frame.number == 40329", "timestamp_epoch": "1533965770.808469000" }, { "tcp_stream": 1089, "frame_number": 40337, "display_filter": "frame.number == 40337", "timestamp_epoch": "1533965770.810276000" }, { "tcp_stream": 1087, "frame_number": 40405, "display_filter": "frame.number == 40405", "timestamp_epoch": "1533965770.823596000" }, { "tcp_stream": 1118, "frame_number": 40955, "display_filter": "frame.number == 40955", "timestamp_epoch": "1533965773.747177000" }, { "tcp_stream": 1115, "frame_number": 40957, "display_filter": "frame.number == 40957", "timestamp_epoch": "1533965773.747380000" }, { "tcp_stream": 1125, "frame_number": 41162, "display_filter": "frame.number == 41162", "timestamp_epoch": "1533965772.399571000" } ], "is_private": null, "observable_id": "observable-3d588cad94e0883438b1d29c", "last_seen_epoch": "1533965773.747380000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965770.289999000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "cdn3.doubleverify.com", "evidence": [ { "udp_stream": 294, "frame_number": 32943, "display_filter": "frame.number == 32943", "timestamp_epoch": "1533965136.507812000" }, { "udp_stream": 294, "frame_number": 32947, "display_filter": "frame.number == 32947", "timestamp_epoch": "1533965136.618382000" }, { "tcp_stream": 898, "frame_number": 32960, "display_filter": "frame.number == 32960", "timestamp_epoch": "1533965136.671813000" }, { "tcp_stream": 899, "frame_number": 32968, "display_filter": "frame.number == 32968", "timestamp_epoch": "1533965136.717908000" } ], "is_private": null, "observable_id": "observable-a77e611ca230b53dfbc16ba5", "last_seen_epoch": "1533965136.717908000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965136.507812000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "cdni.rt.com", "evidence": [ { "udp_stream": 33, "frame_number": 599, "display_filter": "frame.number == 599", "timestamp_epoch": "1533964545.580055000" }, { "udp_stream": 33, "frame_number": 649, "display_filter": "frame.number == 649", "timestamp_epoch": "1533964545.745951000" }, { "tcp_stream": 53, "frame_number": 692, "display_filter": "frame.number == 692", "timestamp_epoch": "1533964545.823140000" }, { "tcp_stream": 54, "frame_number": 696, "display_filter": "frame.number == 696", "timestamp_epoch": "1533964545.823802000" }, { "tcp_stream": 56, "frame_number": 698, "display_filter": "frame.number == 698", "timestamp_epoch": "1533964545.824007000" }, { "tcp_stream": 55, "frame_number": 699, "display_filter": "frame.number == 699", "timestamp_epoch": "1533964545.824041000" }, { "tcp_stream": 57, "frame_number": 702, "display_filter": "frame.number == 702", "timestamp_epoch": "1533964545.824352000" }, { "tcp_stream": 58, "frame_number": 704, "display_filter": "frame.number == 704", "timestamp_epoch": "1533964545.824437000" }, { "tcp_stream": 59, "frame_number": 1264, "display_filter": "frame.number == 1264", "timestamp_epoch": "1533964546.538622000" }, { "tcp_stream": 60, "frame_number": 1266, "display_filter": "frame.number == 1266", "timestamp_epoch": "1533964546.538863000" }, { "tcp_stream": 62, "frame_number": 2255, "display_filter": "frame.number == 2255", "timestamp_epoch": "1533964549.224979000" }, { "tcp_stream": 61, "frame_number": 2257, "display_filter": "frame.number == 2257", "timestamp_epoch": "1533964549.225497000" }, { "tcp_stream": 63, "frame_number": 2381, "display_filter": "frame.number == 2381", "timestamp_epoch": "1533964549.653129000" }, { "tcp_stream": 188, "frame_number": 7493, "display_filter": "frame.number == 7493", "timestamp_epoch": "1533964897.294499000" }, { "tcp_stream": 190, "frame_number": 7501, "display_filter": "frame.number == 7501", "timestamp_epoch": "1533964897.294992000" }, { "tcp_stream": 191, "frame_number": 7503, "display_filter": "frame.number == 7503", "timestamp_epoch": "1533964897.295172000" }, { "tcp_stream": 189, "frame_number": 7505, "display_filter": "frame.number == 7505", "timestamp_epoch": "1533964897.295174000" }, { "tcp_stream": 193, "frame_number": 7511, "display_filter": "frame.number == 7511", "timestamp_epoch": "1533964897.295895000" }, { "tcp_stream": 192, "frame_number": 7513, "display_filter": "frame.number == 7513", "timestamp_epoch": "1533964897.295919000" } ], "is_private": null, "observable_id": "observable-b1a30670a41ae63ba2bc4482", "last_seen_epoch": "1533964897.295919000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964545.580055000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "cds.n3g2w2j5.hwcdn.net", "evidence": [ { "udp_stream": 160, "frame_number": 15186, "display_filter": "frame.number == 15186", "timestamp_epoch": "1533964906.152257000" } ], "is_private": null, "observable_id": "observable-68cdfeacc780f8eb6173581c", "last_seen_epoch": "1533964906.152257000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964906.152257000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "cds.p5q6b2e4.hwcdn.net", "evidence": [ { "udp_stream": 90, "frame_number": 7515, "display_filter": "frame.number == 7515", "timestamp_epoch": "1533964897.312123000" } ], "is_private": null, "observable_id": "observable-1359ffe062d1480e3e999067", "last_seen_epoch": "1533964897.312123000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964897.312123000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "ce.lijit.com", "evidence": [ { "udp_stream": 284, "frame_number": 31610, "display_filter": "frame.number == 31610", "timestamp_epoch": "1533965100.695463000" }, { "udp_stream": 284, "frame_number": 31672, "display_filter": "frame.number == 31672", "timestamp_epoch": "1533965100.795928000" }, { "tcp_stream": 862, "frame_number": 31788, "display_filter": "frame.number == 31788", "timestamp_epoch": "1533965100.899662000" }, { "tcp_stream": 861, "frame_number": 31801, "display_filter": "frame.number == 31801", "timestamp_epoch": "1533965100.912659000" } ], "is_private": null, "observable_id": "observable-54bf5b371f538e33b544ef53", "last_seen_epoch": "1533965100.912659000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965100.695463000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "cm.adform.net", "evidence": [ { "udp_stream": 235, "frame_number": 23570, "display_filter": "frame.number == 23570", "timestamp_epoch": "1533964997.745243000" }, { "udp_stream": 235, "frame_number": 23649, "display_filter": "frame.number == 23649", "timestamp_epoch": "1533964997.831687000" }, { "tcp_stream": 660, "frame_number": 23834, "display_filter": "frame.number == 23834", "timestamp_epoch": "1533964998.080510000" }, { "tcp_stream": 661, "frame_number": 23835, "display_filter": "frame.number == 23835", "timestamp_epoch": "1533964998.080847000" } ], "is_private": null, "observable_id": "observable-21ca2fb53ad396b752303c24", "last_seen_epoch": "1533964998.080847000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964997.745243000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "cm.adgrx.com", "evidence": [ { "udp_stream": 276, "frame_number": 30492, "display_filter": "frame.number == 30492", "timestamp_epoch": "1533965098.783727000" }, { "udp_stream": 276, "frame_number": 30803, "display_filter": "frame.number == 30803", "timestamp_epoch": "1533965099.278838000" }, { "tcp_stream": 838, "frame_number": 31187, "display_filter": "frame.number == 31187", "timestamp_epoch": "1533965100.008452000" }, { "tcp_stream": 839, "frame_number": 31191, "display_filter": "frame.number == 31191", "timestamp_epoch": "1533965100.008832000" } ], "is_private": null, "observable_id": "observable-a880cd9083cb15bddfbce855", "last_seen_epoch": "1533965100.008832000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965098.783727000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "cm.eyereturn.com", "evidence": [ { "udp_stream": 299, "frame_number": 33838, "display_filter": "frame.number == 33838", "timestamp_epoch": "1533965157.679632000" }, { "udp_stream": 299, "frame_number": 33923, "display_filter": "frame.number == 33923", "timestamp_epoch": "1533965157.846245000" }, { "tcp_stream": 942, "frame_number": 34027, "display_filter": "frame.number == 34027", "timestamp_epoch": "1533965157.936377000" }, { "tcp_stream": 943, "frame_number": 34028, "display_filter": "frame.number == 34028", "timestamp_epoch": "1533965157.936486000" } ], "is_private": null, "observable_id": "observable-5d78dc8fd8aadddcc222e2d5", "last_seen_epoch": "1533965157.936486000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965157.679632000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "cm.g.doubleclick.net", "evidence": [ { "udp_stream": 66, "frame_number": 5083, "display_filter": "frame.number == 5083", "timestamp_epoch": "1533964555.923820000" }, { "udp_stream": 66, "frame_number": 5140, "display_filter": "frame.number == 5140", "timestamp_epoch": "1533964556.025417000" }, { "udp_stream": 362, "frame_number": 45976, "display_filter": "frame.number == 45976", "timestamp_epoch": "1533965789.422175000" }, { "udp_stream": 362, "frame_number": 46032, "display_filter": "frame.number == 46032", "timestamp_epoch": "1533965789.555893000" }, { "tcp_stream": 124, "frame_number": 5207, "display_filter": "frame.number == 5207", "timestamp_epoch": "1533964556.093107000" }, { "tcp_stream": 121, "frame_number": 5212, "display_filter": "frame.number == 5212", "timestamp_epoch": "1533964556.093986000" }, { "tcp_stream": 301, "frame_number": 11522, "display_filter": "frame.number == 11522", "timestamp_epoch": "1533964901.338831000" }, { "tcp_stream": 298, "frame_number": 11523, "display_filter": "frame.number == 11523", "timestamp_epoch": "1533964901.339056000" }, { "tcp_stream": 299, "frame_number": 11524, "display_filter": "frame.number == 11524", "timestamp_epoch": "1533964901.339078000" }, { "tcp_stream": 300, "frame_number": 11525, "display_filter": "frame.number == 11525", "timestamp_epoch": "1533964901.339204000" }, { "tcp_stream": 1211, "frame_number": 46067, "display_filter": "frame.number == 46067", "timestamp_epoch": "1533965789.689201000" }, { "tcp_stream": 1212, "frame_number": 46069, "display_filter": "frame.number == 46069", "timestamp_epoch": "1533965789.689556000" }, { "tcp_stream": 1213, "frame_number": 46073, "display_filter": "frame.number == 46073", "timestamp_epoch": "1533965789.693703000" } ], "is_private": null, "observable_id": "observable-0b1c758fb28c330e7f0867c0", "last_seen_epoch": "1533965789.693703000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964555.923820000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "cms.quantserve.com", "evidence": [ { "udp_stream": 231, "frame_number": 23547, "display_filter": "frame.number == 23547", "timestamp_epoch": "1533964997.685605000" }, { "udp_stream": 231, "frame_number": 23599, "display_filter": "frame.number == 23599", "timestamp_epoch": "1533964997.757167000" }, { "tcp_stream": 652, "frame_number": 23673, "display_filter": "frame.number == 23673", "timestamp_epoch": "1533964997.857707000" }, { "tcp_stream": 651, "frame_number": 23676, "display_filter": "frame.number == 23676", "timestamp_epoch": "1533964997.858143000" }, { "tcp_stream": 815, "frame_number": 30646, "display_filter": "frame.number == 30646", "timestamp_epoch": "1533965099.045323000" }, { "tcp_stream": 814, "frame_number": 30654, "display_filter": "frame.number == 30654", "timestamp_epoch": "1533965099.046221000" } ], "is_private": null, "observable_id": "observable-068a6da0bb79c5358c41de74", "last_seen_epoch": "1533965099.046221000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964997.685605000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "code.createjs.com", "evidence": [ { "udp_stream": 132, "frame_number": 12096, "display_filter": "frame.number == 12096", "timestamp_epoch": "1533964901.899258000" }, { "udp_stream": 132, "frame_number": 12260, "display_filter": "frame.number == 12260", "timestamp_epoch": "1533964902.009546000" }, { "tcp_stream": 323, "frame_number": 12427, "display_filter": "frame.number == 12427", "timestamp_epoch": "1533964902.276965000" }, { "tcp_stream": 322, "frame_number": 12429, "display_filter": "frame.number == 12429", "timestamp_epoch": "1533964902.277117000" } ], "is_private": null, "observable_id": "observable-46e299f63770703c45b1fe13", "last_seen_epoch": "1533964902.277117000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964901.899258000" }, { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "comet.tass.ru", "evidence": [ { "udp_stream": 193, "frame_number": 44492, "display_filter": "frame.number == 44492", "timestamp_epoch": "1533965785.481508000" }, { "udp_stream": 193, "frame_number": 44698, "display_filter": "frame.number == 44698", "timestamp_epoch": "1533965786.043507000" }, { "tcp_stream": 1186, "frame_number": 44900, "display_filter": "frame.number == 44900", "timestamp_epoch": "1533965786.473054000" } ], "is_private": null, "observable_id": "observable-bb30103ef150f09e844062d3", "last_seen_epoch": "1533965786.473054000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965785.481508000" }, { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "connect.facebook.net", "evidence": [ { "udp_stream": 342, "frame_number": 43646, "display_filter": "frame.number == 43646", "timestamp_epoch": "1533965783.030794000" }, { "udp_stream": 342, "frame_number": 43674, "display_filter": "frame.number == 43674", "timestamp_epoch": "1533965783.128458000" }, { "tcp_stream": 1151, "frame_number": 43690, "display_filter": "frame.number == 43690", "timestamp_epoch": "1533965783.175343000" } ], "is_private": null, "observable_id": "observable-7bba686247a58a37aa55c593", "last_seen_epoch": "1533965783.175343000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965783.030794000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "contextual.media.net", "evidence": [ { "udp_stream": 152, "frame_number": 14557, "display_filter": "frame.number == 14557", "timestamp_epoch": "1533964904.585739000" }, { "udp_stream": 152, "frame_number": 14656, "display_filter": "frame.number == 14656", "timestamp_epoch": "1533964904.683765000" }, { "tcp_stream": 407, "frame_number": 14772, "display_filter": "frame.number == 14772", "timestamp_epoch": "1533964904.749793000" }, { "tcp_stream": 408, "frame_number": 14781, "display_filter": "frame.number == 14781", "timestamp_epoch": "1533964904.752200000" }, { "tcp_stream": 849, "frame_number": 31660, "display_filter": "frame.number == 31660", "timestamp_epoch": "1533965100.791749000" }, { "tcp_stream": 850, "frame_number": 31661, "display_filter": "frame.number == 31661", "timestamp_epoch": "1533965100.791899000" } ], "is_private": null, "observable_id": "observable-11b3d20f8a01d79ad42e0f41", "last_seen_epoch": "1533965100.791899000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964904.585739000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "cookie.brealtime.com", "evidence": [ { "udp_stream": 245, "frame_number": 26370, "display_filter": "frame.number == 26370", "timestamp_epoch": "1533965032.574941000" }, { "udp_stream": 245, "frame_number": 26408, "display_filter": "frame.number == 26408", "timestamp_epoch": "1533965032.676936000" }, { "tcp_stream": 700, "frame_number": 26466, "display_filter": "frame.number == 26466", "timestamp_epoch": "1533965032.790959000" }, { "tcp_stream": 701, "frame_number": 26469, "display_filter": "frame.number == 26469", "timestamp_epoch": "1533965032.792859000" } ], "is_private": null, "observable_id": "observable-1b0dd5551415606cbe457769", "last_seen_epoch": "1533965032.792859000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965032.574941000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "cookie.brealtime.com.cdn.cloudflare.net", "evidence": [ { "udp_stream": 245, "frame_number": 26408, "display_filter": "frame.number == 26408", "timestamp_epoch": "1533965032.676936000" } ], "is_private": null, "observable_id": "observable-2c0ea2d53f7116a86e70db76", "last_seen_epoch": "1533965032.676936000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965032.676936000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "cookiesyncing-1395500543.us-east-1.elb.amazonaws.com", "evidence": [ { "udp_stream": 250, "frame_number": 26727, "display_filter": "frame.number == 26727", "timestamp_epoch": "1533965033.481280000" } ], "is_private": null, "observable_id": "observable-23afc23031aa020c2ceaffb3", "last_seen_epoch": "1533965033.481280000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965033.481280000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "cookiex.ngd.yahoo.com", "evidence": [ { "udp_stream": 85, "frame_number": 6262, "display_filter": "frame.number == 6262", "timestamp_epoch": "1533964560.225311000" }, { "udp_stream": 85, "frame_number": 6273, "display_filter": "frame.number == 6273", "timestamp_epoch": "1533964560.304978000" }, { "tcp_stream": 160, "frame_number": 6299, "display_filter": "frame.number == 6299", "timestamp_epoch": "1533964560.408414000" }, { "tcp_stream": 161, "frame_number": 6301, "display_filter": "frame.number == 6301", "timestamp_epoch": "1533964560.408600000" }, { "tcp_stream": 483, "frame_number": 16846, "display_filter": "frame.number == 16846", "timestamp_epoch": "1533964910.795788000" }, { "tcp_stream": 484, "frame_number": 16849, "display_filter": "frame.number == 16849", "timestamp_epoch": "1533964910.796568000" } ], "is_private": null, "observable_id": "observable-675e39910228b5dfa2e4c4be", "last_seen_epoch": "1533964910.796568000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964560.225311000" }, { "type": "domain", "roles": [ "dns-query", "http-host", "tls-sni" ], "value": "counter.yadro.ru", "evidence": [ { "udp_stream": 49, "frame_number": 3210, "display_filter": "frame.number == 3210", "timestamp_epoch": "1533964552.428838000" }, { "udp_stream": 49, "frame_number": 3296, "display_filter": "frame.number == 3296", "timestamp_epoch": "1533964552.626454000" }, { "udp_stream": 340, "frame_number": 43641, "display_filter": "frame.number == 43641", "timestamp_epoch": "1533965783.022652000" }, { "udp_stream": 340, "frame_number": 43654, "display_filter": "frame.number == 43654", "timestamp_epoch": "1533965783.076721000" }, { "tcp_stream": 1143, "frame_number": 43744, "display_filter": "frame.number == 43744", "timestamp_epoch": "1533965783.328334000" }, { "tcp_stream": 1144, "frame_number": 43748, "display_filter": "frame.number == 43748", "timestamp_epoch": "1533965783.334711000" }, { "tcp_stream": 83, "frame_number": 3529, "display_filter": "frame.number == 3529", "timestamp_epoch": "1533964552.955577000" }, { "tcp_stream": 82, "frame_number": 3536, "display_filter": "frame.number == 3536", "timestamp_epoch": "1533964552.957535000" }, { "tcp_stream": 209, "frame_number": 8485, "display_filter": "frame.number == 8485", "timestamp_epoch": "1533964898.334174000" }, { "tcp_stream": 208, "frame_number": 8497, "display_filter": "frame.number == 8497", "timestamp_epoch": "1533964898.346644000" } ], "is_private": null, "observable_id": "observable-984aee067a4f012bc805745f", "last_seen_epoch": "1533965783.334711000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964552.428838000" }, { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "crt.comodoca.com", "evidence": [ { "udp_stream": 120, "frame_number": 11334, "display_filter": "frame.number == 11334", "timestamp_epoch": "1533964901.171968000" }, { "udp_stream": 121, "frame_number": 11335, "display_filter": "frame.number == 11335", "timestamp_epoch": "1533964901.173416000" }, { "udp_stream": 121, "frame_number": 11428, "display_filter": "frame.number == 11428", "timestamp_epoch": "1533964901.270602000" }, { "udp_stream": 120, "frame_number": 11429, "display_filter": "frame.number == 11429", "timestamp_epoch": "1533964901.270707000" }, { "tcp_stream": 296, "frame_number": 11487, "display_filter": "frame.number == 11487", "timestamp_epoch": "1533964901.324527000" }, { "tcp_stream": 297, "frame_number": 11488, "display_filter": "frame.number == 11488", "timestamp_epoch": "1533964901.324607000" } ], "is_private": null, "observable_id": "observable-2349944df038289ddc008eb0", "last_seen_epoch": "1533964901.324607000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964901.171968000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "crt.comodoca.com.cdn.cloudflare.net", "evidence": [ { "udp_stream": 121, "frame_number": 11428, "display_filter": "frame.number == 11428", "timestamp_epoch": "1533964901.270602000" }, { "udp_stream": 120, "frame_number": 11429, "display_filter": "frame.number == 11429", "timestamp_epoch": "1533964901.270707000" } ], "is_private": null, "observable_id": "observable-f54b1e1823352d1a1eb5d287", "last_seen_epoch": "1533964901.270707000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964901.270602000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "cs.adingo.jp", "evidence": [ { "udp_stream": 304, "frame_number": 35495, "display_filter": "frame.number == 35495", "timestamp_epoch": "1533965160.271382000" }, { "udp_stream": 304, "frame_number": 35517, "display_filter": "frame.number == 35517", "timestamp_epoch": "1533965160.353225000" }, { "tcp_stream": 959, "frame_number": 35639, "display_filter": "frame.number == 35639", "timestamp_epoch": "1533965160.501178000" }, { "tcp_stream": 958, "frame_number": 35655, "display_filter": "frame.number == 35655", "timestamp_epoch": "1533965160.512260000" } ], "is_private": null, "observable_id": "observable-8191c7cc91a36f601f6d72cd", "last_seen_epoch": "1533965160.512260000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965160.271382000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "cs574.wpc.edgecastcdn.net", "evidence": [ { "udp_stream": 214, "frame_number": 20116, "display_filter": "frame.number == 20116", "timestamp_epoch": "1533964964.705871000" } ], "is_private": null, "observable_id": "observable-01bc0161b78878e280ebfe87", "last_seen_epoch": "1533964964.705871000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964964.705871000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "cs84.wac.edgecastcdn.net", "evidence": [ { "udp_stream": 204, "frame_number": 19335, "display_filter": "frame.number == 19335", "timestamp_epoch": "1533964961.815071000" } ], "is_private": null, "observable_id": "observable-07238b9b5823a2ddba1f7aff", "last_seen_epoch": "1533964961.815071000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964961.815071000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "csi.gstatic.com", "evidence": [ { "udp_stream": 151, "frame_number": 14517, "display_filter": "frame.number == 14517", "timestamp_epoch": "1533964904.556113000" }, { "udp_stream": 151, "frame_number": 14626, "display_filter": "frame.number == 14626", "timestamp_epoch": "1533964904.641770000" }, { "tcp_stream": 400, "frame_number": 14869, "display_filter": "frame.number == 14869", "timestamp_epoch": "1533964904.839279000" }, { "tcp_stream": 399, "frame_number": 14870, "display_filter": "frame.number == 14870", "timestamp_epoch": "1533964904.839407000" } ], "is_private": null, "observable_id": "observable-9fcbd8a9e74af65c74f74d50", "last_seen_epoch": "1533964904.839407000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964904.556113000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "d3f7zc5bbfci5.cloudfront.net", "evidence": [ { "udp_stream": 72, "frame_number": 5857, "display_filter": "frame.number == 5857", "timestamp_epoch": "1533964559.422782000" } ], "is_private": null, "observable_id": "observable-f7f8934debb864d5857db0e2", "last_seen_epoch": "1533964559.422782000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964559.422782000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "d5p.de17a.com", "evidence": [ { "udp_stream": 243, "frame_number": 35499, "display_filter": "frame.number == 35499", "timestamp_epoch": "1533965160.272196000" }, { "udp_stream": 243, "frame_number": 35522, "display_filter": "frame.number == 35522", "timestamp_epoch": "1533965160.354549000" }, { "tcp_stream": 962, "frame_number": 35688, "display_filter": "frame.number == 35688", "timestamp_epoch": "1533965160.566666000" }, { "tcp_stream": 960, "frame_number": 35689, "display_filter": "frame.number == 35689", "timestamp_epoch": "1533965160.566812000" } ], "is_private": null, "observable_id": "observable-a571e9fad414646fbe746f75", "last_seen_epoch": "1533965160.566812000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965160.272196000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "da4pli3l5vc0d.cloudfront.net", "evidence": [ { "udp_stream": 213, "frame_number": 20088, "display_filter": "frame.number == 20088", "timestamp_epoch": "1533964964.561974000" }, { "udp_stream": 213, "frame_number": 20107, "display_filter": "frame.number == 20107", "timestamp_epoch": "1533964964.633293000" }, { "tcp_stream": 581, "frame_number": 20127, "display_filter": "frame.number == 20127", "timestamp_epoch": "1533964964.714903000" }, { "tcp_stream": 582, "frame_number": 20131, "display_filter": "frame.number == 20131", "timestamp_epoch": "1533964964.723599000" }, { "tcp_stream": 786, "frame_number": 28749, "display_filter": "frame.number == 28749", "timestamp_epoch": "1533965094.697438000" }, { "tcp_stream": 787, "frame_number": 28753, "display_filter": "frame.number == 28753", "timestamp_epoch": "1533965094.701744000" }, { "tcp_stream": 927, "frame_number": 33665, "display_filter": "frame.number == 33665", "timestamp_epoch": "1533965157.318244000" }, { "tcp_stream": 926, "frame_number": 33671, "display_filter": "frame.number == 33671", "timestamp_epoch": "1533965157.319578000" }, { "tcp_stream": 984, "frame_number": 37020, "display_filter": "frame.number == 37020", "timestamp_epoch": "1533965220.199143000" }, { "tcp_stream": 983, "frame_number": 37021, "display_filter": "frame.number == 37021", "timestamp_epoch": "1533965220.199145000" } ], "is_private": null, "observable_id": "observable-e49397f353a16eaec241c135", "last_seen_epoch": "1533965220.199145000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964964.561974000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "delivery-us-west-1.openx.net", "evidence": [ { "udp_stream": 119, "frame_number": 11119, "display_filter": "frame.number == 11119", "timestamp_epoch": "1533964901.057490000" }, { "udp_stream": 119, "frame_number": 11261, "display_filter": "frame.number == 11261", "timestamp_epoch": "1533964901.134370000" }, { "tcp_stream": 291, "frame_number": 11389, "display_filter": "frame.number == 11389", "timestamp_epoch": "1533964901.234054000" }, { "tcp_stream": 290, "frame_number": 11391, "display_filter": "frame.number == 11391", "timestamp_epoch": "1533964901.234373000" } ], "is_private": null, "observable_id": "observable-7d44eb5958550b1af1bf4f38", "last_seen_epoch": "1533964901.234373000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964901.057490000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "delivery.h.switchadhub.com", "evidence": [ { "udp_stream": 302, "frame_number": 35493, "display_filter": "frame.number == 35493", "timestamp_epoch": "1533965160.270758000" }, { "udp_stream": 302, "frame_number": 35521, "display_filter": "frame.number == 35521", "timestamp_epoch": "1533965160.354413000" }, { "tcp_stream": 961, "frame_number": 35583, "display_filter": "frame.number == 35583", "timestamp_epoch": "1533965160.404895000" }, { "tcp_stream": 964, "frame_number": 35587, "display_filter": "frame.number == 35587", "timestamp_epoch": "1533965160.424069000" } ], "is_private": null, "observable_id": "observable-3aab5fd9383dd7dd0efe87cf", "last_seen_epoch": "1533965160.424069000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965160.270758000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "dh.serving-sys.com", "evidence": [ { "udp_stream": 261, "frame_number": 27305, "display_filter": "frame.number == 27305", "timestamp_epoch": "1533965035.353791000" }, { "udp_stream": 261, "frame_number": 27339, "display_filter": "frame.number == 27339", "timestamp_epoch": "1533965035.445254000" }, { "tcp_stream": 747, "frame_number": 27512, "display_filter": "frame.number == 27512", "timestamp_epoch": "1533965035.687150000" }, { "tcp_stream": 744, "frame_number": 27514, "display_filter": "frame.number == 27514", "timestamp_epoch": "1533965035.687423000" } ], "is_private": null, "observable_id": "observable-57144f135b27540fb905e6a0", "last_seen_epoch": "1533965035.687423000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965035.353791000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "dis.criteo.com", "evidence": [ { "udp_stream": 167, "frame_number": 15982, "display_filter": "frame.number == 15982", "timestamp_epoch": "1533964908.334286000" }, { "udp_stream": 167, "frame_number": 15991, "display_filter": "frame.number == 15991", "timestamp_epoch": "1533964908.383676000" }, { "tcp_stream": 449, "frame_number": 16074, "display_filter": "frame.number == 16074", "timestamp_epoch": "1533964908.456604000" }, { "tcp_stream": 450, "frame_number": 16081, "display_filter": "frame.number == 16081", "timestamp_epoch": "1533964908.458723000" }, { "tcp_stream": 645, "frame_number": 23592, "display_filter": "frame.number == 23592", "timestamp_epoch": "1533964997.753641000" }, { "tcp_stream": 646, "frame_number": 23601, "display_filter": "frame.number == 23601", "timestamp_epoch": "1533964997.759410000" } ], "is_private": null, "observable_id": "observable-15fda4888440cb6341a63462", "last_seen_epoch": "1533964997.759410000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964908.334286000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "dmp-pixel.aolp-prd.public.aol.com", "evidence": [ { "udp_stream": 102, "frame_number": 8976, "display_filter": "frame.number == 8976", "timestamp_epoch": "1533964898.938935000" } ], "is_private": null, "observable_id": "observable-b2c8ba48117917e32ca40b63", "last_seen_epoch": "1533964898.938935000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964898.938935000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "dmp.brand-display.com", "evidence": [ { "udp_stream": 225, "frame_number": 23095, "display_filter": "frame.number == 23095", "timestamp_epoch": "1533964996.653876000" }, { "udp_stream": 225, "frame_number": 23149, "display_filter": "frame.number == 23149", "timestamp_epoch": "1533964996.948203000" }, { "tcp_stream": 622, "frame_number": 23243, "display_filter": "frame.number == 23243", "timestamp_epoch": "1533964997.187628000" }, { "tcp_stream": 623, "frame_number": 23263, "display_filter": "frame.number == 23263", "timestamp_epoch": "1533964997.192337000" } ], "is_private": null, "observable_id": "observable-c59d0140ccf47ff5a187766b", "last_seen_epoch": "1533964997.192337000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964996.653876000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "dpm.demdex.net", "evidence": [ { "udp_stream": 173, "frame_number": 16523, "display_filter": "frame.number == 16523", "timestamp_epoch": "1533964909.665205000" }, { "udp_stream": 173, "frame_number": 16524, "display_filter": "frame.number == 16524", "timestamp_epoch": "1533964909.718959000" }, { "tcp_stream": 468, "frame_number": 16534, "display_filter": "frame.number == 16534", "timestamp_epoch": "1533964909.914087000" }, { "tcp_stream": 467, "frame_number": 16536, "display_filter": "frame.number == 16536", "timestamp_epoch": "1533964909.916198000" } ], "is_private": null, "observable_id": "observable-2809cf331a30704ba222b1d7", "last_seen_epoch": "1533964909.916198000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964909.665205000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "dsp.adfarm1.adition.com", "evidence": [ { "udp_stream": 301, "frame_number": 35492, "display_filter": "frame.number == 35492", "timestamp_epoch": "1533965160.270599000" }, { "udp_stream": 301, "frame_number": 35520, "display_filter": "frame.number == 35520", "timestamp_epoch": "1533965160.354275000" }, { "tcp_stream": 963, "frame_number": 35706, "display_filter": "frame.number == 35706", "timestamp_epoch": "1533965160.580828000" }, { "tcp_stream": 965, "frame_number": 35714, "display_filter": "frame.number == 35714", "timestamp_epoch": "1533965160.600800000" } ], "is_private": null, "observable_id": "observable-ad5003ef9f1e588efc65b737", "last_seen_epoch": "1533965160.600800000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965160.270599000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "dsp.adkernel.com", "evidence": [ { "udp_stream": 283, "frame_number": 31609, "display_filter": "frame.number == 31609", "timestamp_epoch": "1533965100.695251000" }, { "udp_stream": 283, "frame_number": 31670, "display_filter": "frame.number == 31670", "timestamp_epoch": "1533965100.795818000" }, { "tcp_stream": 858, "frame_number": 31835, "display_filter": "frame.number == 31835", "timestamp_epoch": "1533965100.980563000" }, { "tcp_stream": 860, "frame_number": 31838, "display_filter": "frame.number == 31838", "timestamp_epoch": "1533965100.980923000" } ], "is_private": null, "observable_id": "observable-8646a5337888a87dad23dd8c", "last_seen_epoch": "1533965100.980923000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965100.695251000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "dsum-sec.casalemedia.com", "evidence": [ { "udp_stream": 256, "frame_number": 27296, "display_filter": "frame.number == 27296", "timestamp_epoch": "1533965035.302382000" }, { "udp_stream": 256, "frame_number": 27329, "display_filter": "frame.number == 27329", "timestamp_epoch": "1533965035.426932000" }, { "tcp_stream": 741, "frame_number": 27376, "display_filter": "frame.number == 27376", "timestamp_epoch": "1533965035.517921000" }, { "tcp_stream": 740, "frame_number": 27377, "display_filter": "frame.number == 27377", "timestamp_epoch": "1533965035.518005000" } ], "is_private": null, "observable_id": "observable-d34ac1f2a7e7cf5d1ea80d22", "last_seen_epoch": "1533965035.518005000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965035.302382000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "dxedge-prod-lb-1585771072.us-west-2.elb.amazonaws.com", "evidence": [ { "udp_stream": 156, "frame_number": 14613, "display_filter": "frame.number == 14613", "timestamp_epoch": "1533964904.637787000" }, { "udp_stream": 222, "frame_number": 23033, "display_filter": "frame.number == 23033", "timestamp_epoch": "1533964996.474799000" } ], "is_private": null, "observable_id": "observable-e1875a4ebf86af6a156c04e5", "last_seen_epoch": "1533964996.474799000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964904.637787000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "e.nexac.com", "evidence": [ { "udp_stream": 264, "frame_number": 27454, "display_filter": "frame.number == 27454", "timestamp_epoch": "1533965035.627357000" }, { "udp_stream": 264, "frame_number": 27522, "display_filter": "frame.number == 27522", "timestamp_epoch": "1533965035.690340000" }, { "tcp_stream": 754, "frame_number": 27635, "display_filter": "frame.number == 27635", "timestamp_epoch": "1533965035.790889000" }, { "tcp_stream": 759, "frame_number": 27640, "display_filter": "frame.number == 27640", "timestamp_epoch": "1533965035.799446000" } ], "is_private": null, "observable_id": "observable-e9e3fbf0c31897f0b325f0f2", "last_seen_epoch": "1533965035.799446000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965035.627357000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "e1.emxdgt.com", "evidence": [ { "udp_stream": 233, "frame_number": 23568, "display_filter": "frame.number == 23568", "timestamp_epoch": "1533964997.737064000" }, { "udp_stream": 233, "frame_number": 23633, "display_filter": "frame.number == 23633", "timestamp_epoch": "1533964997.811829000" }, { "tcp_stream": 657, "frame_number": 23754, "display_filter": "frame.number == 23754", "timestamp_epoch": "1533964997.960598000" }, { "tcp_stream": 656, "frame_number": 23762, "display_filter": "frame.number == 23762", "timestamp_epoch": "1533964997.972200000" } ], "is_private": null, "observable_id": "observable-43f6b6cbc03ab8c8d6eb3b59", "last_seen_epoch": "1533964997.972200000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964997.737064000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "eb2.3lift.com", "evidence": [ { "udp_stream": 259, "frame_number": 27303, "display_filter": "frame.number == 27303", "timestamp_epoch": "1533965035.335816000" }, { "udp_stream": 259, "frame_number": 27332, "display_filter": "frame.number == 27332", "timestamp_epoch": "1533965035.434545000" }, { "tcp_stream": 742, "frame_number": 27436, "display_filter": "frame.number == 27436", "timestamp_epoch": "1533965035.590273000" }, { "tcp_stream": 743, "frame_number": 27442, "display_filter": "frame.number == 27442", "timestamp_epoch": "1533965035.599216000" } ], "is_private": null, "observable_id": "observable-3a87287f435353503defda2f", "last_seen_epoch": "1533965035.599216000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965035.335816000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "ebdr3.com", "evidence": [ { "udp_stream": 281, "frame_number": 31607, "display_filter": "frame.number == 31607", "timestamp_epoch": "1533965100.694974000" }, { "udp_stream": 281, "frame_number": 31703, "display_filter": "frame.number == 31703", "timestamp_epoch": "1533965100.814252000" }, { "tcp_stream": 869, "frame_number": 31819, "display_filter": "frame.number == 31819", "timestamp_epoch": "1533965100.951618000" }, { "tcp_stream": 868, "frame_number": 31826, "display_filter": "frame.number == 31826", "timestamp_epoch": "1533965100.952361000" } ], "is_private": null, "observable_id": "observable-6e1a93f3a9fdaf9a0fae2a5e", "last_seen_epoch": "1533965100.952361000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965100.694974000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "elb-aws-ca-clickdistrict-2095435364.us-west-1.elb.amazonaws.com", "evidence": [ { "udp_stream": 274, "frame_number": 30691, "display_filter": "frame.number == 30691", "timestamp_epoch": "1533965099.093757000" } ], "is_private": null, "observable_id": "observable-4920e51a7821d3573eee5c87", "last_seen_epoch": "1533965099.093757000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965099.093757000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "eus.rubiconproject.com", "evidence": [ { "udp_stream": 172, "frame_number": 16422, "display_filter": "frame.number == 16422", "timestamp_epoch": "1533964908.974972000" }, { "udp_stream": 172, "frame_number": 16445, "display_filter": "frame.number == 16445", "timestamp_epoch": "1533964909.104131000" }, { "tcp_stream": 465, "frame_number": 16464, "display_filter": "frame.number == 16464", "timestamp_epoch": "1533964909.174457000" }, { "tcp_stream": 466, "frame_number": 16466, "display_filter": "frame.number == 16466", "timestamp_epoch": "1533964909.174601000" } ], "is_private": null, "observable_id": "observable-2004f81e88e2d4878108d5e9", "last_seen_epoch": "1533964909.174601000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964908.974972000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "f2.shared.global.fastly.net", "evidence": [ { "udp_stream": 279, "frame_number": 31673, "display_filter": "frame.number == 31673", "timestamp_epoch": "1533965100.796418000" } ], "is_private": null, "observable_id": "observable-1c964b2e7437cc190baeb13e", "last_seen_epoch": "1533965100.796418000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965100.796418000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "fastlane-adv.rubiconproject.com", "evidence": [ { "udp_stream": 141, "frame_number": 13443, "display_filter": "frame.number == 13443", "timestamp_epoch": "1533964903.409461000" }, { "udp_stream": 141, "frame_number": 13494, "display_filter": "frame.number == 13494", "timestamp_epoch": "1533964903.481649000" }, { "tcp_stream": 349, "frame_number": 13560, "display_filter": "frame.number == 13560", "timestamp_epoch": "1533964903.549819000" } ], "is_private": null, "observable_id": "observable-658b4ce6bf3e0568f425fc63", "last_seen_epoch": "1533964903.549819000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964903.409461000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "fo-fd-world-new.yax.gysm.yahoodns.net", "evidence": [ { "udp_stream": 81, "frame_number": 6113, "display_filter": "frame.number == 6113", "timestamp_epoch": "1533964559.840586000" }, { "udp_stream": 85, "frame_number": 6273, "display_filter": "frame.number == 6273", "timestamp_epoch": "1533964560.304978000" } ], "is_private": null, "observable_id": "observable-ddecbd1fdb7799ecd88d52e5", "last_seen_epoch": "1533964560.304978000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964559.840586000" }, { "type": "domain", "roles": [ "dns-query", "http-host", "tls-sni" ], "value": "fonts.googleapis.com", "evidence": [ { "udp_stream": 41, "frame_number": 2269, "display_filter": "frame.number == 2269", "timestamp_epoch": "1533964549.231268000" }, { "udp_stream": 41, "frame_number": 2425, "display_filter": "frame.number == 2425", "timestamp_epoch": "1533964549.757857000" }, { "udp_stream": 354, "frame_number": 44597, "display_filter": "frame.number == 44597", "timestamp_epoch": "1533965785.837646000" }, { "udp_stream": 354, "frame_number": 44732, "display_filter": "frame.number == 44732", "timestamp_epoch": "1533965786.093172000" }, { "tcp_stream": 1190, "frame_number": 44836, "display_filter": "frame.number == 44836", "timestamp_epoch": "1533965786.409477000" }, { "tcp_stream": 1191, "frame_number": 44840, "display_filter": "frame.number == 44840", "timestamp_epoch": "1533965786.410078000" }, { "tcp_stream": 64, "frame_number": 2517, "display_filter": "frame.number == 2517", "timestamp_epoch": "1533964550.141655000" }, { "tcp_stream": 65, "frame_number": 2518, "display_filter": "frame.number == 2518", "timestamp_epoch": "1533964550.141657000" }, { "tcp_stream": 560, "frame_number": 19599, "display_filter": "frame.number == 19599", "timestamp_epoch": "1533964962.530305000" }, { "tcp_stream": 561, "frame_number": 19602, "display_filter": "frame.number == 19602", "timestamp_epoch": "1533964962.532060000" } ], "is_private": null, "observable_id": "observable-86579a762a791beb58709c7b", "last_seen_epoch": "1533965786.410078000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964549.231268000" }, { "type": "domain", "roles": [ "dns-query", "http-host", "tls-sni" ], "value": "fonts.gstatic.com", "evidence": [ { "udp_stream": 45, "frame_number": 3134, "display_filter": "frame.number == 3134", "timestamp_epoch": "1533964552.236123000" }, { "udp_stream": 45, "frame_number": 3196, "display_filter": "frame.number == 3196", "timestamp_epoch": "1533964552.405445000" }, { "udp_stream": 357, "frame_number": 45000, "display_filter": "frame.number == 45000", "timestamp_epoch": "1533965786.627493000" }, { "udp_stream": 357, "frame_number": 45116, "display_filter": "frame.number == 45116", "timestamp_epoch": "1533965786.910754000" }, { "tcp_stream": 1198, "frame_number": 45320, "display_filter": "frame.number == 45320", "timestamp_epoch": "1533965787.350306000" }, { "tcp_stream": 1197, "frame_number": 45321, "display_filter": "frame.number == 45321", "timestamp_epoch": "1533965787.350307000" }, { "tcp_stream": 74, "frame_number": 3264, "display_filter": "frame.number == 3264", "timestamp_epoch": "1533964552.477001000" }, { "tcp_stream": 75, "frame_number": 3266, "display_filter": "frame.number == 3266", "timestamp_epoch": "1533964552.477100000" }, { "tcp_stream": 73, "frame_number": 3267, "display_filter": "frame.number == 3267", "timestamp_epoch": "1533964552.477139000" }, { "tcp_stream": 129, "frame_number": 5477, "display_filter": "frame.number == 5477", "timestamp_epoch": "1533964556.949763000" } ], "is_private": null, "observable_id": "observable-38d7323de0ab3caba05426f5", "last_seen_epoch": "1533965787.350307000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964552.236123000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "g2.gumgum.com", "evidence": [ { "udp_stream": 145, "frame_number": 13493, "display_filter": "frame.number == 13493", "timestamp_epoch": "1533964903.481648000" }, { "udp_stream": 145, "frame_number": 13562, "display_filter": "frame.number == 13562", "timestamp_epoch": "1533964903.558314000" }, { "tcp_stream": 353, "frame_number": 13673, "display_filter": "frame.number == 13673", "timestamp_epoch": "1533964903.645216000" }, { "tcp_stream": 356, "frame_number": 13674, "display_filter": "frame.number == 13674", "timestamp_epoch": "1533964903.645497000" } ], "is_private": null, "observable_id": "observable-eece0e6729adf5e30e6fe012", "last_seen_epoch": "1533964903.645497000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964903.481648000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "googleadapis.l.google.com", "evidence": [ { "udp_stream": 41, "frame_number": 2425, "display_filter": "frame.number == 2425", "timestamp_epoch": "1533964549.757857000" }, { "udp_stream": 140, "frame_number": 13400, "display_filter": "frame.number == 13400", "timestamp_epoch": "1533964903.310256000" }, { "udp_stream": 354, "frame_number": 44732, "display_filter": "frame.number == 44732", "timestamp_epoch": "1533965786.093172000" } ], "is_private": null, "observable_id": "observable-bd2f38a015b83953b03d070e", "last_seen_epoch": "1533965786.093172000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964549.757857000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "googleads.g.doubleclick.net", "evidence": [ { "udp_stream": 69, "frame_number": 5430, "display_filter": "frame.number == 5430", "timestamp_epoch": "1533964556.819517000" }, { "udp_stream": 69, "frame_number": 5441, "display_filter": "frame.number == 5441", "timestamp_epoch": "1533964556.880955000" }, { "udp_stream": 359, "frame_number": 45612, "display_filter": "frame.number == 45612", "timestamp_epoch": "1533965788.303184000" }, { "udp_stream": 359, "frame_number": 45830, "display_filter": "frame.number == 45830", "timestamp_epoch": "1533965789.081206000" }, { "tcp_stream": 131, "frame_number": 5484, "display_filter": "frame.number == 5484", "timestamp_epoch": "1533964556.953322000" }, { "tcp_stream": 130, "frame_number": 5489, "display_filter": "frame.number == 5489", "timestamp_epoch": "1533964556.954242000" }, { "tcp_stream": 247, "frame_number": 9665, "display_filter": "frame.number == 9665", "timestamp_epoch": "1533964899.587690000" }, { "tcp_stream": 246, "frame_number": 9674, "display_filter": "frame.number == 9674", "timestamp_epoch": "1533964899.588806000" }, { "tcp_stream": 252, "frame_number": 9694, "display_filter": "frame.number == 9694", "timestamp_epoch": "1533964899.600626000" }, { "tcp_stream": 251, "frame_number": 9710, "display_filter": "frame.number == 9710", "timestamp_epoch": "1533964899.602873000" }, { "tcp_stream": 268, "frame_number": 10385, "display_filter": "frame.number == 10385", "timestamp_epoch": "1533964900.268062000" }, { "tcp_stream": 904, "frame_number": 33061, "display_filter": "frame.number == 33061", "timestamp_epoch": "1533965136.994395000" }, { "tcp_stream": 905, "frame_number": 33063, "display_filter": "frame.number == 33063", "timestamp_epoch": "1533965136.995440000" }, { "tcp_stream": 914, "frame_number": 33252, "display_filter": "frame.number == 33252", "timestamp_epoch": "1533965137.379124000" }, { "tcp_stream": 1009, "frame_number": 38925, "display_filter": "frame.number == 38925", "timestamp_epoch": "1533965240.537262000" }, { "tcp_stream": 1010, "frame_number": 38933, "display_filter": "frame.number == 38933", "timestamp_epoch": "1533965240.538141000" }, { "tcp_stream": 1206, "frame_number": 45901, "display_filter": "frame.number == 45901", "timestamp_epoch": "1533965789.195222000" }, { "tcp_stream": 1205, "frame_number": 45903, "display_filter": "frame.number == 45903", "timestamp_epoch": "1533965789.195689000" } ], "is_private": null, "observable_id": "observable-b46539f1c03a93270a904d89", "last_seen_epoch": "1533965789.195689000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964556.819517000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "googleads4.g.doubleclick.net", "evidence": [ { "udp_stream": 126, "frame_number": 11738, "display_filter": "frame.number == 11738", "timestamp_epoch": "1533964901.548766000" }, { "udp_stream": 126, "frame_number": 11931, "display_filter": "frame.number == 11931", "timestamp_epoch": "1533964901.698739000" }, { "tcp_stream": 309, "frame_number": 11970, "display_filter": "frame.number == 11970", "timestamp_epoch": "1533964901.775522000" }, { "tcp_stream": 310, "frame_number": 11971, "display_filter": "frame.number == 11971", "timestamp_epoch": "1533964901.775654000" } ], "is_private": null, "observable_id": "observable-1b26b832fe1e9f183525ec02", "last_seen_epoch": "1533964901.775654000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964901.548766000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "googleapis.l.google.com", "evidence": [ { "udp_stream": 30, "frame_number": 611, "display_filter": "frame.number == 611", "timestamp_epoch": "1533964545.651017000" } ], "is_private": null, "observable_id": "observable-b09ed558f364542f73f3dd3a", "last_seen_epoch": "1533964545.651017000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964545.651017000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "gstaticadssl.l.google.com", "evidence": [ { "udp_stream": 45, "frame_number": 3196, "display_filter": "frame.number == 3196", "timestamp_epoch": "1533964552.405445000" }, { "udp_stream": 357, "frame_number": 45116, "display_filter": "frame.number == 45116", "timestamp_epoch": "1533965786.910754000" } ], "is_private": null, "observable_id": "observable-349ba8af8e4678c63ef80e72", "last_seen_epoch": "1533965786.910754000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964552.405445000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "hb-api-usa02.omnitagjs.com", "evidence": [ { "udp_stream": 146, "frame_number": 13566, "display_filter": "frame.number == 13566", "timestamp_epoch": "1533964903.560435000" } ], "is_private": null, "observable_id": "observable-5223a166b2911bd817f53dfa", "last_seen_epoch": "1533964903.560435000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964903.560435000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "hb-api.omnitagjs.com", "evidence": [ { "udp_stream": 146, "frame_number": 13502, "display_filter": "frame.number == 13502", "timestamp_epoch": "1533964903.485569000" }, { "udp_stream": 146, "frame_number": 13566, "display_filter": "frame.number == 13566", "timestamp_epoch": "1533964903.560435000" }, { "tcp_stream": 357, "frame_number": 13770, "display_filter": "frame.number == 13770", "timestamp_epoch": "1533964903.717409000" } ], "is_private": null, "observable_id": "observable-65b759360ae29738d045a03a", "last_seen_epoch": "1533964903.717409000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964903.485569000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "hbevents.1rx.io", "evidence": [ { "udp_stream": 162, "frame_number": 15389, "display_filter": "frame.number == 15389", "timestamp_epoch": "1533964906.550970000" }, { "udp_stream": 162, "frame_number": 15556, "display_filter": "frame.number == 15556", "timestamp_epoch": "1533964906.746311000" }, { "tcp_stream": 425, "frame_number": 15602, "display_filter": "frame.number == 15602", "timestamp_epoch": "1533964906.851735000" }, { "tcp_stream": 426, "frame_number": 15603, "display_filter": "frame.number == 15603", "timestamp_epoch": "1533964906.851959000" } ], "is_private": null, "observable_id": "observable-514fe42a5d35ec702e480d03", "last_seen_epoch": "1533964906.851959000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964906.550970000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "i.w55c.net", "evidence": [ { "udp_stream": 156, "frame_number": 14568, "display_filter": "frame.number == 14568", "timestamp_epoch": "1533964904.596445000" }, { "udp_stream": 156, "frame_number": 14613, "display_filter": "frame.number == 14613", "timestamp_epoch": "1533964904.637787000" }, { "tcp_stream": 398, "frame_number": 14728, "display_filter": "frame.number == 14728", "timestamp_epoch": "1533964904.713278000" }, { "tcp_stream": 397, "frame_number": 14729, "display_filter": "frame.number == 14729", "timestamp_epoch": "1533964904.713386000" }, { "tcp_stream": 631, "frame_number": 23315, "display_filter": "frame.number == 23315", "timestamp_epoch": "1533964997.317123000" }, { "tcp_stream": 630, "frame_number": 23316, "display_filter": "frame.number == 23316", "timestamp_epoch": "1533964997.317150000" } ], "is_private": null, "observable_id": "observable-b33a85bc3e0787a16f8d4549", "last_seen_epoch": "1533964997.317150000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964904.596445000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "i.ytimg.com", "evidence": [ { "udp_stream": 71, "frame_number": 5681, "display_filter": "frame.number == 5681", "timestamp_epoch": "1533964558.620590000" }, { "udp_stream": 71, "frame_number": 5698, "display_filter": "frame.number == 5698", "timestamp_epoch": "1533964558.771373000" }, { "tcp_stream": 135, "frame_number": 5705, "display_filter": "frame.number == 5705", "timestamp_epoch": "1533964558.825936000" }, { "tcp_stream": 134, "frame_number": 5707, "display_filter": "frame.number == 5707", "timestamp_epoch": "1533964558.827148000" }, { "tcp_stream": 282, "frame_number": 10697, "display_filter": "frame.number == 10697", "timestamp_epoch": "1533964900.710385000" }, { "tcp_stream": 283, "frame_number": 10699, "display_filter": "frame.number == 10699", "timestamp_epoch": "1533964900.710596000" } ], "is_private": null, "observable_id": "observable-a2ed7083552acda83b518aaf", "last_seen_epoch": "1533964900.710596000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964558.620590000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "ib.adnxs.com", "evidence": [ { "udp_stream": 100, "frame_number": 8912, "display_filter": "frame.number == 8912", "timestamp_epoch": "1533964898.855179000" }, { "udp_stream": 100, "frame_number": 8956, "display_filter": "frame.number == 8956", "timestamp_epoch": "1533964898.930148000" }, { "tcp_stream": 235, "frame_number": 9015, "display_filter": "frame.number == 9015", "timestamp_epoch": "1533964898.995291000" }, { "tcp_stream": 232, "frame_number": 9029, "display_filter": "frame.number == 9029", "timestamp_epoch": "1533964898.996896000" }, { "tcp_stream": 524, "frame_number": 18640, "display_filter": "frame.number == 18640", "timestamp_epoch": "1533964959.508962000" }, { "tcp_stream": 523, "frame_number": 18646, "display_filter": "frame.number == 18646", "timestamp_epoch": "1533964959.510081000" }, { "tcp_stream": 534, "frame_number": 18749, "display_filter": "frame.number == 18749", "timestamp_epoch": "1533964959.984935000" }, { "tcp_stream": 533, "frame_number": 18750, "display_filter": "frame.number == 18750", "timestamp_epoch": "1533964959.985057000" }, { "tcp_stream": 602, "frame_number": 21957, "display_filter": "frame.number == 21957", "timestamp_epoch": "1533964980.047151000" }, { "tcp_stream": 601, "frame_number": 21958, "display_filter": "frame.number == 21958", "timestamp_epoch": "1533964980.047155000" }, { "tcp_stream": 626, "frame_number": 23283, "display_filter": "frame.number == 23283", "timestamp_epoch": "1533964997.231021000" }, { "tcp_stream": 627, "frame_number": 23285, "display_filter": "frame.number == 23285", "timestamp_epoch": "1533964997.231199000" }, { "tcp_stream": 680, "frame_number": 24416, "display_filter": "frame.number == 24416", "timestamp_epoch": "1533965015.155537000" }, { "tcp_stream": 679, "frame_number": 24418, "display_filter": "frame.number == 24418", "timestamp_epoch": "1533965015.155692000" }, { "tcp_stream": 729, "frame_number": 27185, "display_filter": "frame.number == 27185", "timestamp_epoch": "1533965034.923961000" }, { "tcp_stream": 730, "frame_number": 27186, "display_filter": "frame.number == 27186", "timestamp_epoch": "1533965034.924117000" }, { "tcp_stream": 733, "frame_number": 27212, "display_filter": "frame.number == 27212", "timestamp_epoch": "1533965034.983960000" }, { "tcp_stream": 778, "frame_number": 28211, "display_filter": "frame.number == 28211", "timestamp_epoch": "1533965055.159104000" }, { "tcp_stream": 777, "frame_number": 28213, "display_filter": "frame.number == 28213", "timestamp_epoch": "1533965055.159396000" }, { "tcp_stream": 780, "frame_number": 28461, "display_filter": "frame.number == 28461", "timestamp_epoch": "1533965075.835447000" } ], "is_private": null, "observable_id": "observable-89c54be412aee44309eb93a3", "last_seen_epoch": "1533965234.479897000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964898.855179000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "id.rlcdn.com", "evidence": [ { "udp_stream": 150, "frame_number": 14516, "display_filter": "frame.number == 14516", "timestamp_epoch": "1533964904.554032000" }, { "udp_stream": 150, "frame_number": 14614, "display_filter": "frame.number == 14614", "timestamp_epoch": "1533964904.637907000" }, { "tcp_stream": 396, "frame_number": 14725, "display_filter": "frame.number == 14725", "timestamp_epoch": "1533964904.712726000" }, { "tcp_stream": 395, "frame_number": 14726, "display_filter": "frame.number == 14726", "timestamp_epoch": "1533964904.712920000" } ], "is_private": null, "observable_id": "observable-5145251affaaf1b062a1eb95", "last_seen_epoch": "1533964904.712920000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964904.554032000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "idpix.media6degrees.com", "evidence": [ { "udp_stream": 192, "frame_number": 18474, "display_filter": "frame.number == 18474", "timestamp_epoch": "1533964959.055539000" }, { "udp_stream": 192, "frame_number": 18626, "display_filter": "frame.number == 18626", "timestamp_epoch": "1533964959.502753000" }, { "tcp_stream": 530, "frame_number": 18738, "display_filter": "frame.number == 18738", "timestamp_epoch": "1533964959.945476000" }, { "tcp_stream": 529, "frame_number": 18740, "display_filter": "frame.number == 18740", "timestamp_epoch": "1533964959.945828000" } ], "is_private": null, "observable_id": "observable-1375f5fd187dd6cce6d501b9", "last_seen_epoch": "1533964959.945828000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964959.055539000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "idsync-ext-weight-2.rlcdn.com", "evidence": [ { "udp_stream": 190, "frame_number": 18568, "display_filter": "frame.number == 18568", "timestamp_epoch": "1533964959.365164000" } ], "is_private": null, "observable_id": "observable-f7a0961eb7f7f7a37f03ab3e", "last_seen_epoch": "1533964959.365164000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964959.365164000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "idsync.rlcdn.com", "evidence": [ { "udp_stream": 190, "frame_number": 18440, "display_filter": "frame.number == 18440", "timestamp_epoch": "1533964959.043665000" }, { "udp_stream": 190, "frame_number": 18568, "display_filter": "frame.number == 18568", "timestamp_epoch": "1533964959.365164000" }, { "tcp_stream": 526, "frame_number": 18695, "display_filter": "frame.number == 18695", "timestamp_epoch": "1533964959.750246000" }, { "tcp_stream": 525, "frame_number": 18696, "display_filter": "frame.number == 18696", "timestamp_epoch": "1533964959.750247000" } ], "is_private": null, "observable_id": "observable-7dd1dfd5662aa187f805d9d0", "last_seen_epoch": "1533964959.750247000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964959.043665000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "iecvlist.microsoft.com", "evidence": [ { "udp_stream": 86, "frame_number": 6512, "display_filter": "frame.number == 6512", "timestamp_epoch": "1533964574.365606000" }, { "udp_stream": 86, "frame_number": 6513, "display_filter": "frame.number == 6513", "timestamp_epoch": "1533964574.365861000" }, { "udp_stream": 366, "frame_number": 46918, "display_filter": "frame.number == 46918", "timestamp_epoch": "1533965798.576687000" }, { "udp_stream": 366, "frame_number": 46919, "display_filter": "frame.number == 46919", "timestamp_epoch": "1533965798.750795000" }, { "tcp_stream": 165, "frame_number": 6520, "display_filter": "frame.number == 6520", "timestamp_epoch": "1533964574.443493000" }, { "tcp_stream": 164, "frame_number": 6522, "display_filter": "frame.number == 6522", "timestamp_epoch": "1533964574.443681000" }, { "tcp_stream": 1230, "frame_number": 46926, "display_filter": "frame.number == 46926", "timestamp_epoch": "1533965798.889723000" }, { "tcp_stream": 1229, "frame_number": 46927, "display_filter": "frame.number == 46927", "timestamp_epoch": "1533965798.889852000" } ], "is_private": null, "observable_id": "observable-e3ddf83be5fed8b14c4f0529", "last_seen_epoch": "1533965798.889852000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964574.365606000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "image2.pubmatic.com", "evidence": [ { "udp_stream": 128, "frame_number": 11954, "display_filter": "frame.number == 11954", "timestamp_epoch": "1533964901.706900000" }, { "udp_stream": 128, "frame_number": 11978, "display_filter": "frame.number == 11978", "timestamp_epoch": "1533964901.783846000" }, { "tcp_stream": 314, "frame_number": 12042, "display_filter": "frame.number == 12042", "timestamp_epoch": "1533964901.843881000" }, { "tcp_stream": 315, "frame_number": 12044, "display_filter": "frame.number == 12044", "timestamp_epoch": "1533964901.844190000" }, { "tcp_stream": 697, "frame_number": 26444, "display_filter": "frame.number == 26444", "timestamp_epoch": "1533965032.721529000" }, { "tcp_stream": 696, "frame_number": 26449, "display_filter": "frame.number == 26449", "timestamp_epoch": "1533965032.722110000" }, { "tcp_stream": 875, "frame_number": 32100, "display_filter": "frame.number == 32100", "timestamp_epoch": "1533965101.564817000" }, { "tcp_stream": 874, "frame_number": 32102, "display_filter": "frame.number == 32102", "timestamp_epoch": "1533965101.569346000" } ], "is_private": null, "observable_id": "observable-97e45d9ecdbff80ce6d5aa31", "last_seen_epoch": "1533965101.569346000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964901.706900000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "image4.pubmatic.com", "evidence": [ { "udp_stream": 171, "frame_number": 16362, "display_filter": "frame.number == 16362", "timestamp_epoch": "1533964908.826784000" }, { "udp_stream": 171, "frame_number": 16389, "display_filter": "frame.number == 16389", "timestamp_epoch": "1533964908.885044000" }, { "tcp_stream": 463, "frame_number": 16412, "display_filter": "frame.number == 16412", "timestamp_epoch": "1533964908.961212000" }, { "tcp_stream": 464, "frame_number": 16413, "display_filter": "frame.number == 16413", "timestamp_epoch": "1533964908.961417000" }, { "tcp_stream": 948, "frame_number": 34889, "display_filter": "frame.number == 34889", "timestamp_epoch": "1533965159.091676000" }, { "tcp_stream": 949, "frame_number": 34891, "display_filter": "frame.number == 34891", "timestamp_epoch": "1533965159.091883000" } ], "is_private": null, "observable_id": "observable-86d83f83c0069987d4c0d1bb", "last_seen_epoch": "1533965159.091883000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964908.826784000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "image6.pubmatic.com", "evidence": [ { "udp_stream": 165, "frame_number": 15919, "display_filter": "frame.number == 15919", "timestamp_epoch": "1533964907.947302000" }, { "udp_stream": 165, "frame_number": 15930, "display_filter": "frame.number == 15930", "timestamp_epoch": "1533964908.051426000" }, { "tcp_stream": 437, "frame_number": 15937, "display_filter": "frame.number == 15937", "timestamp_epoch": "1533964908.117624000" }, { "tcp_stream": 438, "frame_number": 15938, "display_filter": "frame.number == 15938", "timestamp_epoch": "1533964908.117625000" }, { "tcp_stream": 808, "frame_number": 29818, "display_filter": "frame.number == 29818", "timestamp_epoch": "1533965097.616749000" }, { "tcp_stream": 809, "frame_number": 29835, "display_filter": "frame.number == 29835", "timestamp_epoch": "1533965097.623442000" } ], "is_private": null, "observable_id": "observable-7a395a985e651af891743b2d", "last_seen_epoch": "1533965097.623442000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964907.947302000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "images.outbrainimg.com", "evidence": [ { "udp_stream": 147, "frame_number": 13640, "display_filter": "frame.number == 13640", "timestamp_epoch": "1533964903.629499000" }, { "udp_stream": 147, "frame_number": 13794, "display_filter": "frame.number == 13794", "timestamp_epoch": "1533964903.730026000" }, { "tcp_stream": 363, "frame_number": 13925, "display_filter": "frame.number == 13925", "timestamp_epoch": "1533964903.796988000" }, { "tcp_stream": 362, "frame_number": 13929, "display_filter": "frame.number == 13929", "timestamp_epoch": "1533964903.798419000" }, { "tcp_stream": 364, "frame_number": 13938, "display_filter": "frame.number == 13938", "timestamp_epoch": "1533964903.810237000" } ], "is_private": null, "observable_id": "observable-e96bd415eef27a6b07ef4c69", "last_seen_epoch": "1533964903.810237000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964903.629499000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "images9.engageya.com", "evidence": [ { "udp_stream": 110, "frame_number": 10576, "display_filter": "frame.number == 10576", "timestamp_epoch": "1533964900.522209000" }, { "udp_stream": 110, "frame_number": 10626, "display_filter": "frame.number == 10626", "timestamp_epoch": "1533964900.625516000" }, { "tcp_stream": 275, "frame_number": 10651, "display_filter": "frame.number == 10651", "timestamp_epoch": "1533964900.685939000" }, { "tcp_stream": 279, "frame_number": 10657, "display_filter": "frame.number == 10657", "timestamp_epoch": "1533964900.688301000" }, { "tcp_stream": 276, "frame_number": 10659, "display_filter": "frame.number == 10659", "timestamp_epoch": "1533964900.688509000" }, { "tcp_stream": 278, "frame_number": 10661, "display_filter": "frame.number == 10661", "timestamp_epoch": "1533964900.688758000" }, { "tcp_stream": 277, "frame_number": 10663, "display_filter": "frame.number == 10663", "timestamp_epoch": "1533964900.688850000" } ], "is_private": null, "observable_id": "observable-57df2292eaf71c1c9f231364", "last_seen_epoch": "1533964900.688850000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964900.522209000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "imasdk.googleapis.com", "evidence": [ { "udp_stream": 140, "frame_number": 13322, "display_filter": "frame.number == 13322", "timestamp_epoch": "1533964903.228307000" }, { "udp_stream": 140, "frame_number": 13400, "display_filter": "frame.number == 13400", "timestamp_epoch": "1533964903.310256000" }, { "tcp_stream": 344, "frame_number": 13439, "display_filter": "frame.number == 13439", "timestamp_epoch": "1533964903.380407000" }, { "tcp_stream": 343, "frame_number": 13441, "display_filter": "frame.number == 13441", "timestamp_epoch": "1533964903.383586000" }, { "tcp_stream": 495, "frame_number": 17509, "display_filter": "frame.number == 17509", "timestamp_epoch": "1533964956.619349000" } ], "is_private": null, "observable_id": "observable-8e23daf2a60b8358a3ec4c2b", "last_seen_epoch": "1533964956.619349000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964903.228307000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "isatap.localdomain", "evidence": [ { "udp_stream": 3, "frame_number": 6, "display_filter": "frame.number == 6", "timestamp_epoch": "1533964508.833900000" }, { "udp_stream": 3, "frame_number": 7, "display_filter": "frame.number == 7", "timestamp_epoch": "1533964508.834117000" } ], "is_private": null, "observable_id": "observable-7f65675196997f6bd9df7e6a", "last_seen_epoch": "1533964508.834117000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964508.833900000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "jadserve.postrelease.com", "evidence": [ { "udp_stream": 262, "frame_number": 27306, "display_filter": "frame.number == 27306", "timestamp_epoch": "1533965035.354027000" }, { "udp_stream": 262, "frame_number": 27340, "display_filter": "frame.number == 27340", "timestamp_epoch": "1533965035.445360000" }, { "tcp_stream": 745, "frame_number": 27389, "display_filter": "frame.number == 27389", "timestamp_epoch": "1533965035.528115000" }, { "tcp_stream": 746, "frame_number": 27390, "display_filter": "frame.number == 27390", "timestamp_epoch": "1533965035.528277000" } ], "is_private": null, "observable_id": "observable-73767dc6c15c5c6af99169e2", "last_seen_epoch": "1533965035.528277000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965035.354027000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "jadserve.postrelease.com.akadns.net", "evidence": [ { "udp_stream": 262, "frame_number": 27340, "display_filter": "frame.number == 27340", "timestamp_epoch": "1533965035.445360000" } ], "is_private": null, "observable_id": "observable-af825af7e0b2aad0ea5d230a", "last_seen_epoch": "1533965035.445360000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965035.445360000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "launcher.spot.im", "evidence": [ { "udp_stream": 90, "frame_number": 7484, "display_filter": "frame.number == 7484", "timestamp_epoch": "1533964897.219566000" }, { "udp_stream": 90, "frame_number": 7515, "display_filter": "frame.number == 7515", "timestamp_epoch": "1533964897.312123000" }, { "tcp_stream": 195, "frame_number": 7552, "display_filter": "frame.number == 7552", "timestamp_epoch": "1533964897.403131000" }, { "tcp_stream": 194, "frame_number": 7554, "display_filter": "frame.number == 7554", "timestamp_epoch": "1533964897.403225000" } ], "is_private": null, "observable_id": "observable-e7629a85258e6d7181e0b5ca", "last_seen_epoch": "1533964897.403225000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964897.219566000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "lax1-ib.adnxs.com", "evidence": [ { "udp_stream": 202, "frame_number": 19273, "display_filter": "frame.number == 19273", "timestamp_epoch": "1533964961.687478000" }, { "udp_stream": 202, "frame_number": 19300, "display_filter": "frame.number == 19300", "timestamp_epoch": "1533964961.756585000" }, { "tcp_stream": 552, "frame_number": 19336, "display_filter": "frame.number == 19336", "timestamp_epoch": "1533964961.815273000" }, { "tcp_stream": 553, "frame_number": 19342, "display_filter": "frame.number == 19342", "timestamp_epoch": "1533964961.831082000" }, { "tcp_stream": 604, "frame_number": 22871, "display_filter": "frame.number == 22871", "timestamp_epoch": "1533964994.530205000" }, { "tcp_stream": 605, "frame_number": 22875, "display_filter": "frame.number == 22875", "timestamp_epoch": "1533964994.535341000" }, { "tcp_stream": 686, "frame_number": 26228, "display_filter": "frame.number == 26228", "timestamp_epoch": "1533965030.656483000" }, { "tcp_stream": 687, "frame_number": 26229, "display_filter": "frame.number == 26229", "timestamp_epoch": "1533965030.656484000" }, { "tcp_stream": 790, "frame_number": 28758, "display_filter": "frame.number == 28758", "timestamp_epoch": "1533965094.736269000" }, { "tcp_stream": 791, "frame_number": 28761, "display_filter": "frame.number == 28761", "timestamp_epoch": "1533965094.736604000" }, { "tcp_stream": 925, "frame_number": 33597, "display_filter": "frame.number == 33597", "timestamp_epoch": "1533965155.480314000" }, { "tcp_stream": 924, "frame_number": 33601, "display_filter": "frame.number == 33601", "timestamp_epoch": "1533965155.481900000" }, { "tcp_stream": 1029, "frame_number": 39311, "display_filter": "frame.number == 39311", "timestamp_epoch": "1533965246.774368000" }, { "tcp_stream": 1028, "frame_number": 39313, "display_filter": "frame.number == 39313", "timestamp_epoch": "1533965246.774457000" } ], "is_private": null, "observable_id": "observable-0119b6813c2ffccdb1512e66", "last_seen_epoch": "1533965246.774457000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964961.687478000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "load77.exelator.com", "evidence": [ { "udp_stream": 221, "frame_number": 20905, "display_filter": "frame.number == 20905", "timestamp_epoch": "1533964966.935817000" }, { "udp_stream": 221, "frame_number": 21150, "display_filter": "frame.number == 21150", "timestamp_epoch": "1533964967.906377000" }, { "tcp_stream": 600, "frame_number": 21428, "display_filter": "frame.number == 21428", "timestamp_epoch": "1533964968.672694000" }, { "tcp_stream": 599, "frame_number": 21430, "display_filter": "frame.number == 21430", "timestamp_epoch": "1533964968.673327000" } ], "is_private": null, "observable_id": "observable-dcb34b89c642f47f20d50613", "last_seen_epoch": "1533964968.673327000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964966.935817000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "loadm.exelator.com", "evidence": [ { "udp_stream": 216, "frame_number": 20180, "display_filter": "frame.number == 20180", "timestamp_epoch": "1533964964.890981000" }, { "udp_stream": 216, "frame_number": 20234, "display_filter": "frame.number == 20234", "timestamp_epoch": "1533964965.013702000" }, { "tcp_stream": 591, "frame_number": 20299, "display_filter": "frame.number == 20299", "timestamp_epoch": "1533964965.249476000" }, { "tcp_stream": 592, "frame_number": 20300, "display_filter": "frame.number == 20300", "timestamp_epoch": "1533964965.249688000" } ], "is_private": null, "observable_id": "observable-da4d673ee98ecb9679f298a8", "last_seen_epoch": "1533964965.249688000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964964.890981000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "m.adnxs.com", "evidence": [ { "udp_stream": 210, "frame_number": 19905, "display_filter": "frame.number == 19905", "timestamp_epoch": "1533964963.453564000" }, { "udp_stream": 210, "frame_number": 19910, "display_filter": "frame.number == 19910", "timestamp_epoch": "1533964963.540458000" }, { "tcp_stream": 573, "frame_number": 19919, "display_filter": "frame.number == 19919", "timestamp_epoch": "1533964963.590918000" }, { "tcp_stream": 572, "frame_number": 19920, "display_filter": "frame.number == 19920", "timestamp_epoch": "1533964963.591094000" } ], "is_private": null, "observable_id": "observable-f159deab208209c078c32e02", "last_seen_epoch": "1533964963.591094000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964963.453564000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "magnetic.t.domdex.com", "evidence": [ { "udp_stream": 154, "frame_number": 14564, "display_filter": "frame.number == 14564", "timestamp_epoch": "1533964904.594862000" }, { "udp_stream": 154, "frame_number": 14640, "display_filter": "frame.number == 14640", "timestamp_epoch": "1533964904.663956000" }, { "udp_stream": 364, "frame_number": 46027, "display_filter": "frame.number == 46027", "timestamp_epoch": "1533965789.539672000" }, { "udp_stream": 364, "frame_number": 46080, "display_filter": "frame.number == 46080", "timestamp_epoch": "1533965789.714227000" }, { "tcp_stream": 402, "frame_number": 14742, "display_filter": "frame.number == 14742", "timestamp_epoch": "1533964904.728998000" }, { "tcp_stream": 401, "frame_number": 14744, "display_filter": "frame.number == 14744", "timestamp_epoch": "1533964904.729235000" }, { "tcp_stream": 613, "frame_number": 23022, "display_filter": "frame.number == 23022", "timestamp_epoch": "1533964996.447720000" }, { "tcp_stream": 612, "frame_number": 23025, "display_filter": "frame.number == 23025", "timestamp_epoch": "1533964996.448180000" }, { "tcp_stream": 813, "frame_number": 30621, "display_filter": "frame.number == 30621", "timestamp_epoch": "1533965099.024703000" }, { "tcp_stream": 812, "frame_number": 30623, "display_filter": "frame.number == 30623", "timestamp_epoch": "1533965099.024779000" }, { "tcp_stream": 1220, "frame_number": 46125, "display_filter": "frame.number == 46125", "timestamp_epoch": "1533965789.789220000" }, { "tcp_stream": 1221, "frame_number": 46126, "display_filter": "frame.number == 46126", "timestamp_epoch": "1533965789.789332000" } ], "is_private": null, "observable_id": "observable-6336d79044375aad2294587a", "last_seen_epoch": "1533965789.789332000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964904.594862000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "match-243508202.us-west-2.elb.amazonaws.com", "evidence": [ { "udp_stream": 65, "frame_number": 5141, "display_filter": "frame.number == 5141", "timestamp_epoch": "1533964556.025527000" } ], "is_private": null, "observable_id": "observable-74bedc0e2316ce1a8d1e7df9", "last_seen_epoch": "1533964556.025527000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964556.025527000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "match-us-east-1.sharethrough.com", "evidence": [ { "udp_stream": 280, "frame_number": 31704, "display_filter": "frame.number == 31704", "timestamp_epoch": "1533965100.817951000" } ], "is_private": null, "observable_id": "observable-359f394d8016d5670c1f3e7a", "last_seen_epoch": "1533965100.817951000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965100.817951000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "match.adsrvr.org", "evidence": [ { "udp_stream": 65, "frame_number": 5080, "display_filter": "frame.number == 5080", "timestamp_epoch": "1533964555.922018000" }, { "udp_stream": 65, "frame_number": 5141, "display_filter": "frame.number == 5141", "timestamp_epoch": "1533964556.025527000" }, { "tcp_stream": 120, "frame_number": 5245, "display_filter": "frame.number == 5245", "timestamp_epoch": "1533964556.112608000" }, { "tcp_stream": 119, "frame_number": 5246, "display_filter": "frame.number == 5246", "timestamp_epoch": "1533964556.112610000" }, { "tcp_stream": 444, "frame_number": 16022, "display_filter": "frame.number == 16022", "timestamp_epoch": "1533964908.405170000" }, { "tcp_stream": 443, "frame_number": 16026, "display_filter": "frame.number == 16026", "timestamp_epoch": "1533964908.405722000" }, { "tcp_stream": 805, "frame_number": 29830, "display_filter": "frame.number == 29830", "timestamp_epoch": "1533965097.622965000" }, { "tcp_stream": 804, "frame_number": 29833, "display_filter": "frame.number == 29833", "timestamp_epoch": "1533965097.623193000" } ], "is_private": null, "observable_id": "observable-eb53093dcd92781a0e540110", "last_seen_epoch": "1533965097.623193000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964555.922018000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "match.basebanner.com", "evidence": [ { "udp_stream": 191, "frame_number": 18461, "display_filter": "frame.number == 18461", "timestamp_epoch": "1533964959.050612000" }, { "udp_stream": 191, "frame_number": 18574, "display_filter": "frame.number == 18574", "timestamp_epoch": "1533964959.368247000" }, { "tcp_stream": 527, "frame_number": 18677, "display_filter": "frame.number == 18677", "timestamp_epoch": "1533964959.691383000" }, { "tcp_stream": 528, "frame_number": 18685, "display_filter": "frame.number == 18685", "timestamp_epoch": "1533964959.704203000" } ], "is_private": null, "observable_id": "observable-88f77ee88a86b19f6eaad083", "last_seen_epoch": "1533964959.704203000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964959.050612000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "match.bnmla.com", "evidence": [ { "udp_stream": 278, "frame_number": 30496, "display_filter": "frame.number == 30496", "timestamp_epoch": "1533965098.787226000" }, { "udp_stream": 278, "frame_number": 30782, "display_filter": "frame.number == 30782", "timestamp_epoch": "1533965099.269249000" }, { "tcp_stream": 836, "frame_number": 31209, "display_filter": "frame.number == 31209", "timestamp_epoch": "1533965100.029072000" }, { "tcp_stream": 837, "frame_number": 31211, "display_filter": "frame.number == 31211", "timestamp_epoch": "1533965100.029197000" } ], "is_private": null, "observable_id": "observable-7d0bd35cd5022e15a011493d", "last_seen_epoch": "1533965100.029197000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965098.787226000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "match.prod.bidr.io", "evidence": [ { "udp_stream": 244, "frame_number": 26359, "display_filter": "frame.number == 26359", "timestamp_epoch": "1533965032.570113000" }, { "udp_stream": 244, "frame_number": 26411, "display_filter": "frame.number == 26411", "timestamp_epoch": "1533965032.677118000" }, { "tcp_stream": 699, "frame_number": 26470, "display_filter": "frame.number == 26470", "timestamp_epoch": "1533965032.792962000" }, { "tcp_stream": 698, "frame_number": 26472, "display_filter": "frame.number == 26472", "timestamp_epoch": "1533965032.793141000" }, { "tcp_stream": 956, "frame_number": 35547, "display_filter": "frame.number == 35547", "timestamp_epoch": "1533965160.371639000" }, { "tcp_stream": 957, "frame_number": 35548, "display_filter": "frame.number == 35548", "timestamp_epoch": "1533965160.371822000" } ], "is_private": null, "observable_id": "observable-f41c4713ec6474ceb8ec1e60", "last_seen_epoch": "1533965160.371822000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965032.570113000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "match.rundsp.com", "evidence": [ { "udp_stream": 277, "frame_number": 30493, "display_filter": "frame.number == 30493", "timestamp_epoch": "1533965098.783956000" }, { "udp_stream": 277, "frame_number": 30810, "display_filter": "frame.number == 30810", "timestamp_epoch": "1533965099.289135000" }, { "tcp_stream": 840, "frame_number": 31175, "display_filter": "frame.number == 31175", "timestamp_epoch": "1533965100.006057000" }, { "tcp_stream": 841, "frame_number": 31192, "display_filter": "frame.number == 31192", "timestamp_epoch": "1533965100.009068000" } ], "is_private": null, "observable_id": "observable-04a87f3a5336e92f3c7df38f", "last_seen_epoch": "1533965100.009068000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965098.783956000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "match.sharethrough.com", "evidence": [ { "udp_stream": 280, "frame_number": 31606, "display_filter": "frame.number == 31606", "timestamp_epoch": "1533965100.694552000" }, { "udp_stream": 280, "frame_number": 31704, "display_filter": "frame.number == 31704", "timestamp_epoch": "1533965100.817951000" }, { "tcp_stream": 871, "frame_number": 31846, "display_filter": "frame.number == 31846", "timestamp_epoch": "1533965101.016609000" }, { "tcp_stream": 870, "frame_number": 31847, "display_filter": "frame.number == 31847", "timestamp_epoch": "1533965101.016612000" } ], "is_private": null, "observable_id": "observable-adf208c36a5d05a6594f3a86", "last_seen_epoch": "1533965101.016612000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965100.694552000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "match.taboola.com", "evidence": [ { "udp_stream": 287, "frame_number": 32116, "display_filter": "frame.number == 32116", "timestamp_epoch": "1533965101.584554000" }, { "udp_stream": 287, "frame_number": 32144, "display_filter": "frame.number == 32144", "timestamp_epoch": "1533965101.694508000" }, { "tcp_stream": 876, "frame_number": 32170, "display_filter": "frame.number == 32170", "timestamp_epoch": "1533965101.852145000" }, { "tcp_stream": 877, "frame_number": 32174, "display_filter": "frame.number == 32174", "timestamp_epoch": "1533965101.879907000" } ], "is_private": null, "observable_id": "observable-3753d237f7a2c54466a3efa6", "last_seen_epoch": "1533965101.879907000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965101.584554000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "matchuswest-922949909.us-west-1.elb.amazonaws.com", "evidence": [ { "udp_stream": 277, "frame_number": 30810, "display_filter": "frame.number == 30810", "timestamp_epoch": "1533965099.289135000" } ], "is_private": null, "observable_id": "observable-09c49e3a6fe2b30ae2ee8c37", "last_seen_epoch": "1533965099.289135000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965099.289135000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "mc.yandex.ru", "evidence": [ { "udp_stream": 52, "frame_number": 3216, "display_filter": "frame.number == 3216", "timestamp_epoch": "1533964552.432630000" }, { "udp_stream": 52, "frame_number": 3310, "display_filter": "frame.number == 3310", "timestamp_epoch": "1533964552.683616000" }, { "udp_stream": 344, "frame_number": 43677, "display_filter": "frame.number == 43677", "timestamp_epoch": "1533965783.159102000" }, { "udp_stream": 344, "frame_number": 43729, "display_filter": "frame.number == 43729", "timestamp_epoch": "1533965783.276443000" }, { "tcp_stream": 87, "frame_number": 3558, "display_filter": "frame.number == 3558", "timestamp_epoch": "1533964552.967445000" }, { "tcp_stream": 86, "frame_number": 3561, "display_filter": "frame.number == 3561", "timestamp_epoch": "1533964552.967829000" }, { "tcp_stream": 184, "frame_number": 7420, "display_filter": "frame.number == 7420", "timestamp_epoch": "1533964896.798333000" }, { "tcp_stream": 185, "frame_number": 7422, "display_filter": "frame.number == 7422", "timestamp_epoch": "1533964896.798517000" }, { "tcp_stream": 1153, "frame_number": 43935, "display_filter": "frame.number == 43935", "timestamp_epoch": "1533965783.795303000" }, { "tcp_stream": 1154, "frame_number": 43937, "display_filter": "frame.number == 43937", "timestamp_epoch": "1533965783.795464000" } ], "is_private": null, "observable_id": "observable-28d9eb110d5f47f41712aebf", "last_seen_epoch": "1533965783.795464000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964552.432630000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "melia.sp1.convertro.com", "evidence": [ { "udp_stream": 205, "frame_number": 19606, "display_filter": "frame.number == 19606", "timestamp_epoch": "1533964962.543898000" }, { "udp_stream": 205, "frame_number": 19619, "display_filter": "frame.number == 19619", "timestamp_epoch": "1533964962.605621000" }, { "tcp_stream": 563, "frame_number": 19632, "display_filter": "frame.number == 19632", "timestamp_epoch": "1533964962.734007000" }, { "tcp_stream": 562, "frame_number": 19633, "display_filter": "frame.number == 19633", "timestamp_epoch": "1533964962.734030000" }, { "tcp_stream": 760, "frame_number": 27686, "display_filter": "frame.number == 27686", "timestamp_epoch": "1533965035.849773000" }, { "tcp_stream": 761, "frame_number": 27687, "display_filter": "frame.number == 27687", "timestamp_epoch": "1533965035.849996000" }, { "tcp_stream": 973, "frame_number": 35831, "display_filter": "frame.number == 35831", "timestamp_epoch": "1533965160.970333000" }, { "tcp_stream": 972, "frame_number": 35832, "display_filter": "frame.number == 35832", "timestamp_epoch": "1533965160.970589000" } ], "is_private": null, "observable_id": "observable-12942ee8a3001f755940b2ea", "last_seen_epoch": "1533965160.970589000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964962.543898000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "mixi.media", "evidence": [ { "udp_stream": 91, "frame_number": 7800, "display_filter": "frame.number == 7800", "timestamp_epoch": "1533964897.662014000" }, { "udp_stream": 91, "frame_number": 8116, "display_filter": "frame.number == 8116", "timestamp_epoch": "1533964897.941119000" }, { "tcp_stream": 205, "frame_number": 8405, "display_filter": "frame.number == 8405", "timestamp_epoch": "1533964898.230941000" }, { "tcp_stream": 204, "frame_number": 8421, "display_filter": "frame.number == 8421", "timestamp_epoch": "1533964898.251259000" } ], "is_private": null, "observable_id": "observable-c311fbc6050e92138c0fbee1", "last_seen_epoch": "1533964898.251259000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964897.662014000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "mixi1-1.s1.mixi.space", "evidence": [ { "udp_stream": 103, "frame_number": 9470, "display_filter": "frame.number == 9470", "timestamp_epoch": "1533964899.377567000" }, { "udp_stream": 104, "frame_number": 9471, "display_filter": "frame.number == 9471", "timestamp_epoch": "1533964899.377655000" }, { "udp_stream": 131, "frame_number": 12208, "display_filter": "frame.number == 12208", "timestamp_epoch": "1533964901.980409000" }, { "udp_stream": 130, "frame_number": 12212, "display_filter": "frame.number == 12212", "timestamp_epoch": "1533964901.981250000" }, { "udp_stream": 134, "frame_number": 12763, "display_filter": "frame.number == 12763", "timestamp_epoch": "1533964902.706045000" } ], "is_private": null, "observable_id": "observable-0c7cc89688ed279ae185f0b8", "last_seen_epoch": "1533964902.706045000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964899.377567000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "ml314.com", "evidence": [ { "udp_stream": 215, "frame_number": 20177, "display_filter": "frame.number == 20177", "timestamp_epoch": "1533964964.882716000" }, { "udp_stream": 215, "frame_number": 20229, "display_filter": "frame.number == 20229", "timestamp_epoch": "1533964965.012616000" }, { "tcp_stream": 589, "frame_number": 20302, "display_filter": "frame.number == 20302", "timestamp_epoch": "1533964965.250141000" }, { "tcp_stream": 590, "frame_number": 20343, "display_filter": "frame.number == 20343", "timestamp_epoch": "1533964965.302580000" } ], "is_private": null, "observable_id": "observable-93946d4a7081431aa283a3c3", "last_seen_epoch": "1533964965.302580000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964964.882716000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "mm.melia.com", "evidence": [ { "udp_stream": 200, "frame_number": 19245, "display_filter": "frame.number == 19245", "timestamp_epoch": "1533964961.545252000" }, { "udp_stream": 200, "frame_number": 19258, "display_filter": "frame.number == 19258", "timestamp_epoch": "1533964961.633523000" }, { "tcp_stream": 550, "frame_number": 19358, "display_filter": "frame.number == 19358", "timestamp_epoch": "1533964961.845258000" }, { "tcp_stream": 551, "frame_number": 19359, "display_filter": "frame.number == 19359", "timestamp_epoch": "1533964961.845259000" }, { "tcp_stream": 727, "frame_number": 27200, "display_filter": "frame.number == 27200", "timestamp_epoch": "1533965034.944923000" }, { "tcp_stream": 728, "frame_number": 27202, "display_filter": "frame.number == 27202", "timestamp_epoch": "1533965034.944925000" }, { "tcp_stream": 950, "frame_number": 35467, "display_filter": "frame.number == 35467", "timestamp_epoch": "1533965160.181369000" }, { "tcp_stream": 951, "frame_number": 35471, "display_filter": "frame.number == 35471", "timestamp_epoch": "1533965160.192710000" } ], "is_private": null, "observable_id": "observable-b819e7d36432906e1cf8cf51", "last_seen_epoch": "1533965160.192710000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964961.545252000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "na-eb2.3lift.com", "evidence": [ { "udp_stream": 259, "frame_number": 27332, "display_filter": "frame.number == 27332", "timestamp_epoch": "1533965035.434545000" } ], "is_private": null, "observable_id": "observable-1aeb95bd8b22199bf627019f", "last_seen_epoch": "1533965035.434545000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965035.434545000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "net.finam.ru", "evidence": [ { "udp_stream": 123, "frame_number": 11426, "display_filter": "frame.number == 11426", "timestamp_epoch": "1533964901.269111000" }, { "udp_stream": 123, "frame_number": 11477, "display_filter": "frame.number == 11477", "timestamp_epoch": "1533964901.323587000" }, { "tcp_stream": 303, "frame_number": 11850, "display_filter": "frame.number == 11850", "timestamp_epoch": "1533964901.594524000" }, { "tcp_stream": 302, "frame_number": 11854, "display_filter": "frame.number == 11854", "timestamp_epoch": "1533964901.598920000" } ], "is_private": null, "observable_id": "observable-534e5322c4e3bf3e9c43e998", "last_seen_epoch": "1533964901.598920000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964901.269111000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "odb.outbrain.com", "evidence": [ { "udp_stream": 138, "frame_number": 13204, "display_filter": "frame.number == 13204", "timestamp_epoch": "1533964903.157823000" }, { "udp_stream": 138, "frame_number": 13349, "display_filter": "frame.number == 13349", "timestamp_epoch": "1533964903.242983000" }, { "tcp_stream": 339, "frame_number": 13419, "display_filter": "frame.number == 13419", "timestamp_epoch": "1533964903.334955000" }, { "tcp_stream": 340, "frame_number": 13422, "display_filter": "frame.number == 13422", "timestamp_epoch": "1533964903.335215000" } ], "is_private": null, "observable_id": "observable-e59311c08fb20b8c0af51d4d", "last_seen_epoch": "1533964903.335215000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964903.157823000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "odr-712357372.us-east-1.elb.amazonaws.com", "evidence": [ { "udp_stream": 207, "frame_number": 19702, "display_filter": "frame.number == 19702", "timestamp_epoch": "1533964962.896098000" } ], "is_private": null, "observable_id": "observable-2286e451a5b01f61f73e18cb", "last_seen_epoch": "1533964962.896098000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964962.896098000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "odr.mookie1.com", "evidence": [ { "udp_stream": 207, "frame_number": 19653, "display_filter": "frame.number == 19653", "timestamp_epoch": "1533964962.787255000" }, { "udp_stream": 207, "frame_number": 19702, "display_filter": "frame.number == 19702", "timestamp_epoch": "1533964962.896098000" }, { "tcp_stream": 566, "frame_number": 19804, "display_filter": "frame.number == 19804", "timestamp_epoch": "1533964963.040445000" }, { "tcp_stream": 567, "frame_number": 19805, "display_filter": "frame.number == 19805", "timestamp_epoch": "1533964963.041725000" } ], "is_private": null, "observable_id": "observable-4eb7c861cb1a62f848425159", "last_seen_epoch": "1533964963.041725000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964962.787255000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "optimized-by.rubiconproject.com", "evidence": [ { "udp_stream": 158, "frame_number": 14636, "display_filter": "frame.number == 14636", "timestamp_epoch": "1533964904.647012000" }, { "udp_stream": 158, "frame_number": 14749, "display_filter": "frame.number == 14749", "timestamp_epoch": "1533964904.736366000" }, { "tcp_stream": 414, "frame_number": 14819, "display_filter": "frame.number == 14819", "timestamp_epoch": "1533964904.795068000" }, { "tcp_stream": 413, "frame_number": 14821, "display_filter": "frame.number == 14821", "timestamp_epoch": "1533964904.795277000" } ], "is_private": null, "observable_id": "observable-5bec042dcab7d47937579369", "last_seen_epoch": "1533964904.795277000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964904.647012000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "ox.pxl.ace.advertising.com", "evidence": [ { "udp_stream": 79, "frame_number": 5856, "display_filter": "frame.number == 5856", "timestamp_epoch": "1533964559.411813000" }, { "udp_stream": 79, "frame_number": 5893, "display_filter": "frame.number == 5893", "timestamp_epoch": "1533964559.525559000" }, { "tcp_stream": 150, "frame_number": 5940, "display_filter": "frame.number == 5940", "timestamp_epoch": "1533964559.589148000" }, { "tcp_stream": 151, "frame_number": 5950, "display_filter": "frame.number == 5950", "timestamp_epoch": "1533964559.594136000" } ], "is_private": null, "observable_id": "observable-f60eac8385134cf667ac67e0", "last_seen_epoch": "1533964559.594136000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964559.411813000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "oxp.mxptint.net", "evidence": [ { "udp_stream": 153, "frame_number": 14558, "display_filter": "frame.number == 14558", "timestamp_epoch": "1533964904.586500000" }, { "udp_stream": 153, "frame_number": 14611, "display_filter": "frame.number == 14611", "timestamp_epoch": "1533964904.637605000" }, { "tcp_stream": 394, "frame_number": 14741, "display_filter": "frame.number == 14741", "timestamp_epoch": "1533964904.728872000" }, { "tcp_stream": 393, "frame_number": 14752, "display_filter": "frame.number == 14752", "timestamp_epoch": "1533964904.737397000" } ], "is_private": null, "observable_id": "observable-a99a0437f98e5c3179056703", "last_seen_epoch": "1533964904.737397000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964904.586500000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "p.adsymptotic.com", "evidence": [ { "udp_stream": 166, "frame_number": 15967, "display_filter": "frame.number == 15967", "timestamp_epoch": "1533964908.323614000" }, { "udp_stream": 166, "frame_number": 16032, "display_filter": "frame.number == 16032", "timestamp_epoch": "1533964908.406611000" }, { "tcp_stream": 454, "frame_number": 16152, "display_filter": "frame.number == 16152", "timestamp_epoch": "1533964908.533771000" }, { "tcp_stream": 453, "frame_number": 16164, "display_filter": "frame.number == 16164", "timestamp_epoch": "1533964908.543183000" }, { "tcp_stream": 826, "frame_number": 30836, "display_filter": "frame.number == 30836", "timestamp_epoch": "1533965099.324080000" }, { "tcp_stream": 827, "frame_number": 30855, "display_filter": "frame.number == 30855", "timestamp_epoch": "1533965099.357388000" } ], "is_private": null, "observable_id": "observable-911ae72f190fa32e3838772e", "last_seen_epoch": "1533965099.357388000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964908.323614000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "p.rfihub.com", "evidence": [ { "udp_stream": 78, "frame_number": 5855, "display_filter": "frame.number == 5855", "timestamp_epoch": "1533964559.411454000" }, { "udp_stream": 78, "frame_number": 6294, "display_filter": "frame.number == 6294", "timestamp_epoch": "1533964560.407087000" }, { "udp_stream": 78, "frame_number": 6313, "display_filter": "frame.number == 6313", "timestamp_epoch": "1533964560.553014000" }, { "tcp_stream": 162, "frame_number": 6340, "display_filter": "frame.number == 6340", "timestamp_epoch": "1533964560.688711000" }, { "tcp_stream": 163, "frame_number": 6344, "display_filter": "frame.number == 6344", "timestamp_epoch": "1533964560.711802000" }, { "tcp_stream": 441, "frame_number": 16084, "display_filter": "frame.number == 16084", "timestamp_epoch": "1533964908.459084000" }, { "tcp_stream": 442, "frame_number": 16086, "display_filter": "frame.number == 16086", "timestamp_epoch": "1533964908.459668000" }, { "tcp_stream": 648, "frame_number": 23675, "display_filter": "frame.number == 23675", "timestamp_epoch": "1533964997.858092000" }, { "tcp_stream": 647, "frame_number": 23677, "display_filter": "frame.number == 23677", "timestamp_epoch": "1533964997.858310000" }, { "tcp_stream": 709, "frame_number": 26748, "display_filter": "frame.number == 26748", "timestamp_epoch": "1533965033.510056000" }, { "tcp_stream": 710, "frame_number": 26749, "display_filter": "frame.number == 26749", "timestamp_epoch": "1533965033.510057000" } ], "is_private": null, "observable_id": "observable-457ed152df621ea4a3e38a52", "last_seen_epoch": "1533965033.510057000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964559.411454000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "p.skimresources.com", "evidence": [ { "udp_stream": 220, "frame_number": 20585, "display_filter": "frame.number == 20585", "timestamp_epoch": "1533964965.733767000" }, { "udp_stream": 220, "frame_number": 20725, "display_filter": "frame.number == 20725", "timestamp_epoch": "1533964966.306264000" }, { "tcp_stream": 597, "frame_number": 20975, "display_filter": "frame.number == 20975", "timestamp_epoch": "1533964967.208417000" }, { "tcp_stream": 598, "frame_number": 20976, "display_filter": "frame.number == 20976", "timestamp_epoch": "1533964967.208418000" } ], "is_private": null, "observable_id": "observable-ec433021fab82f7eec1a615b", "last_seen_epoch": "1533964967.208418000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964965.733767000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "pagead-googlehosted.l.google.com", "evidence": [ { "udp_stream": 60, "frame_number": 4936, "display_filter": "frame.number == 4936", "timestamp_epoch": "1533964555.714019000" }, { "udp_stream": 347, "frame_number": 44193, "display_filter": "frame.number == 44193", "timestamp_epoch": "1533965784.401633000" } ], "is_private": null, "observable_id": "observable-8767b61498be41398234f1f1", "last_seen_epoch": "1533965784.401633000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964555.714019000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "pagead.l.doubleclick.net", "evidence": [ { "udp_stream": 66, "frame_number": 5140, "display_filter": "frame.number == 5140", "timestamp_epoch": "1533964556.025417000" }, { "udp_stream": 126, "frame_number": 11931, "display_filter": "frame.number == 11931", "timestamp_epoch": "1533964901.698739000" }, { "udp_stream": 177, "frame_number": 16951, "display_filter": "frame.number == 16951", "timestamp_epoch": "1533964912.917076000" }, { "udp_stream": 362, "frame_number": 46032, "display_filter": "frame.number == 46032", "timestamp_epoch": "1533965789.555893000" } ], "is_private": null, "observable_id": "observable-a7bd74ce76c0a15332c145f7", "last_seen_epoch": "1533965789.555893000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964556.025417000" }, { "type": "domain", "roles": [ "dns-query", "http-host", "tls-sni" ], "value": "pagead2.googlesyndication.com", "evidence": [ { "udp_stream": 106, "frame_number": 9409, "display_filter": "frame.number == 9409", "timestamp_epoch": "1533964899.325470000" }, { "udp_stream": 106, "frame_number": 9637, "display_filter": "frame.number == 9637", "timestamp_epoch": "1533964899.569932000" }, { "udp_stream": 353, "frame_number": 44401, "display_filter": "frame.number == 44401", "timestamp_epoch": "1533965785.103477000" }, { "udp_stream": 353, "frame_number": 44701, "display_filter": "frame.number == 44701", "timestamp_epoch": "1533965786.043701000" }, { "tcp_stream": 1187, "frame_number": 44800, "display_filter": "frame.number == 44800", "timestamp_epoch": "1533965786.356599000" }, { "tcp_stream": 259, "frame_number": 9803, "display_filter": "frame.number == 9803", "timestamp_epoch": "1533964899.642217000" }, { "tcp_stream": 260, "frame_number": 9805, "display_filter": "frame.number == 9805", "timestamp_epoch": "1533964899.642445000" }, { "tcp_stream": 261, "frame_number": 9811, "display_filter": "frame.number == 9811", "timestamp_epoch": "1533964899.643460000" }, { "tcp_stream": 574, "frame_number": 19951, "display_filter": "frame.number == 19951", "timestamp_epoch": "1533964963.672103000" }, { "tcp_stream": 575, "frame_number": 19955, "display_filter": "frame.number == 19955", "timestamp_epoch": "1533964963.688975000" }, { "tcp_stream": 576, "frame_number": 19970, "display_filter": "frame.number == 19970", "timestamp_epoch": "1533964963.731363000" }, { "tcp_stream": 1202, "frame_number": 45662, "display_filter": "frame.number == 45662", "timestamp_epoch": "1533965788.445447000" }, { "tcp_stream": 1203, "frame_number": 45828, "display_filter": "frame.number == 45828", "timestamp_epoch": "1533965789.057761000" }, { "tcp_stream": 1204, "frame_number": 45833, "display_filter": "frame.number == 45833", "timestamp_epoch": "1533965789.082723000" }, { "tcp_stream": 1209, "frame_number": 45920, "display_filter": "frame.number == 45920", "timestamp_epoch": "1533965789.225632000" } ], "is_private": null, "observable_id": "observable-a8e6105d884d048675107ba0", "last_seen_epoch": "1533965789.225632000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964899.325470000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "pagead46.l.doubleclick.net", "evidence": [ { "udp_stream": 43, "frame_number": 3185, "display_filter": "frame.number == 3185", "timestamp_epoch": "1533964552.354010000" }, { "udp_stream": 53, "frame_number": 3925, "display_filter": "frame.number == 3925", "timestamp_epoch": "1533964553.575811000" }, { "udp_stream": 69, "frame_number": 5441, "display_filter": "frame.number == 5441", "timestamp_epoch": "1533964556.880955000" }, { "udp_stream": 106, "frame_number": 9637, "display_filter": "frame.number == 9637", "timestamp_epoch": "1533964899.569932000" }, { "udp_stream": 336, "frame_number": 43648, "display_filter": "frame.number == 43648", "timestamp_epoch": "1533965783.044158000" }, { "udp_stream": 345, "frame_number": 43840, "display_filter": "frame.number == 43840", "timestamp_epoch": "1533965783.630277000" }, { "udp_stream": 353, "frame_number": 44701, "display_filter": "frame.number == 44701", "timestamp_epoch": "1533965786.043701000" }, { "udp_stream": 359, "frame_number": 45830, "display_filter": "frame.number == 45830", "timestamp_epoch": "1533965789.081206000" } ], "is_private": null, "observable_id": "observable-7e1de8f72f455b172072f6d3", "last_seen_epoch": "1533965789.081206000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964552.354010000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "partnerad.l.doubleclick.net", "evidence": [ { "udp_stream": 54, "frame_number": 3927, "display_filter": "frame.number == 3927", "timestamp_epoch": "1533964553.575840000" }, { "udp_stream": 183, "frame_number": 18111, "display_filter": "frame.number == 18111", "timestamp_epoch": "1533964958.070258000" }, { "udp_stream": 346, "frame_number": 44008, "display_filter": "frame.number == 44008", "timestamp_epoch": "1533965783.935554000" } ], "is_private": null, "observable_id": "observable-5bcfcb58e4282b617d917004", "last_seen_epoch": "1533965783.935554000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964553.575840000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "partners-1732315393.us-east-1.elb.amazonaws.com", "evidence": [ { "udp_stream": 258, "frame_number": 27323, "display_filter": "frame.number == 27323", "timestamp_epoch": "1533965035.406624000" } ], "is_private": null, "observable_id": "observable-ed51281a4ed1677ae452db3b", "last_seen_epoch": "1533965035.406624000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965035.406624000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "perf-token.rubiconproject.net.akadns.net", "evidence": [ { "udp_stream": 174, "frame_number": 16558, "display_filter": "frame.number == 16558", "timestamp_epoch": "1533964910.093175000" } ], "is_private": null, "observable_id": "observable-0f88359f0c8d541f876d4814", "last_seen_epoch": "1533964910.093175000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964910.093175000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "petrov2018-pc.sputnikhouse.org", "evidence": [ { "udp_stream": 22, "frame_number": 374, "display_filter": "frame.number == 374", "timestamp_epoch": "1533964517.089613000" }, { "udp_stream": 22, "frame_number": 375, "display_filter": "frame.number == 375", "timestamp_epoch": "1533964517.089954000" }, { "udp_stream": 314, "frame_number": 39653, "display_filter": "frame.number == 39653", "timestamp_epoch": "1533965410.182850000" }, { "udp_stream": 314, "frame_number": 39654, "display_filter": "frame.number == 39654", "timestamp_epoch": "1533965410.183053000" }, { "udp_stream": 316, "frame_number": 39657, "display_filter": "frame.number == 39657", "timestamp_epoch": "1533965410.185413000" }, { "udp_stream": 316, "frame_number": 39658, "display_filter": "frame.number == 39658", "timestamp_epoch": "1533965410.185581000" } ], "is_private": null, "observable_id": "observable-dfd1a09ab149f5dd57d0e665", "last_seen_epoch": "1533965410.185581000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964517.089613000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "phototass1.cdnvideo.ru", "evidence": [ { "udp_stream": 324, "frame_number": 40130, "display_filter": "frame.number == 40130", "timestamp_epoch": "1533965770.287434000" }, { "udp_stream": 324, "frame_number": 40193, "display_filter": "frame.number == 40193", "timestamp_epoch": "1533965770.483961000" }, { "tcp_stream": 1079, "frame_number": 40292, "display_filter": "frame.number == 40292", "timestamp_epoch": "1533965770.800076000" }, { "tcp_stream": 1080, "frame_number": 40306, "display_filter": "frame.number == 40306", "timestamp_epoch": "1533965770.800953000" }, { "tcp_stream": 1082, "frame_number": 40309, "display_filter": "frame.number == 40309", "timestamp_epoch": "1533965770.801360000" }, { "tcp_stream": 1081, "frame_number": 40310, "display_filter": "frame.number == 40310", "timestamp_epoch": "1533965770.801362000" }, { "tcp_stream": 1078, "frame_number": 40312, "display_filter": "frame.number == 40312", "timestamp_epoch": "1533965770.801500000" }, { "tcp_stream": 1083, "frame_number": 40315, "display_filter": "frame.number == 40315", "timestamp_epoch": "1533965770.802257000" }, { "tcp_stream": 1114, "frame_number": 40914, "display_filter": "frame.number == 40914", "timestamp_epoch": "1533965773.665198000" }, { "tcp_stream": 1225, "frame_number": 46559, "display_filter": "frame.number == 46559", "timestamp_epoch": "1533965791.712865000" }, { "tcp_stream": 1224, "frame_number": 46560, "display_filter": "frame.number == 46560", "timestamp_epoch": "1533965791.712866000" } ], "is_private": null, "observable_id": "observable-ad039a0ce30356e0612d5434", "last_seen_epoch": "1533965791.712866000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965770.287434000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "phototass2.cdnvideo.ru", "evidence": [ { "udp_stream": 329, "frame_number": 40137, "display_filter": "frame.number == 40137", "timestamp_epoch": "1533965770.291819000" }, { "udp_stream": 329, "frame_number": 40243, "display_filter": "frame.number == 40243", "timestamp_epoch": "1533965770.575466000" }, { "tcp_stream": 1113, "frame_number": 40353, "display_filter": "frame.number == 40353", "timestamp_epoch": "1533965770.815158000" }, { "tcp_stream": 1112, "frame_number": 40364, "display_filter": "frame.number == 40364", "timestamp_epoch": "1533965770.816261000" }, { "tcp_stream": 1109, "frame_number": 40375, "display_filter": "frame.number == 40375", "timestamp_epoch": "1533965770.817366000" }, { "tcp_stream": 1108, "frame_number": 40385, "display_filter": "frame.number == 40385", "timestamp_epoch": "1533965770.819837000" }, { "tcp_stream": 1111, "frame_number": 40387, "display_filter": "frame.number == 40387", "timestamp_epoch": "1533965770.819971000" }, { "tcp_stream": 1110, "frame_number": 40395, "display_filter": "frame.number == 40395", "timestamp_epoch": "1533965770.822836000" }, { "tcp_stream": 1222, "frame_number": 46510, "display_filter": "frame.number == 46510", "timestamp_epoch": "1533965791.526188000" }, { "tcp_stream": 1223, "frame_number": 46514, "display_filter": "frame.number == 46514", "timestamp_epoch": "1533965791.527564000" } ], "is_private": null, "observable_id": "observable-99e3aa0a6d7432906d701cb1", "last_seen_epoch": "1533965791.527564000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965770.291819000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "phototass3.cdnvideo.ru", "evidence": [ { "udp_stream": 328, "frame_number": 40134, "display_filter": "frame.number == 40134", "timestamp_epoch": "1533965770.290547000" }, { "udp_stream": 328, "frame_number": 40224, "display_filter": "frame.number == 40224", "timestamp_epoch": "1533965770.569362000" }, { "tcp_stream": 1092, "frame_number": 40373, "display_filter": "frame.number == 40373", "timestamp_epoch": "1533965770.817168000" }, { "tcp_stream": 1091, "frame_number": 40406, "display_filter": "frame.number == 40406", "timestamp_epoch": "1533965770.823673000" }, { "tcp_stream": 1094, "frame_number": 40409, "display_filter": "frame.number == 40409", "timestamp_epoch": "1533965770.823885000" }, { "tcp_stream": 1099, "frame_number": 40428, "display_filter": "frame.number == 40428", "timestamp_epoch": "1533965770.853344000" }, { "tcp_stream": 1103, "frame_number": 40443, "display_filter": "frame.number == 40443", "timestamp_epoch": "1533965770.857708000" }, { "tcp_stream": 1104, "frame_number": 40461, "display_filter": "frame.number == 40461", "timestamp_epoch": "1533965770.869297000" }, { "tcp_stream": 1117, "frame_number": 40960, "display_filter": "frame.number == 40960", "timestamp_epoch": "1533965773.747852000" }, { "tcp_stream": 1119, "frame_number": 40965, "display_filter": "frame.number == 40965", "timestamp_epoch": "1533965773.748243000" }, { "tcp_stream": 1124, "frame_number": 41160, "display_filter": "frame.number == 41160", "timestamp_epoch": "1533965772.399229000" }, { "tcp_stream": 1126, "frame_number": 41164, "display_filter": "frame.number == 41164", "timestamp_epoch": "1533965772.399573000" }, { "tcp_stream": 1127, "frame_number": 41306, "display_filter": "frame.number == 41306", "timestamp_epoch": "1533965772.815075000" }, { "tcp_stream": 1182, "frame_number": 44816, "display_filter": "frame.number == 44816", "timestamp_epoch": "1533965786.361520000" }, { "tcp_stream": 1183, "frame_number": 44820, "display_filter": "frame.number == 44820", "timestamp_epoch": "1533965786.361841000" } ], "is_private": null, "observable_id": "observable-a385b7f9b9a7316f71e6052a", "last_seen_epoch": "1533965786.361841000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965770.290547000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "phototass4.cdnvideo.ru", "evidence": [ { "udp_stream": 326, "frame_number": 40132, "display_filter": "frame.number == 40132", "timestamp_epoch": "1533965770.289792000" }, { "udp_stream": 326, "frame_number": 40222, "display_filter": "frame.number == 40222", "timestamp_epoch": "1533965770.569135000" }, { "tcp_stream": 1090, "frame_number": 40370, "display_filter": "frame.number == 40370", "timestamp_epoch": "1533965770.816625000" }, { "tcp_stream": 1093, "frame_number": 40389, "display_filter": "frame.number == 40389", "timestamp_epoch": "1533965770.820237000" }, { "tcp_stream": 1095, "frame_number": 40415, "display_filter": "frame.number == 40415", "timestamp_epoch": "1533965770.825183000" }, { "tcp_stream": 1096, "frame_number": 40417, "display_filter": "frame.number == 40417", "timestamp_epoch": "1533965770.825184000" }, { "tcp_stream": 1100, "frame_number": 40426, "display_filter": "frame.number == 40426", "timestamp_epoch": "1533965770.853341000" }, { "tcp_stream": 1102, "frame_number": 40435, "display_filter": "frame.number == 40435", "timestamp_epoch": "1533965770.856913000" }, { "tcp_stream": 1121, "frame_number": 40953, "display_filter": "frame.number == 40953", "timestamp_epoch": "1533965773.747076000" }, { "tcp_stream": 1120, "frame_number": 40963, "display_filter": "frame.number == 40963", "timestamp_epoch": "1533965773.747990000" }, { "tcp_stream": 1123, "frame_number": 41110, "display_filter": "frame.number == 41110", "timestamp_epoch": "1533965774.062728000" }, { "tcp_stream": 1122, "frame_number": 41124, "display_filter": "frame.number == 41124", "timestamp_epoch": "1533965774.074652000" }, { "tcp_stream": 1128, "frame_number": 41308, "display_filter": "frame.number == 41308", "timestamp_epoch": "1533965772.815243000" }, { "tcp_stream": 1129, "frame_number": 41316, "display_filter": "frame.number == 41316", "timestamp_epoch": "1533965772.824220000" }, { "tcp_stream": 1180, "frame_number": 44814, "display_filter": "frame.number == 44814", "timestamp_epoch": "1533965786.361271000" }, { "tcp_stream": 1181, "frame_number": 44822, "display_filter": "frame.number == 44822", "timestamp_epoch": "1533965786.362580000" } ], "is_private": null, "observable_id": "observable-1e0c9a0e45afb8a73414521d", "last_seen_epoch": "1533965786.362580000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965770.289792000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "ping.chartbeat.net", "evidence": [ { "udp_stream": 82, "frame_number": 6127, "display_filter": "frame.number == 6127", "timestamp_epoch": "1533964559.866175000" }, { "udp_stream": 82, "frame_number": 6148, "display_filter": "frame.number == 6148", "timestamp_epoch": "1533964559.906110000" }, { "tcp_stream": 156, "frame_number": 6210, "display_filter": "frame.number == 6210", "timestamp_epoch": "1533964560.054258000" }, { "tcp_stream": 157, "frame_number": 6214, "display_filter": "frame.number == 6214", "timestamp_epoch": "1533964560.058896000" }, { "tcp_stream": 176, "frame_number": 7174, "display_filter": "frame.number == 7174", "timestamp_epoch": "1533964739.950773000" }, { "tcp_stream": 175, "frame_number": 7180, "display_filter": "frame.number == 7180", "timestamp_epoch": "1533964739.962159000" }, { "tcp_stream": 180, "frame_number": 7347, "display_filter": "frame.number == 7347", "timestamp_epoch": "1533964875.352644000" }, { "tcp_stream": 181, "frame_number": 7349, "display_filter": "frame.number == 7349", "timestamp_epoch": "1533964875.352768000" } ], "is_private": null, "observable_id": "observable-16f3647d79427cf0605b99b0", "last_seen_epoch": "1533964875.352768000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964559.866175000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "pippio.com", "evidence": [ { "udp_stream": 218, "frame_number": 20280, "display_filter": "frame.number == 20280", "timestamp_epoch": "1533964965.146026000" }, { "udp_stream": 218, "frame_number": 20323, "display_filter": "frame.number == 20323", "timestamp_epoch": "1533964965.297460000" }, { "tcp_stream": 594, "frame_number": 20386, "display_filter": "frame.number == 20386", "timestamp_epoch": "1533964965.380525000" }, { "tcp_stream": 593, "frame_number": 20387, "display_filter": "frame.number == 20387", "timestamp_epoch": "1533964965.380735000" } ], "is_private": null, "observable_id": "observable-f5443057148f474bea8261c0", "last_seen_epoch": "1533964965.380735000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964965.146026000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "pix.impdesk.com", "evidence": [ { "udp_stream": 251, "frame_number": 26701, "display_filter": "frame.number == 26701", "timestamp_epoch": "1533965033.402780000" }, { "udp_stream": 251, "frame_number": 26729, "display_filter": "frame.number == 26729", "timestamp_epoch": "1533965033.481704000" }, { "tcp_stream": 711, "frame_number": 26756, "display_filter": "frame.number == 26756", "timestamp_epoch": "1533965033.528947000" }, { "tcp_stream": 712, "frame_number": 26757, "display_filter": "frame.number == 26757", "timestamp_epoch": "1533965033.528949000" } ], "is_private": null, "observable_id": "observable-473fc2880296de7bbdab3891", "last_seen_epoch": "1533965033.528949000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965033.402780000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "pix.spot.im", "evidence": [ { "udp_stream": 148, "frame_number": 14316, "display_filter": "frame.number == 14316", "timestamp_epoch": "1533964904.262876000" }, { "udp_stream": 148, "frame_number": 14376, "display_filter": "frame.number == 14376", "timestamp_epoch": "1533964904.333194000" }, { "tcp_stream": 378, "frame_number": 14459, "display_filter": "frame.number == 14459", "timestamp_epoch": "1533964904.454417000" }, { "tcp_stream": 379, "frame_number": 14465, "display_filter": "frame.number == 14465", "timestamp_epoch": "1533964904.473391000" } ], "is_private": null, "observable_id": "observable-1862b8ed5bec246b3f4729bc", "last_seen_epoch": "1533964904.473391000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964904.262876000" }, { "type": "domain", "roles": [ "dns-cname", "dns-query", "tls-sni" ], "value": "pixel-a.sitescout.com", "evidence": [ { "udp_stream": 77, "frame_number": 5866, "display_filter": "frame.number == 5866", "timestamp_epoch": "1533964559.464580000" }, { "udp_stream": 228, "frame_number": 23250, "display_filter": "frame.number == 23250", "timestamp_epoch": "1533964997.189399000" }, { "udp_stream": 228, "frame_number": 23321, "display_filter": "frame.number == 23321", "timestamp_epoch": "1533964997.328339000" }, { "tcp_stream": 641, "frame_number": 23404, "display_filter": "frame.number == 23404", "timestamp_epoch": "1533964997.416681000" }, { "tcp_stream": 640, "frame_number": 23406, "display_filter": "frame.number == 23406", "timestamp_epoch": "1533964997.416898000" } ], "is_private": null, "observable_id": "observable-301a347df53c17bd6cff0433", "last_seen_epoch": "1533964997.416898000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964559.464580000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "pixel-origin.mathtag.com", "evidence": [ { "udp_stream": 61, "frame_number": 5120, "display_filter": "frame.number == 5120", "timestamp_epoch": "1533964555.984165000" } ], "is_private": null, "observable_id": "observable-f51422c41bd3b907dc23493d", "last_seen_epoch": "1533964555.984165000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964555.984165000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "pixel-sc2.adsymptotic.com", "evidence": [ { "udp_stream": 288, "frame_number": 32216, "display_filter": "frame.number == 32216", "timestamp_epoch": "1533965102.093914000" }, { "udp_stream": 288, "frame_number": 32219, "display_filter": "frame.number == 32219", "timestamp_epoch": "1533965102.184319000" }, { "tcp_stream": 878, "frame_number": 32226, "display_filter": "frame.number == 32226", "timestamp_epoch": "1533965102.240261000" }, { "tcp_stream": 879, "frame_number": 32227, "display_filter": "frame.number == 32227", "timestamp_epoch": "1533965102.240348000" } ], "is_private": null, "observable_id": "observable-7c02a893df3a2137c581d763", "last_seen_epoch": "1533965102.240348000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965102.093914000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "pixel-sync.sitescout.com", "evidence": [ { "udp_stream": 77, "frame_number": 5854, "display_filter": "frame.number == 5854", "timestamp_epoch": "1533964559.409750000" }, { "udp_stream": 77, "frame_number": 5866, "display_filter": "frame.number == 5866", "timestamp_epoch": "1533964559.464580000" }, { "tcp_stream": 145, "frame_number": 5900, "display_filter": "frame.number == 5900", "timestamp_epoch": "1533964559.530894000" }, { "tcp_stream": 144, "frame_number": 5901, "display_filter": "frame.number == 5901", "timestamp_epoch": "1533964559.530984000" }, { "tcp_stream": 521, "frame_number": 18582, "display_filter": "frame.number == 18582", "timestamp_epoch": "1533964959.371649000" }, { "tcp_stream": 522, "frame_number": 18584, "display_filter": "frame.number == 18584", "timestamp_epoch": "1533964959.371752000" } ], "is_private": null, "observable_id": "observable-04273b1ed743f442b2a7aa0a", "last_seen_epoch": "1533964959.371752000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964559.409750000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "pixel-us-east.rubiconproject.com", "evidence": [ { "udp_stream": 196, "frame_number": 18671, "display_filter": "frame.number == 18671", "timestamp_epoch": "1533964959.616289000" }, { "udp_stream": 196, "frame_number": 18786, "display_filter": "frame.number == 18786", "timestamp_epoch": "1533964960.049215000" }, { "tcp_stream": 539, "frame_number": 18914, "display_filter": "frame.number == 18914", "timestamp_epoch": "1533964960.219733000" }, { "tcp_stream": 540, "frame_number": 18935, "display_filter": "frame.number == 18935", "timestamp_epoch": "1533964960.247858000" }, { "tcp_stream": 810, "frame_number": 30257, "display_filter": "frame.number == 30257", "timestamp_epoch": "1533965098.377029000" }, { "tcp_stream": 811, "frame_number": 30258, "display_filter": "frame.number == 30258", "timestamp_epoch": "1533965098.377030000" } ], "is_private": null, "observable_id": "observable-92bfb54320330c5bad6bebba", "last_seen_epoch": "1533965098.377030000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964959.616289000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "pixel-us-east.rubiconproject.net.akadns.net", "evidence": [ { "udp_stream": 196, "frame_number": 18786, "display_filter": "frame.number == 18786", "timestamp_epoch": "1533964960.049215000" } ], "is_private": null, "observable_id": "observable-b997abc0b05b7a562321ba67", "last_seen_epoch": "1533964960.049215000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964960.049215000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "pixel.advertising.com", "evidence": [ { "udp_stream": 102, "frame_number": 8916, "display_filter": "frame.number == 8916", "timestamp_epoch": "1533964898.857493000" }, { "udp_stream": 102, "frame_number": 8976, "display_filter": "frame.number == 8976", "timestamp_epoch": "1533964898.938935000" }, { "tcp_stream": 241, "frame_number": 9013, "display_filter": "frame.number == 9013", "timestamp_epoch": "1533964898.995095000" }, { "tcp_stream": 240, "frame_number": 9028, "display_filter": "frame.number == 9028", "timestamp_epoch": "1533964898.996894000" }, { "tcp_stream": 807, "frame_number": 29803, "display_filter": "frame.number == 29803", "timestamp_epoch": "1533965097.615870000" }, { "tcp_stream": 806, "frame_number": 29810, "display_filter": "frame.number == 29810", "timestamp_epoch": "1533965097.616243000" } ], "is_private": null, "observable_id": "observable-0b8996a7c95e2b06e026b2c3", "last_seen_epoch": "1533965097.616243000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964898.857493000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "pixel.quantserve.com", "evidence": [ { "udp_stream": 98, "frame_number": 8910, "display_filter": "frame.number == 8910", "timestamp_epoch": "1533964898.853770000" }, { "udp_stream": 98, "frame_number": 8958, "display_filter": "frame.number == 8958", "timestamp_epoch": "1533964898.930359000" }, { "tcp_stream": 231, "frame_number": 9041, "display_filter": "frame.number == 9041", "timestamp_epoch": "1533964899.006328000" }, { "tcp_stream": 230, "frame_number": 9045, "display_filter": "frame.number == 9045", "timestamp_epoch": "1533964899.006696000" } ], "is_private": null, "observable_id": "observable-df3b20173a6d44e545e69bf4", "last_seen_epoch": "1533964899.006696000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964898.853770000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "pixel.rubiconproject.com", "evidence": [ { "udp_stream": 175, "frame_number": 16557, "display_filter": "frame.number == 16557", "timestamp_epoch": "1533964910.070782000" }, { "udp_stream": 175, "frame_number": 16602, "display_filter": "frame.number == 16602", "timestamp_epoch": "1533964910.201908000" }, { "tcp_stream": 472, "frame_number": 16630, "display_filter": "frame.number == 16630", "timestamp_epoch": "1533964910.249486000" }, { "tcp_stream": 473, "frame_number": 16633, "display_filter": "frame.number == 16633", "timestamp_epoch": "1533964910.249866000" }, { "tcp_stream": 474, "frame_number": 16637, "display_filter": "frame.number == 16637", "timestamp_epoch": "1533964910.251487000" }, { "tcp_stream": 475, "frame_number": 16643, "display_filter": "frame.number == 16643", "timestamp_epoch": "1533964910.254776000" }, { "tcp_stream": 476, "frame_number": 16644, "display_filter": "frame.number == 16644", "timestamp_epoch": "1533964910.255157000" }, { "tcp_stream": 642, "frame_number": 23558, "display_filter": "frame.number == 23558", "timestamp_epoch": "1533964997.703961000" }, { "tcp_stream": 643, "frame_number": 23559, "display_filter": "frame.number == 23559", "timestamp_epoch": "1533964997.704063000" }, { "tcp_stream": 644, "frame_number": 23590, "display_filter": "frame.number == 23590", "timestamp_epoch": "1533964997.751001000" }, { "tcp_stream": 649, "frame_number": 23627, "display_filter": "frame.number == 23627", "timestamp_epoch": "1533964997.805395000" }, { "tcp_stream": 650, "frame_number": 23660, "display_filter": "frame.number == 23660", "timestamp_epoch": "1533964997.843178000" }, { "tcp_stream": 653, "frame_number": 23664, "display_filter": "frame.number == 23664", "timestamp_epoch": "1533964997.845875000" }, { "tcp_stream": 846, "frame_number": 31586, "display_filter": "frame.number == 31586", "timestamp_epoch": "1533965100.689701000" }, { "tcp_stream": 845, "frame_number": 31588, "display_filter": "frame.number == 31588", "timestamp_epoch": "1533965100.689703000" }, { "tcp_stream": 847, "frame_number": 31601, "display_filter": "frame.number == 31601", "timestamp_epoch": "1533965100.693842000" }, { "tcp_stream": 848, "frame_number": 31602, "display_filter": "frame.number == 31602", "timestamp_epoch": "1533965100.693894000" }, { "tcp_stream": 851, "frame_number": 31667, "display_filter": "frame.number == 31667", "timestamp_epoch": "1533965100.795642000" }, { "tcp_stream": 855, "frame_number": 31697, "display_filter": "frame.number == 31697", "timestamp_epoch": "1533965100.808279000" } ], "is_private": null, "observable_id": "observable-8d2a1ba9cf1336a35b3deec6", "last_seen_epoch": "1533965100.808279000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964910.070782000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "pixel.rubiconproject.net.akadns.net", "evidence": [ { "udp_stream": 175, "frame_number": 16602, "display_filter": "frame.number == 16602", "timestamp_epoch": "1533964910.201908000" } ], "is_private": null, "observable_id": "observable-4694891b72b0db6cd56f734e", "last_seen_epoch": "1533964910.201908000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964910.201908000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "pixel.sitescout.com", "evidence": [ { "udp_stream": 80, "frame_number": 6060, "display_filter": "frame.number == 6060", "timestamp_epoch": "1533964559.747861000" }, { "udp_stream": 80, "frame_number": 6137, "display_filter": "frame.number == 6137", "timestamp_epoch": "1533964559.872487000" }, { "tcp_stream": 154, "frame_number": 6163, "display_filter": "frame.number == 6163", "timestamp_epoch": "1533964559.928446000" }, { "tcp_stream": 155, "frame_number": 6165, "display_filter": "frame.number == 6165", "timestamp_epoch": "1533964559.928564000" }, { "tcp_stream": 542, "frame_number": 18904, "display_filter": "frame.number == 18904", "timestamp_epoch": "1533964960.217591000" }, { "tcp_stream": 541, "frame_number": 18908, "display_filter": "frame.number == 18908", "timestamp_epoch": "1533964960.218196000" } ], "is_private": null, "observable_id": "observable-5b6ce2b9b56197124f139a25", "last_seen_epoch": "1533964960.218196000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964559.747861000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "pixel.tapad.com", "evidence": [ { "udp_stream": 211, "frame_number": 20027, "display_filter": "frame.number == 20027", "timestamp_epoch": "1533964964.071735000" }, { "udp_stream": 211, "frame_number": 20032, "display_filter": "frame.number == 20032", "timestamp_epoch": "1533964964.154372000" }, { "tcp_stream": 577, "frame_number": 20039, "display_filter": "frame.number == 20039", "timestamp_epoch": "1533964964.213934000" }, { "tcp_stream": 578, "frame_number": 20045, "display_filter": "frame.number == 20045", "timestamp_epoch": "1533964964.263207000" }, { "tcp_stream": 843, "frame_number": 31583, "display_filter": "frame.number == 31583", "timestamp_epoch": "1533965100.689333000" }, { "tcp_stream": 844, "frame_number": 31585, "display_filter": "frame.number == 31585", "timestamp_epoch": "1533965100.689530000" } ], "is_private": null, "observable_id": "observable-b39ddba5a08e5303b6cc8064", "last_seen_epoch": "1533965100.689530000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964964.071735000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "pixeltrack.eyeviewads.com", "evidence": [ { "udp_stream": 254, "frame_number": 26990, "display_filter": "frame.number == 26990", "timestamp_epoch": "1533965034.039742000" }, { "udp_stream": 254, "frame_number": 27021, "display_filter": "frame.number == 27021", "timestamp_epoch": "1533965034.135661000" }, { "tcp_stream": 725, "frame_number": 27059, "display_filter": "frame.number == 27059", "timestamp_epoch": "1533965034.290246000" }, { "tcp_stream": 726, "frame_number": 27065, "display_filter": "frame.number == 27065", "timestamp_epoch": "1533965034.293084000" } ], "is_private": null, "observable_id": "observable-b9abdd413cce01685a02612e", "last_seen_epoch": "1533965034.293084000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965034.039742000" }, { "type": "domain", "roles": [ "dns-query", "http-host", "tls-sni" ], "value": "platform.twitter.com", "evidence": [ { "udp_stream": 343, "frame_number": 43647, "display_filter": "frame.number == 43647", "timestamp_epoch": "1533965783.031263000" }, { "udp_stream": 343, "frame_number": 43671, "display_filter": "frame.number == 43671", "timestamp_epoch": "1533965783.112888000" }, { "tcp_stream": 1150, "frame_number": 43698, "display_filter": "frame.number == 43698", "timestamp_epoch": "1533965783.176462000" }, { "tcp_stream": 1163, "frame_number": 44150, "display_filter": "frame.number == 44150", "timestamp_epoch": "1533965784.337315000" } ], "is_private": null, "observable_id": "observable-3a48bae8cb7731092b62319d", "last_seen_epoch": "1533965784.337315000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965783.031263000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "pm.w55c.net", "evidence": [ { "udp_stream": 222, "frame_number": 22986, "display_filter": "frame.number == 22986", "timestamp_epoch": "1533964996.335466000" }, { "udp_stream": 222, "frame_number": 23033, "display_filter": "frame.number == 23033", "timestamp_epoch": "1533964996.474799000" }, { "tcp_stream": 619, "frame_number": 23062, "display_filter": "frame.number == 23062", "timestamp_epoch": "1533964996.584481000" }, { "tcp_stream": 618, "frame_number": 23069, "display_filter": "frame.number == 23069", "timestamp_epoch": "1533964996.585577000" } ], "is_private": null, "observable_id": "observable-348543086827afd346122484", "last_seen_epoch": "1533964996.585577000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964996.335466000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "pmp.mxptint.net", "evidence": [ { "udp_stream": 224, "frame_number": 22988, "display_filter": "frame.number == 22988", "timestamp_epoch": "1533964996.338424000" }, { "udp_stream": 224, "frame_number": 23034, "display_filter": "frame.number == 23034", "timestamp_epoch": "1533964996.474895000" }, { "tcp_stream": 616, "frame_number": 23080, "display_filter": "frame.number == 23080", "timestamp_epoch": "1533964996.591113000" }, { "tcp_stream": 617, "frame_number": 23084, "display_filter": "frame.number == 23084", "timestamp_epoch": "1533964996.603708000" } ], "is_private": null, "observable_id": "observable-627c334137ed87675a3ef4bb", "last_seen_epoch": "1533964996.603708000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964996.338424000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "pool.tokyo.iponweb.net", "evidence": [ { "udp_stream": 120, "frame_number": 23682, "display_filter": "frame.number == 23682", "timestamp_epoch": "1533964997.887170000" } ], "is_private": null, "observable_id": "observable-8d8cc838440243cbb68b4280", "last_seen_epoch": "1533964997.887170000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964997.887170000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "pop.yandex.com", "evidence": [ { "udp_stream": 87, "frame_number": 6566, "display_filter": "frame.number == 6566", "timestamp_epoch": "1533964577.036284000" }, { "udp_stream": 87, "frame_number": 6567, "display_filter": "frame.number == 6567", "timestamp_epoch": "1533964577.203660000" }, { "udp_stream": 318, "frame_number": 39813, "display_filter": "frame.number == 39813", "timestamp_epoch": "1533965567.110094000" }, { "udp_stream": 318, "frame_number": 39814, "display_filter": "frame.number == 39814", "timestamp_epoch": "1533965567.514714000" }, { "tcp_stream": 166, "frame_number": 6571, "display_filter": "frame.number == 6571", "timestamp_epoch": "1533964577.639943000" }, { "tcp_stream": 177, "frame_number": 7200, "display_filter": "frame.number == 7200", "timestamp_epoch": "1533964761.191924000" }, { "tcp_stream": 1056, "frame_number": 39818, "display_filter": "frame.number == 39818", "timestamp_epoch": "1533965567.875578000" } ], "is_private": null, "observable_id": "observable-f2d3174c71c159ee60e29404", "last_seen_epoch": "1533965567.875578000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964577.036284000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "pop.yandex.ru", "evidence": [ { "udp_stream": 87, "frame_number": 6567, "display_filter": "frame.number == 6567", "timestamp_epoch": "1533964577.203660000" }, { "udp_stream": 318, "frame_number": 39814, "display_filter": "frame.number == 39814", "timestamp_epoch": "1533965567.514714000" } ], "is_private": null, "observable_id": "observable-b8ebc93e8e7620bb9f25020a", "last_seen_epoch": "1533965567.514714000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964577.203660000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "pp.lp4.io", "evidence": [ { "udp_stream": 29, "frame_number": 593, "display_filter": "frame.number == 593", "timestamp_epoch": "1533964545.560553000" }, { "udp_stream": 29, "frame_number": 605, "display_filter": "frame.number == 605", "timestamp_epoch": "1533964545.630742000" }, { "tcp_stream": 43, "frame_number": 712, "display_filter": "frame.number == 712", "timestamp_epoch": "1533964545.855496000" }, { "tcp_stream": 44, "frame_number": 730, "display_filter": "frame.number == 730", "timestamp_epoch": "1533964545.873598000" }, { "tcp_stream": 136, "frame_number": 5919, "display_filter": "frame.number == 5919", "timestamp_epoch": "1533964559.550519000" }, { "tcp_stream": 137, "frame_number": 5922, "display_filter": "frame.number == 5922", "timestamp_epoch": "1533964559.550786000" }, { "tcp_stream": 170, "frame_number": 6690, "display_filter": "frame.number == 6690", "timestamp_epoch": "1533964622.291023000" }, { "tcp_stream": 171, "frame_number": 6691, "display_filter": "frame.number == 6691", "timestamp_epoch": "1533964622.291025000" }, { "tcp_stream": 173, "frame_number": 7136, "display_filter": "frame.number == 7136", "timestamp_epoch": "1533964682.159024000" }, { "tcp_stream": 174, "frame_number": 7140, "display_filter": "frame.number == 7140", "timestamp_epoch": "1533964682.167350000" }, { "tcp_stream": 183, "frame_number": 7378, "display_filter": "frame.number == 7378", "timestamp_epoch": "1533964894.375662000" }, { "tcp_stream": 182, "frame_number": 7382, "display_filter": "frame.number == 7382", "timestamp_epoch": "1533964894.376436000" }, { "tcp_stream": 1022, "frame_number": 39177, "display_filter": "frame.number == 39177", "timestamp_epoch": "1533965245.889150000" }, { "tcp_stream": 1023, "frame_number": 39181, "display_filter": "frame.number == 39181", "timestamp_epoch": "1533965245.895481000" } ], "is_private": null, "observable_id": "observable-7e786227c2c45979014fe7d4", "last_seen_epoch": "1533965245.895481000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964545.560553000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "pr-bh.ybp.gysm.yahoodns.net", "evidence": [ { "udp_stream": 64, "frame_number": 5121, "display_filter": "frame.number == 5121", "timestamp_epoch": "1533964555.984478000" }, { "udp_stream": 363, "frame_number": 46038, "display_filter": "frame.number == 46038", "timestamp_epoch": "1533965789.567878000" } ], "is_private": null, "observable_id": "observable-b898229e3cd130c5431c097f", "last_seen_epoch": "1533965789.567878000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964555.984478000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "pr-bh.ybp.yahoo.com", "evidence": [ { "udp_stream": 64, "frame_number": 5079, "display_filter": "frame.number == 5079", "timestamp_epoch": "1533964555.921841000" }, { "udp_stream": 64, "frame_number": 5121, "display_filter": "frame.number == 5121", "timestamp_epoch": "1533964555.984478000" }, { "udp_stream": 363, "frame_number": 45993, "display_filter": "frame.number == 45993", "timestamp_epoch": "1533965789.443122000" }, { "udp_stream": 363, "frame_number": 46038, "display_filter": "frame.number == 46038", "timestamp_epoch": "1533965789.567878000" }, { "tcp_stream": 117, "frame_number": 5184, "display_filter": "frame.number == 5184", "timestamp_epoch": "1533964556.077465000" }, { "tcp_stream": 118, "frame_number": 5188, "display_filter": "frame.number == 5188", "timestamp_epoch": "1533964556.079603000" }, { "tcp_stream": 477, "frame_number": 16736, "display_filter": "frame.number == 16736", "timestamp_epoch": "1533964910.417681000" }, { "tcp_stream": 478, "frame_number": 16749, "display_filter": "frame.number == 16749", "timestamp_epoch": "1533964910.427951000" }, { "tcp_stream": 751, "frame_number": 27559, "display_filter": "frame.number == 27559", "timestamp_epoch": "1533965035.723614000" }, { "tcp_stream": 750, "frame_number": 27560, "display_filter": "frame.number == 27560", "timestamp_epoch": "1533965035.723615000" }, { "tcp_stream": 937, "frame_number": 33914, "display_filter": "frame.number == 33914", "timestamp_epoch": "1533965157.843657000" }, { "tcp_stream": 936, "frame_number": 33921, "display_filter": "frame.number == 33921", "timestamp_epoch": "1533965157.844645000" }, { "tcp_stream": 1215, "frame_number": 46091, "display_filter": "frame.number == 46091", "timestamp_epoch": "1533965789.730636000" }, { "tcp_stream": 1214, "frame_number": 46092, "display_filter": "frame.number == 46092", "timestamp_epoch": "1533965789.730637000" } ], "is_private": null, "observable_id": "observable-a126fe54f8ce5682702972b1", "last_seen_epoch": "1533965789.730637000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964555.921841000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "pre-usermatch.targeting.unrulymedia.com", "evidence": [ { "udp_stream": 306, "frame_number": 35497, "display_filter": "frame.number == 35497", "timestamp_epoch": "1533965160.271885000" }, { "udp_stream": 306, "frame_number": 35556, "display_filter": "frame.number == 35556", "timestamp_epoch": "1533965160.381946000" }, { "tcp_stream": 970, "frame_number": 35635, "display_filter": "frame.number == 35635", "timestamp_epoch": "1533965160.493902000" }, { "tcp_stream": 971, "frame_number": 35643, "display_filter": "frame.number == 35643", "timestamp_epoch": "1533965160.503041000" } ], "is_private": null, "observable_id": "observable-657cb93836feea7bb029313f", "last_seen_epoch": "1533965160.503041000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965160.271885000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "prod-dem-collector-elb-611025824.eu-west-1.elb.amazonaws.com", "evidence": [ { "udp_stream": 73, "frame_number": 5860, "display_filter": "frame.number == 5860", "timestamp_epoch": "1533964559.445991000" } ], "is_private": null, "observable_id": "observable-d2661cb38f1da2ae0a68e1bb", "last_seen_epoch": "1533964559.445991000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964559.445991000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "prod.appnexus.map.fastly.net", "evidence": [ { "udp_stream": 201, "frame_number": 19305, "display_filter": "frame.number == 19305", "timestamp_epoch": "1533964961.766961000" }, { "udp_stream": 226, "frame_number": 23216, "display_filter": "frame.number == 23216", "timestamp_epoch": "1533964997.081499000" } ], "is_private": null, "observable_id": "observable-0127f71438fb6619bbed9b83", "last_seen_epoch": "1533964997.081499000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964961.766961000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "prod.contextweb.map.fastlylb.net", "evidence": [ { "udp_stream": 246, "frame_number": 26420, "display_filter": "frame.number == 26420", "timestamp_epoch": "1533965032.696494000" } ], "is_private": null, "observable_id": "observable-aa25b6613b43f9145a8e76c9", "last_seen_epoch": "1533965032.696494000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965032.696494000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "prod.outbrain.map.fastlylb.net", "evidence": [ { "udp_stream": 138, "frame_number": 13349, "display_filter": "frame.number == 13349", "timestamp_epoch": "1533964903.242983000" } ], "is_private": null, "observable_id": "observable-beaab0e8c5b53356aaba3247", "last_seen_epoch": "1533964903.242983000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964903.242983000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "prod.y-medialink.com", "evidence": [ { "udp_stream": 263, "frame_number": 27451, "display_filter": "frame.number == 27451", "timestamp_epoch": "1533965035.621107000" }, { "udp_stream": 263, "frame_number": 27526, "display_filter": "frame.number == 27526", "timestamp_epoch": "1533965035.690931000" }, { "tcp_stream": 758, "frame_number": 27621, "display_filter": "frame.number == 27621", "timestamp_epoch": "1533965035.782912000" }, { "tcp_stream": 757, "frame_number": 27626, "display_filter": "frame.number == 27626", "timestamp_epoch": "1533965035.783476000" } ], "is_private": null, "observable_id": "observable-0fdc17515adbf7a03fec3559", "last_seen_epoch": "1533965035.783476000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965035.621107000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "pubads.g.doubleclick.net", "evidence": [ { "udp_stream": 183, "frame_number": 18026, "display_filter": "frame.number == 18026", "timestamp_epoch": "1533964957.807117000" }, { "udp_stream": 183, "frame_number": 18111, "display_filter": "frame.number == 18111", "timestamp_epoch": "1533964958.070258000" }, { "tcp_stream": 504, "frame_number": 18134, "display_filter": "frame.number == 18134", "timestamp_epoch": "1533964958.132879000" }, { "tcp_stream": 505, "frame_number": 18135, "display_filter": "frame.number == 18135", "timestamp_epoch": "1533964958.133287000" } ], "is_private": null, "observable_id": "observable-6047aaca5aa5c37fe84a2c19", "last_seen_epoch": "1533964958.133287000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964957.807117000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "pubmatic-match.dotomi.com", "evidence": [ { "udp_stream": 168, "frame_number": 15985, "display_filter": "frame.number == 15985", "timestamp_epoch": "1533964908.336781000" }, { "udp_stream": 168, "frame_number": 16039, "display_filter": "frame.number == 16039", "timestamp_epoch": "1533964908.424347000" }, { "tcp_stream": 455, "frame_number": 16105, "display_filter": "frame.number == 16105", "timestamp_epoch": "1533964908.481382000" }, { "tcp_stream": 456, "frame_number": 16106, "display_filter": "frame.number == 16106", "timestamp_epoch": "1533964908.481558000" } ], "is_private": null, "observable_id": "observable-d013560856fc443728361e54", "last_seen_epoch": "1533964908.481558000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964908.336781000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "pubmatic2waycm-atl.netmng.com", "evidence": [ { "udp_stream": 169, "frame_number": 15986, "display_filter": "frame.number == 15986", "timestamp_epoch": "1533964908.338567000" }, { "udp_stream": 169, "frame_number": 16028, "display_filter": "frame.number == 16028", "timestamp_epoch": "1533964908.406114000" }, { "tcp_stream": 452, "frame_number": 16166, "display_filter": "frame.number == 16166", "timestamp_epoch": "1533964908.543281000" }, { "tcp_stream": 451, "frame_number": 16176, "display_filter": "frame.number == 16176", "timestamp_epoch": "1533964908.544102000" } ], "is_private": null, "observable_id": "observable-036721e5f9c08e95b177f8a9", "last_seen_epoch": "1533964908.544102000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964908.338567000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "px-us-ca.adhigh.net", "evidence": [ { "udp_stream": 223, "frame_number": 23086, "display_filter": "frame.number == 23086", "timestamp_epoch": "1533964996.618558000" }, { "udp_stream": 361, "frame_number": 46077, "display_filter": "frame.number == 46077", "timestamp_epoch": "1533965789.700898000" } ], "is_private": null, "observable_id": "observable-1200c1fbdccafee93c257673", "last_seen_epoch": "1533965789.700898000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964996.618558000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "px.adhigh.net", "evidence": [ { "udp_stream": 223, "frame_number": 22987, "display_filter": "frame.number == 22987", "timestamp_epoch": "1533964996.337677000" }, { "udp_stream": 223, "frame_number": 23086, "display_filter": "frame.number == 23086", "timestamp_epoch": "1533964996.618558000" }, { "udp_stream": 361, "frame_number": 45975, "display_filter": "frame.number == 45975", "timestamp_epoch": "1533965789.421325000" }, { "udp_stream": 361, "frame_number": 46077, "display_filter": "frame.number == 46077", "timestamp_epoch": "1533965789.700898000" }, { "tcp_stream": 621, "frame_number": 23116, "display_filter": "frame.number == 23116", "timestamp_epoch": "1533964996.711933000" }, { "tcp_stream": 620, "frame_number": 23118, "display_filter": "frame.number == 23118", "timestamp_epoch": "1533964996.712394000" }, { "tcp_stream": 1218, "frame_number": 46103, "display_filter": "frame.number == 46103", "timestamp_epoch": "1533965789.758127000" }, { "tcp_stream": 1219, "frame_number": 46108, "display_filter": "frame.number == 46108", "timestamp_epoch": "1533965789.759136000" } ], "is_private": null, "observable_id": "observable-e46806fd32691487e29a329d", "last_seen_epoch": "1533965789.759136000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964996.337677000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "px.moatads.com", "evidence": [ { "udp_stream": 133, "frame_number": 12552, "display_filter": "frame.number == 12552", "timestamp_epoch": "1533964902.453057000" }, { "udp_stream": 133, "frame_number": 12591, "display_filter": "frame.number == 12591", "timestamp_epoch": "1533964902.539371000" }, { "tcp_stream": 324, "frame_number": 12638, "display_filter": "frame.number == 12638", "timestamp_epoch": "1533964902.589662000" }, { "tcp_stream": 325, "frame_number": 12671, "display_filter": "frame.number == 12671", "timestamp_epoch": "1533964902.643109000" }, { "tcp_stream": 1032, "frame_number": 39345, "display_filter": "frame.number == 39345", "timestamp_epoch": "1533965247.222636000" }, { "tcp_stream": 1031, "frame_number": 39348, "display_filter": "frame.number == 39348", "timestamp_epoch": "1533965247.223208000" } ], "is_private": null, "observable_id": "observable-7aa890a1dfa0523f7d51e3fb", "last_seen_epoch": "1533965247.223208000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964902.453057000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "px.owneriq.net", "evidence": [ { "udp_stream": 243, "frame_number": 26358, "display_filter": "frame.number == 26358", "timestamp_epoch": "1533965032.569139000" }, { "udp_stream": 243, "frame_number": 26414, "display_filter": "frame.number == 26414", "timestamp_epoch": "1533965032.677681000" }, { "tcp_stream": 702, "frame_number": 26473, "display_filter": "frame.number == 26473", "timestamp_epoch": "1533965032.793305000" }, { "tcp_stream": 703, "frame_number": 26475, "display_filter": "frame.number == 26475", "timestamp_epoch": "1533965032.793308000" }, { "tcp_stream": 852, "frame_number": 31651, "display_filter": "frame.number == 31651", "timestamp_epoch": "1533965100.791005000" }, { "tcp_stream": 853, "frame_number": 31666, "display_filter": "frame.number == 31666", "timestamp_epoch": "1533965100.795540000" } ], "is_private": null, "observable_id": "observable-423c8b70620caaedf99c3a90", "last_seen_epoch": "1533965100.795540000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965032.569139000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "px.powerlinks.com", "evidence": [ { "udp_stream": 273, "frame_number": 30390, "display_filter": "frame.number == 30390", "timestamp_epoch": "1533965098.616151000" }, { "udp_stream": 273, "frame_number": 30652, "display_filter": "frame.number == 30652", "timestamp_epoch": "1533965099.045919000" }, { "tcp_stream": 830, "frame_number": 31064, "display_filter": "frame.number == 31064", "timestamp_epoch": "1533965099.788712000" }, { "tcp_stream": 831, "frame_number": 31065, "display_filter": "frame.number == 31065", "timestamp_epoch": "1533965099.788714000" } ], "is_private": null, "observable_id": "observable-1d279e8d30452581de430ff3", "last_seen_epoch": "1533965099.788714000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965098.616151000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "pxl.connexity.net", "evidence": [ { "udp_stream": 268, "frame_number": 27462, "display_filter": "frame.number == 27462", "timestamp_epoch": "1533965035.643053000" }, { "udp_stream": 268, "frame_number": 27576, "display_filter": "frame.number == 27576", "timestamp_epoch": "1533965035.747687000" }, { "tcp_stream": 769, "frame_number": 27669, "display_filter": "frame.number == 27669", "timestamp_epoch": "1533965035.841137000" }, { "tcp_stream": 768, "frame_number": 27677, "display_filter": "frame.number == 27677", "timestamp_epoch": "1533965035.846302000" } ], "is_private": null, "observable_id": "observable-2453d50bb7e4e17ef4c75e82", "last_seen_epoch": "1533965035.846302000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965035.643053000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "qcx.quantserve.com", "evidence": [ { "udp_stream": 142, "frame_number": 13463, "display_filter": "frame.number == 13463", "timestamp_epoch": "1533964903.459819000" }, { "udp_stream": 142, "frame_number": 13537, "display_filter": "frame.number == 13537", "timestamp_epoch": "1533964903.535108000" }, { "tcp_stream": 352, "frame_number": 13611, "display_filter": "frame.number == 13611", "timestamp_epoch": "1533964903.595117000" } ], "is_private": null, "observable_id": "observable-c4fb16c91ff7cd18c93ad7e3", "last_seen_epoch": "1533964903.595117000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964903.459819000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "r.nexac.com", "evidence": [ { "udp_stream": 239, "frame_number": 24026, "display_filter": "frame.number == 24026", "timestamp_epoch": "1533964999.378273000" }, { "udp_stream": 239, "frame_number": 24037, "display_filter": "frame.number == 24037", "timestamp_epoch": "1533964999.457617000" }, { "tcp_stream": 668, "frame_number": 24069, "display_filter": "frame.number == 24069", "timestamp_epoch": "1533964999.556954000" }, { "tcp_stream": 669, "frame_number": 24070, "display_filter": "frame.number == 24070", "timestamp_epoch": "1533964999.557035000" } ], "is_private": null, "observable_id": "observable-85b74252da91721d4e1fa8f6", "last_seen_epoch": "1533964999.557035000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964999.378273000" }, { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "r53x.com", "evidence": [ { "udp_stream": 89, "frame_number": 7256, "display_filter": "frame.number == 7256", "timestamp_epoch": "1533964849.660908000" }, { "udp_stream": 89, "frame_number": 7259, "display_filter": "frame.number == 7259", "timestamp_epoch": "1533964850.053278000" }, { "tcp_stream": 178, "frame_number": 7263, "display_filter": "frame.number == 7263", "timestamp_epoch": "1533964850.464296000" }, { "tcp_stream": 179, "frame_number": 7277, "display_filter": "frame.number == 7277", "timestamp_epoch": "1533964857.855860000" }, { "tcp_stream": 179, "frame_number": 7280, "display_filter": "frame.number == 7280", "timestamp_epoch": "1533964858.738093000" } ], "is_private": null, "observable_id": "observable-4ffac87c81591710ab6d3e1c", "last_seen_epoch": "1533964858.738093000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964849.660908000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "rbp.mxptint.net", "evidence": [ { "udp_stream": 230, "frame_number": 23262, "display_filter": "frame.number == 23262", "timestamp_epoch": "1533964997.192053000" }, { "udp_stream": 230, "frame_number": 23300, "display_filter": "frame.number == 23300", "timestamp_epoch": "1533964997.294014000" }, { "tcp_stream": 637, "frame_number": 23394, "display_filter": "frame.number == 23394", "timestamp_epoch": "1533964997.397872000" }, { "tcp_stream": 636, "frame_number": 23395, "display_filter": "frame.number == 23395", "timestamp_epoch": "1533964997.397874000" } ], "is_private": null, "observable_id": "observable-fbe494ec6ac0c31dc67925bf", "last_seen_epoch": "1533964997.397874000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964997.192053000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "recs.engageya.com", "evidence": [ { "udp_stream": 96, "frame_number": 8579, "display_filter": "frame.number == 8579", "timestamp_epoch": "1533964898.482071000" }, { "udp_stream": 96, "frame_number": 8628, "display_filter": "frame.number == 8628", "timestamp_epoch": "1533964898.548203000" }, { "tcp_stream": 224, "frame_number": 8801, "display_filter": "frame.number == 8801", "timestamp_epoch": "1533964898.751838000" }, { "tcp_stream": 223, "frame_number": 8805, "display_filter": "frame.number == 8805", "timestamp_epoch": "1533964898.752738000" } ], "is_private": null, "observable_id": "observable-ee54ca12a257766bcf294ef1", "last_seen_epoch": "1533964898.752738000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964898.482071000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "relap.io", "evidence": [ { "udp_stream": 365, "frame_number": 46366, "display_filter": "frame.number == 46366", "timestamp_epoch": "1533965791.000009000" }, { "udp_stream": 365, "frame_number": 46422, "display_filter": "frame.number == 46422", "timestamp_epoch": "1533965791.276701000" }, { "tcp_stream": 1226, "frame_number": 46565, "display_filter": "frame.number == 46565", "timestamp_epoch": "1533965791.718122000" }, { "tcp_stream": 1227, "frame_number": 46571, "display_filter": "frame.number == 46571", "timestamp_epoch": "1533965791.730140000" } ], "is_private": null, "observable_id": "observable-f3a959fcb6569669910e9947", "last_seen_epoch": "1533965791.730140000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965791.000009000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "rp.gwallet.com", "evidence": [ { "udp_stream": 253, "frame_number": 26769, "display_filter": "frame.number == 26769", "timestamp_epoch": "1533965033.590617000" }, { "udp_stream": 253, "frame_number": 26821, "display_filter": "frame.number == 26821", "timestamp_epoch": "1533965033.693499000" }, { "tcp_stream": 722, "frame_number": 26878, "display_filter": "frame.number == 26878", "timestamp_epoch": "1533965033.770456000" }, { "tcp_stream": 721, "frame_number": 26880, "display_filter": "frame.number == 26880", "timestamp_epoch": "1533965033.771149000" }, { "tcp_stream": 935, "frame_number": 33905, "display_filter": "frame.number == 33905", "timestamp_epoch": "1533965157.828358000" }, { "tcp_stream": 934, "frame_number": 33906, "display_filter": "frame.number == 33906", "timestamp_epoch": "1533965157.828453000" } ], "is_private": null, "observable_id": "observable-65618a4c15665225c61e52c0", "last_seen_epoch": "1533965157.828453000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965033.590617000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "rs-lb-b.lkqd.net", "evidence": [ { "udp_stream": 157, "frame_number": 14679, "display_filter": "frame.number == 14679", "timestamp_epoch": "1533964904.689217000" } ], "is_private": null, "observable_id": "observable-c6e3119a491151bff31bce5c", "last_seen_epoch": "1533964904.689217000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964904.689217000" }, { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "rtax.criteo.com", "evidence": [ { "udp_stream": 338, "frame_number": 43639, "display_filter": "frame.number == 43639", "timestamp_epoch": "1533965783.004773000" }, { "udp_stream": 338, "frame_number": 43659, "display_filter": "frame.number == 43659", "timestamp_epoch": "1533965783.084459000" }, { "tcp_stream": 1146, "frame_number": 43682, "display_filter": "frame.number == 43682", "timestamp_epoch": "1533965783.173153000" } ], "is_private": null, "observable_id": "observable-f601a2cb548db8cb2a783507", "last_seen_epoch": "1533965783.173153000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965783.004773000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "rtb-csync.smartadserver.com", "evidence": [ { "udp_stream": 265, "frame_number": 27457, "display_filter": "frame.number == 27457", "timestamp_epoch": "1533965035.633952000" }, { "udp_stream": 265, "frame_number": 27532, "display_filter": "frame.number == 27532", "timestamp_epoch": "1533965035.693277000" }, { "tcp_stream": 755, "frame_number": 27777, "display_filter": "frame.number == 27777", "timestamp_epoch": "1533965035.957742000" }, { "tcp_stream": 756, "frame_number": 27789, "display_filter": "frame.number == 27789", "timestamp_epoch": "1533965035.964944000" } ], "is_private": null, "observable_id": "observable-7da06e59cac063e4b6369bc4", "last_seen_epoch": "1533965035.964944000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965035.633952000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "rtb.adentifi.com", "evidence": [ { "udp_stream": 300, "frame_number": 33846, "display_filter": "frame.number == 33846", "timestamp_epoch": "1533965157.683154000" }, { "udp_stream": 300, "frame_number": 33970, "display_filter": "frame.number == 33970", "timestamp_epoch": "1533965157.910445000" }, { "tcp_stream": 945, "frame_number": 34262, "display_filter": "frame.number == 34262", "timestamp_epoch": "1533965158.190158000" }, { "tcp_stream": 944, "frame_number": 34270, "display_filter": "frame.number == 34270", "timestamp_epoch": "1533965158.203148000" } ], "is_private": null, "observable_id": "observable-237c2cef576f2649250ea083", "last_seen_epoch": "1533965158.203148000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965157.683154000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "rtb.adgrx.com", "evidence": [ { "udp_stream": 276, "frame_number": 30803, "display_filter": "frame.number == 30803", "timestamp_epoch": "1533965099.278838000" } ], "is_private": null, "observable_id": "observable-7f8ecbd1ac90287c017557a9", "last_seen_epoch": "1533965099.278838000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965099.278838000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "rtb.gumgum.com", "evidence": [ { "udp_stream": 155, "frame_number": 14565, "display_filter": "frame.number == 14565", "timestamp_epoch": "1533964904.595064000" }, { "udp_stream": 155, "frame_number": 14641, "display_filter": "frame.number == 14641", "timestamp_epoch": "1533964904.664048000" }, { "tcp_stream": 403, "frame_number": 14758, "display_filter": "frame.number == 14758", "timestamp_epoch": "1533964904.744354000" }, { "tcp_stream": 404, "frame_number": 14783, "display_filter": "frame.number == 14783", "timestamp_epoch": "1533964904.753223000" }, { "tcp_stream": 615, "frame_number": 23038, "display_filter": "frame.number == 23038", "timestamp_epoch": "1533964996.476011000" }, { "tcp_stream": 614, "frame_number": 23044, "display_filter": "frame.number == 23044", "timestamp_epoch": "1533964996.477767000" } ], "is_private": null, "observable_id": "observable-02a8995e9e12e950ec006c1c", "last_seen_epoch": "1533964996.477767000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964904.595064000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "rtb.openx.net", "evidence": [ { "udp_stream": 76, "frame_number": 5853, "display_filter": "frame.number == 5853", "timestamp_epoch": "1533964559.407270000" }, { "udp_stream": 76, "frame_number": 5871, "display_filter": "frame.number == 5871", "timestamp_epoch": "1533964559.485487000" }, { "tcp_stream": 146, "frame_number": 5917, "display_filter": "frame.number == 5917", "timestamp_epoch": "1533964559.549991000" }, { "tcp_stream": 148, "frame_number": 5923, "display_filter": "frame.number == 5923", "timestamp_epoch": "1533964559.550920000" } ], "is_private": null, "observable_id": "observable-8863f98a7a5584496b653990", "last_seen_epoch": "1533964559.550920000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964559.407270000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "rtb0.doubleverify.com", "evidence": [ { "udp_stream": 295, "frame_number": 32944, "display_filter": "frame.number == 32944", "timestamp_epoch": "1533965136.578793000" }, { "udp_stream": 295, "frame_number": 32962, "display_filter": "frame.number == 32962", "timestamp_epoch": "1533965136.678702000" }, { "tcp_stream": 900, "frame_number": 32982, "display_filter": "frame.number == 32982", "timestamp_epoch": "1533965136.734297000" }, { "tcp_stream": 901, "frame_number": 32984, "display_filter": "frame.number == 32984", "timestamp_epoch": "1533965136.734621000" }, { "tcp_stream": 1000, "frame_number": 38774, "display_filter": "frame.number == 38774", "timestamp_epoch": "1533965239.837286000" }, { "tcp_stream": 1001, "frame_number": 38778, "display_filter": "frame.number == 38778", "timestamp_epoch": "1533965239.842811000" } ], "is_private": null, "observable_id": "observable-6a273ea72e2d1b6277c76baa", "last_seen_epoch": "1533965239.842811000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965136.578793000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "rtr.innovid.com", "evidence": [ { "udp_stream": 290, "frame_number": 32699, "display_filter": "frame.number == 32699", "timestamp_epoch": "1533965134.785276000" }, { "udp_stream": 290, "frame_number": 32701, "display_filter": "frame.number == 32701", "timestamp_epoch": "1533965134.862529000" }, { "tcp_stream": 891, "frame_number": 32710, "display_filter": "frame.number == 32710", "timestamp_epoch": "1533965134.952080000" }, { "tcp_stream": 890, "frame_number": 32711, "display_filter": "frame.number == 32711", "timestamp_epoch": "1533965134.952249000" }, { "tcp_stream": 996, "frame_number": 38738, "display_filter": "frame.number == 38738", "timestamp_epoch": "1533965239.228582000" }, { "tcp_stream": 997, "frame_number": 38739, "display_filter": "frame.number == 38739", "timestamp_epoch": "1533965239.228584000" } ], "is_private": null, "observable_id": "observable-0ea340e5a86e188e0b49e2ba", "last_seen_epoch": "1533965239.228584000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965134.785276000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "rub.pxl.ace.advertising.com", "evidence": [ { "udp_stream": 229, "frame_number": 23251, "display_filter": "frame.number == 23251", "timestamp_epoch": "1533964997.190207000" }, { "udp_stream": 229, "frame_number": 23322, "display_filter": "frame.number == 23322", "timestamp_epoch": "1533964997.328492000" }, { "tcp_stream": 638, "frame_number": 23410, "display_filter": "frame.number == 23410", "timestamp_epoch": "1533964997.417319000" }, { "tcp_stream": 639, "frame_number": 23411, "display_filter": "frame.number == 23411", "timestamp_epoch": "1533964997.417469000" } ], "is_private": null, "observable_id": "observable-3e0c356a220d1f0120c885fb", "last_seen_epoch": "1533964997.417469000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964997.190207000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "rubicon-match.dotomi.com", "evidence": [ { "udp_stream": 249, "frame_number": 26699, "display_filter": "frame.number == 26699", "timestamp_epoch": "1533965033.401595000" }, { "udp_stream": 249, "frame_number": 26802, "display_filter": "frame.number == 26802", "timestamp_epoch": "1533965033.625618000" }, { "tcp_stream": 719, "frame_number": 26857, "display_filter": "frame.number == 26857", "timestamp_epoch": "1533965033.755397000" }, { "tcp_stream": 720, "frame_number": 26858, "display_filter": "frame.number == 26858", "timestamp_epoch": "1533965033.755512000" } ], "is_private": null, "observable_id": "observable-28fbb95e7fbbc42a23b96719", "last_seen_epoch": "1533965033.755512000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965033.401595000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "rum-collector-2.pingdom.net", "evidence": [ { "udp_stream": 73, "frame_number": 5846, "display_filter": "frame.number == 5846", "timestamp_epoch": "1533964559.371843000" }, { "udp_stream": 73, "frame_number": 5860, "display_filter": "frame.number == 5860", "timestamp_epoch": "1533964559.445991000" }, { "tcp_stream": 140, "frame_number": 5996, "display_filter": "frame.number == 5996", "timestamp_epoch": "1533964559.652325000" }, { "tcp_stream": 141, "frame_number": 5998, "display_filter": "frame.number == 5998", "timestamp_epoch": "1533964559.652692000" }, { "tcp_stream": 383, "frame_number": 14633, "display_filter": "frame.number == 14633", "timestamp_epoch": "1533964904.646300000" }, { "tcp_stream": 382, "frame_number": 14638, "display_filter": "frame.number == 14638", "timestamp_epoch": "1533964904.647172000" } ], "is_private": null, "observable_id": "observable-020bfa234b9f3cefb3b7ea83", "last_seen_epoch": "1533964904.647172000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964559.371843000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "rum-collector.pingdom.net", "evidence": [ { "udp_stream": 74, "frame_number": 5847, "display_filter": "frame.number == 5847", "timestamp_epoch": "1533964559.373718000" }, { "udp_stream": 74, "frame_number": 5863, "display_filter": "frame.number == 5863", "timestamp_epoch": "1533964559.449101000" }, { "tcp_stream": 142, "frame_number": 5883, "display_filter": "frame.number == 5883", "timestamp_epoch": "1533964559.508584000" }, { "tcp_stream": 143, "frame_number": 5891, "display_filter": "frame.number == 5891", "timestamp_epoch": "1533964559.512892000" }, { "tcp_stream": 385, "frame_number": 14493, "display_filter": "frame.number == 14493", "timestamp_epoch": "1533964904.506379000" }, { "tcp_stream": 384, "frame_number": 14499, "display_filter": "frame.number == 14499", "timestamp_epoch": "1533964904.513679000" } ], "is_private": null, "observable_id": "observable-915e90fca04876fbb1627083", "last_seen_epoch": "1533964904.513679000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964559.373718000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "rum-static.pingdom.net", "evidence": [ { "udp_stream": 42, "frame_number": 3056, "display_filter": "frame.number == 3056", "timestamp_epoch": "1533964551.845979000" }, { "udp_stream": 42, "frame_number": 3180, "display_filter": "frame.number == 3180", "timestamp_epoch": "1533964552.350754000" }, { "tcp_stream": 66, "frame_number": 3236, "display_filter": "frame.number == 3236", "timestamp_epoch": "1533964552.452729000" }, { "tcp_stream": 67, "frame_number": 3244, "display_filter": "frame.number == 3244", "timestamp_epoch": "1533964552.457149000" } ], "is_private": null, "observable_id": "observable-45e78d89921aeaaab0f10b80", "last_seen_epoch": "1533964552.457149000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964551.845979000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "ruptly-d.openx.net", "evidence": [ { "udp_stream": 31, "frame_number": 595, "display_filter": "frame.number == 595", "timestamp_epoch": "1533964545.575227000" }, { "udp_stream": 31, "frame_number": 617, "display_filter": "frame.number == 617", "timestamp_epoch": "1533964545.677779000" }, { "tcp_stream": 51, "frame_number": 651, "display_filter": "frame.number == 651", "timestamp_epoch": "1533964545.746485000" }, { "tcp_stream": 52, "frame_number": 659, "display_filter": "frame.number == 659", "timestamp_epoch": "1533964545.748147000" }, { "tcp_stream": 108, "frame_number": 4626, "display_filter": "frame.number == 4626", "timestamp_epoch": "1533964555.042529000" }, { "tcp_stream": 107, "frame_number": 4629, "display_filter": "frame.number == 4629", "timestamp_epoch": "1533964555.043031000" }, { "tcp_stream": 199, "frame_number": 7944, "display_filter": "frame.number == 7944", "timestamp_epoch": "1533964897.818985000" }, { "tcp_stream": 198, "frame_number": 7946, "display_filter": "frame.number == 7946", "timestamp_epoch": "1533964897.819227000" }, { "tcp_stream": 227, "frame_number": 8747, "display_filter": "frame.number == 8747", "timestamp_epoch": "1533964898.710746000" } ], "is_private": null, "observable_id": "observable-40d7913fa415047f0de38360", "last_seen_epoch": "1533964898.710746000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964545.575227000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "s-static.innovid.com", "evidence": [ { "udp_stream": 291, "frame_number": 32735, "display_filter": "frame.number == 32735", "timestamp_epoch": "1533965135.331791000" }, { "udp_stream": 291, "frame_number": 32736, "display_filter": "frame.number == 32736", "timestamp_epoch": "1533965135.439362000" }, { "tcp_stream": 892, "frame_number": 32745, "display_filter": "frame.number == 32745", "timestamp_epoch": "1533965135.491616000" }, { "tcp_stream": 893, "frame_number": 32747, "display_filter": "frame.number == 32747", "timestamp_epoch": "1533965135.491714000" } ], "is_private": null, "observable_id": "observable-5c78f52c22c49b1611a1a88c", "last_seen_epoch": "1533965135.491714000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965135.331791000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "s.amazon-adsystem.com", "evidence": [ { "udp_stream": 101, "frame_number": 8913, "display_filter": "frame.number == 8913", "timestamp_epoch": "1533964898.856145000" }, { "udp_stream": 101, "frame_number": 8957, "display_filter": "frame.number == 8957", "timestamp_epoch": "1533964898.930358000" }, { "tcp_stream": 234, "frame_number": 9086, "display_filter": "frame.number == 9086", "timestamp_epoch": "1533964899.055405000" }, { "tcp_stream": 233, "frame_number": 9088, "display_filter": "frame.number == 9088", "timestamp_epoch": "1533964899.055718000" }, { "tcp_stream": 544, "frame_number": 19098, "display_filter": "frame.number == 19098", "timestamp_epoch": "1533964960.618687000" }, { "tcp_stream": 543, "frame_number": 19101, "display_filter": "frame.number == 19101", "timestamp_epoch": "1533964960.619057000" } ], "is_private": null, "observable_id": "observable-f87c37af5eb886e787990dcb", "last_seen_epoch": "1533964960.619057000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964898.856145000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "s.gycs.b.yahoodns.net", "evidence": [ { "udp_stream": 194, "frame_number": 18742, "display_filter": "frame.number == 18742", "timestamp_epoch": "1533964959.980701000" } ], "is_private": null, "observable_id": "observable-fe3df222de8acea991a5fb40", "last_seen_epoch": "1533964959.980701000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964959.980701000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "s.innovid.com", "evidence": [ { "udp_stream": 293, "frame_number": 32839, "display_filter": "frame.number == 32839", "timestamp_epoch": "1533965136.010238000" }, { "udp_stream": 293, "frame_number": 32841, "display_filter": "frame.number == 32841", "timestamp_epoch": "1533965136.087192000" }, { "tcp_stream": 894, "frame_number": 32878, "display_filter": "frame.number == 32878", "timestamp_epoch": "1533965136.227907000" }, { "tcp_stream": 895, "frame_number": 32880, "display_filter": "frame.number == 32880", "timestamp_epoch": "1533965136.228296000" }, { "tcp_stream": 999, "frame_number": 38768, "display_filter": "frame.number == 38768", "timestamp_epoch": "1533965239.786732000" }, { "tcp_stream": 998, "frame_number": 38770, "display_filter": "frame.number == 38770", "timestamp_epoch": "1533965239.786944000" } ], "is_private": null, "observable_id": "observable-cb643c32a406f574d576366c", "last_seen_epoch": "1533965239.786944000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965136.010238000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "s.thebrighttag.com", "evidence": [ { "udp_stream": 260, "frame_number": 27304, "display_filter": "frame.number == 27304", "timestamp_epoch": "1533965035.353563000" }, { "udp_stream": 260, "frame_number": 27324, "display_filter": "frame.number == 27324", "timestamp_epoch": "1533965035.406855000" }, { "tcp_stream": 738, "frame_number": 27366, "display_filter": "frame.number == 27366", "timestamp_epoch": "1533965035.499245000" }, { "tcp_stream": 739, "frame_number": 27369, "display_filter": "frame.number == 27369", "timestamp_epoch": "1533965035.499724000" } ], "is_private": null, "observable_id": "observable-22739733a5ff64406b6cef0b", "last_seen_epoch": "1533965035.499724000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965035.353563000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "s.ytimg.com", "evidence": [ { "udp_stream": 356, "frame_number": 44989, "display_filter": "frame.number == 44989", "timestamp_epoch": "1533965786.599954000" }, { "udp_stream": 356, "frame_number": 45110, "display_filter": "frame.number == 45110", "timestamp_epoch": "1533965786.890742000" }, { "tcp_stream": 1195, "frame_number": 45296, "display_filter": "frame.number == 45296", "timestamp_epoch": "1533965787.326751000" }, { "tcp_stream": 1196, "frame_number": 45308, "display_filter": "frame.number == 45308", "timestamp_epoch": "1533965787.331292000" } ], "is_private": null, "observable_id": "observable-1df8d2aec8b6709f8fe2484e", "last_seen_epoch": "1533965787.331292000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965786.599954000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "s0-2mdn-net.l.google.com", "evidence": [ { "udp_stream": 116, "frame_number": 10721, "display_filter": "frame.number == 10721", "timestamp_epoch": "1533964900.718497000" } ], "is_private": null, "observable_id": "observable-2df3f21d97039ad62e2a4343", "last_seen_epoch": "1533964900.718497000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964900.718497000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "s0.2mdn.net", "evidence": [ { "udp_stream": 116, "frame_number": 10635, "display_filter": "frame.number == 10635", "timestamp_epoch": "1533964900.651992000" }, { "udp_stream": 116, "frame_number": 10721, "display_filter": "frame.number == 10721", "timestamp_epoch": "1533964900.718497000" }, { "tcp_stream": 287, "frame_number": 10810, "display_filter": "frame.number == 10810", "timestamp_epoch": "1533964900.776539000" }, { "tcp_stream": 286, "frame_number": 10811, "display_filter": "frame.number == 10811", "timestamp_epoch": "1533964900.777020000" }, { "tcp_stream": 496, "frame_number": 17525, "display_filter": "frame.number == 17525", "timestamp_epoch": "1533964956.631645000" } ], "is_private": null, "observable_id": "observable-b4c3b0aceb29fffbb1f1ebd9", "last_seen_epoch": "1533964956.631645000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964900.651992000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "s2.adform.net", "evidence": [ { "udp_stream": 198, "frame_number": 19141, "display_filter": "frame.number == 19141", "timestamp_epoch": "1533964960.729475000" }, { "udp_stream": 198, "frame_number": 19168, "display_filter": "frame.number == 19168", "timestamp_epoch": "1533964960.869060000" }, { "tcp_stream": 547, "frame_number": 19173, "display_filter": "frame.number == 19173", "timestamp_epoch": "1533964960.919412000" }, { "tcp_stream": 548, "frame_number": 19177, "display_filter": "frame.number == 19177", "timestamp_epoch": "1533964960.930591000" }, { "tcp_stream": 953, "frame_number": 35507, "display_filter": "frame.number == 35507", "timestamp_epoch": "1533965160.284050000" }, { "tcp_stream": 952, "frame_number": 35509, "display_filter": "frame.number == 35509", "timestamp_epoch": "1533965160.284262000" }, { "tcp_stream": 1024, "frame_number": 39169, "display_filter": "frame.number == 39169", "timestamp_epoch": "1533965245.870184000" }, { "tcp_stream": 1025, "frame_number": 39173, "display_filter": "frame.number == 39173", "timestamp_epoch": "1533965245.872744000" } ], "is_private": null, "observable_id": "observable-429583988cd0cd07c1c2c693", "last_seen_epoch": "1533965245.872744000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964960.729475000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "saxp.zedo.com", "evidence": [ { "udp_stream": 129, "frame_number": 11983, "display_filter": "frame.number == 11983", "timestamp_epoch": "1533964901.806285000" }, { "udp_stream": 129, "frame_number": 12104, "display_filter": "frame.number == 12104", "timestamp_epoch": "1533964901.906766000" }, { "tcp_stream": 317, "frame_number": 12192, "display_filter": "frame.number == 12192", "timestamp_epoch": "1533964901.975102000" }, { "tcp_stream": 316, "frame_number": 12204, "display_filter": "frame.number == 12204", "timestamp_epoch": "1533964901.978717000" }, { "tcp_stream": 488, "frame_number": 17163, "display_filter": "frame.number == 17163", "timestamp_epoch": "1533964954.907270000" }, { "tcp_stream": 487, "frame_number": 17164, "display_filter": "frame.number == 17164", "timestamp_epoch": "1533964954.907271000" } ], "is_private": null, "observable_id": "observable-ff81727a35b8413b6a99dc70", "last_seen_epoch": "1533964954.907271000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964901.806285000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "sb.scorecardresearch.com", "evidence": [ { "udp_stream": 47, "frame_number": 3208, "display_filter": "frame.number == 3208", "timestamp_epoch": "1533964552.424918000" }, { "udp_stream": 47, "frame_number": 3334, "display_filter": "frame.number == 3334", "timestamp_epoch": "1533964552.716941000" }, { "tcp_stream": 91, "frame_number": 3496, "display_filter": "frame.number == 3496", "timestamp_epoch": "1533964552.884239000" }, { "tcp_stream": 90, "frame_number": 3504, "display_filter": "frame.number == 3504", "timestamp_epoch": "1533964552.885100000" }, { "tcp_stream": 212, "frame_number": 8415, "display_filter": "frame.number == 8415", "timestamp_epoch": "1533964898.250583000" }, { "tcp_stream": 213, "frame_number": 8419, "display_filter": "frame.number == 8419", "timestamp_epoch": "1533964898.250855000" } ], "is_private": null, "observable_id": "observable-2c913dd76e2486223bad87ba", "last_seen_epoch": "1533964898.250855000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964552.424918000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "scontent.xx.fbcdn.net", "evidence": [ { "udp_stream": 342, "frame_number": 43674, "display_filter": "frame.number == 43674", "timestamp_epoch": "1533965783.128458000" }, { "udp_stream": 348, "frame_number": 44214, "display_filter": "frame.number == 44214", "timestamp_epoch": "1533965784.461656000" } ], "is_private": null, "observable_id": "observable-487178ef06d4aef29afe849e", "last_seen_epoch": "1533965784.461656000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965783.128458000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "secure-assets.rubiconproject.com", "evidence": [ { "udp_stream": 188, "frame_number": 18172, "display_filter": "frame.number == 18172", "timestamp_epoch": "1533964958.356489000" }, { "udp_stream": 188, "frame_number": 18210, "display_filter": "frame.number == 18210", "timestamp_epoch": "1533964958.485955000" }, { "tcp_stream": 516, "frame_number": 18246, "display_filter": "frame.number == 18246", "timestamp_epoch": "1533964958.557671000" }, { "tcp_stream": 515, "frame_number": 18248, "display_filter": "frame.number == 18248", "timestamp_epoch": "1533964958.557673000" } ], "is_private": null, "observable_id": "observable-06294fd4cceddd09616df55e", "last_seen_epoch": "1533964958.557673000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964958.356489000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "secure.adnxs.com", "evidence": [ { "udp_stream": 184, "frame_number": 18164, "display_filter": "frame.number == 18164", "timestamp_epoch": "1533964958.349333000" }, { "udp_stream": 184, "frame_number": 18186, "display_filter": "frame.number == 18186", "timestamp_epoch": "1533964958.450245000" }, { "tcp_stream": 510, "frame_number": 18224, "display_filter": "frame.number == 18224", "timestamp_epoch": "1533964958.517047000" }, { "tcp_stream": 511, "frame_number": 18227, "display_filter": "frame.number == 18227", "timestamp_epoch": "1533964958.517518000" }, { "tcp_stream": 606, "frame_number": 22932, "display_filter": "frame.number == 22932", "timestamp_epoch": "1533964996.122063000" }, { "tcp_stream": 607, "frame_number": 22934, "display_filter": "frame.number == 22934", "timestamp_epoch": "1533964996.122233000" }, { "tcp_stream": 688, "frame_number": 26303, "display_filter": "frame.number == 26303", "timestamp_epoch": "1533965032.363879000" }, { "tcp_stream": 689, "frame_number": 26306, "display_filter": "frame.number == 26306", "timestamp_epoch": "1533965032.364251000" }, { "tcp_stream": 797, "frame_number": 29805, "display_filter": "frame.number == 29805", "timestamp_epoch": "1533965097.616034000" }, { "tcp_stream": 796, "frame_number": 29815, "display_filter": "frame.number == 29815", "timestamp_epoch": "1533965097.616746000" }, { "tcp_stream": 930, "frame_number": 33738, "display_filter": "frame.number == 33738", "timestamp_epoch": "1533965157.462503000" }, { "tcp_stream": 931, "frame_number": 33739, "display_filter": "frame.number == 33739", "timestamp_epoch": "1533965157.462612000" } ], "is_private": null, "observable_id": "observable-03a0c05ea51d08a8bdc0d39f", "last_seen_epoch": "1533965157.462612000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964958.349333000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "securepubads.g.doubleclick.net", "evidence": [ { "udp_stream": 54, "frame_number": 3793, "display_filter": "frame.number == 3793", "timestamp_epoch": "1533964553.386066000" }, { "udp_stream": 54, "frame_number": 3927, "display_filter": "frame.number == 3927", "timestamp_epoch": "1533964553.575840000" }, { "udp_stream": 346, "frame_number": 43899, "display_filter": "frame.number == 43899", "timestamp_epoch": "1533965783.771120000" }, { "udp_stream": 346, "frame_number": 44008, "display_filter": "frame.number == 44008", "timestamp_epoch": "1533965783.935554000" }, { "tcp_stream": 101, "frame_number": 4033, "display_filter": "frame.number == 4033", "timestamp_epoch": "1533964553.663008000" }, { "tcp_stream": 102, "frame_number": 4037, "display_filter": "frame.number == 4037", "timestamp_epoch": "1533964553.663428000" }, { "tcp_stream": 225, "frame_number": 8727, "display_filter": "frame.number == 8727", "timestamp_epoch": "1533964898.704460000" }, { "tcp_stream": 226, "frame_number": 8729, "display_filter": "frame.number == 8729", "timestamp_epoch": "1533964898.704490000" }, { "tcp_stream": 250, "frame_number": 9672, "display_filter": "frame.number == 9672", "timestamp_epoch": "1533964899.588524000" }, { "tcp_stream": 253, "frame_number": 9712, "display_filter": "frame.number == 9712", "timestamp_epoch": "1533964899.603389000" }, { "tcp_stream": 1162, "frame_number": 44040, "display_filter": "frame.number == 44040", "timestamp_epoch": "1533965784.020377000" }, { "tcp_stream": 1159, "frame_number": 44058, "display_filter": "frame.number == 44058", "timestamp_epoch": "1533965784.025460000" }, { "tcp_stream": 1158, "frame_number": 44060, "display_filter": "frame.number == 44060", "timestamp_epoch": "1533965784.025677000" }, { "tcp_stream": 1157, "frame_number": 44061, "display_filter": "frame.number == 44061", "timestamp_epoch": "1533965784.025785000" }, { "tcp_stream": 1161, "frame_number": 44063, "display_filter": "frame.number == 44063", "timestamp_epoch": "1533965784.025864000" }, { "tcp_stream": 1160, "frame_number": 44065, "display_filter": "frame.number == 44065", "timestamp_epoch": "1533965784.025952000" }, { "tcp_stream": 1164, "frame_number": 44265, "display_filter": "frame.number == 44265", "timestamp_epoch": "1533965784.616928000" } ], "is_private": null, "observable_id": "observable-9d396da74c91a84e4005ab93", "last_seen_epoch": "1533965784.616928000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964553.386066000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "simage2.pubmatic.com", "evidence": [ { "udp_stream": 170, "frame_number": 16023, "display_filter": "frame.number == 16023", "timestamp_epoch": "1533964908.405443000" }, { "udp_stream": 170, "frame_number": 16092, "display_filter": "frame.number == 16092", "timestamp_epoch": "1533964908.469322000" }, { "tcp_stream": 457, "frame_number": 16175, "display_filter": "frame.number == 16175", "timestamp_epoch": "1533964908.544073000" }, { "tcp_stream": 458, "frame_number": 16177, "display_filter": "frame.number == 16177", "timestamp_epoch": "1533964908.544241000" }, { "tcp_stream": 459, "frame_number": 16248, "display_filter": "frame.number == 16248", "timestamp_epoch": "1533964908.650930000" }, { "tcp_stream": 461, "frame_number": 16357, "display_filter": "frame.number == 16357", "timestamp_epoch": "1533964908.823331000" }, { "tcp_stream": 460, "frame_number": 16359, "display_filter": "frame.number == 16359", "timestamp_epoch": "1533964908.823497000" }, { "tcp_stream": 462, "frame_number": 16375, "display_filter": "frame.number == 16375", "timestamp_epoch": "1533964908.839064000" }, { "tcp_stream": 708, "frame_number": 26676, "display_filter": "frame.number == 26676", "timestamp_epoch": "1533965033.341346000" }, { "tcp_stream": 824, "frame_number": 30791, "display_filter": "frame.number == 30791", "timestamp_epoch": "1533965099.271843000" }, { "tcp_stream": 825, "frame_number": 30797, "display_filter": "frame.number == 30797", "timestamp_epoch": "1533965099.273256000" }, { "tcp_stream": 854, "frame_number": 31701, "display_filter": "frame.number == 31701", "timestamp_epoch": "1533965100.810915000" } ], "is_private": null, "observable_id": "observable-8c7480a1e7bbc936e8367546", "last_seen_epoch": "1533965100.810915000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964908.405443000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "simage4.pubmatic.com", "evidence": [ { "udp_stream": 176, "frame_number": 16707, "display_filter": "frame.number == 16707", "timestamp_epoch": "1533964910.343517000" }, { "udp_stream": 176, "frame_number": 16722, "display_filter": "frame.number == 16722", "timestamp_epoch": "1533964910.397514000" }, { "tcp_stream": 481, "frame_number": 16757, "display_filter": "frame.number == 16757", "timestamp_epoch": "1533964910.464401000" }, { "tcp_stream": 482, "frame_number": 16759, "display_filter": "frame.number == 16759", "timestamp_epoch": "1533964910.464624000" }, { "tcp_stream": 856, "frame_number": 31729, "display_filter": "frame.number == 31729", "timestamp_epoch": "1533965100.860099000" }, { "tcp_stream": 857, "frame_number": 31774, "display_filter": "frame.number == 31774", "timestamp_epoch": "1533965100.889903000" } ], "is_private": null, "observable_id": "observable-c541e06dd8fdccadd046d445", "last_seen_epoch": "1533965100.889903000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964910.343517000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "small-video.edgecast.syn-cdn.com", "evidence": [ { "udp_stream": 214, "frame_number": 20089, "display_filter": "frame.number == 20089", "timestamp_epoch": "1533964964.568163000" }, { "udp_stream": 214, "frame_number": 20116, "display_filter": "frame.number == 20116", "timestamp_epoch": "1533964964.705871000" }, { "tcp_stream": 583, "frame_number": 20139, "display_filter": "frame.number == 20139", "timestamp_epoch": "1533964964.765035000" }, { "tcp_stream": 584, "frame_number": 20140, "display_filter": "frame.number == 20140", "timestamp_epoch": "1533964964.765162000" }, { "tcp_stream": 682, "frame_number": 24588, "display_filter": "frame.number == 24588", "timestamp_epoch": "1533965020.346497000" }, { "tcp_stream": 683, "frame_number": 24589, "display_filter": "frame.number == 24589", "timestamp_epoch": "1533965020.346498000" }, { "tcp_stream": 788, "frame_number": 28739, "display_filter": "frame.number == 28739", "timestamp_epoch": "1533965094.680368000" }, { "tcp_stream": 789, "frame_number": 28740, "display_filter": "frame.number == 28740", "timestamp_epoch": "1533965094.680431000" }, { "tcp_stream": 929, "frame_number": 33675, "display_filter": "frame.number == 33675", "timestamp_epoch": "1533965157.342011000" }, { "tcp_stream": 928, "frame_number": 33683, "display_filter": "frame.number == 33683", "timestamp_epoch": "1533965157.342873000" }, { "tcp_stream": 985, "frame_number": 37134, "display_filter": "frame.number == 37134", "timestamp_epoch": "1533965226.489331000" }, { "tcp_stream": 986, "frame_number": 37135, "display_filter": "frame.number == 37135", "timestamp_epoch": "1533965226.489332000" } ], "is_private": null, "observable_id": "observable-a66177e6ad5bf9afeabc8af0", "last_seen_epoch": "1533965226.489332000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964964.568163000" }, { "type": "domain", "roles": [ "dns-cname", "dns-query", "tls-sni" ], "value": "smi2.net", "evidence": [ { "udp_stream": 124, "frame_number": 11427, "display_filter": "frame.number == 11427", "timestamp_epoch": "1533964901.269376000" }, { "udp_stream": 123, "frame_number": 11477, "display_filter": "frame.number == 11477", "timestamp_epoch": "1533964901.323587000" }, { "udp_stream": 124, "frame_number": 11530, "display_filter": "frame.number == 11530", "timestamp_epoch": "1533964901.340738000" }, { "tcp_stream": 304, "frame_number": 11837, "display_filter": "frame.number == 11837", "timestamp_epoch": "1533964901.592161000" }, { "tcp_stream": 305, "frame_number": 11855, "display_filter": "frame.number == 11855", "timestamp_epoch": "1533964901.598922000" } ], "is_private": null, "observable_id": "observable-905f3038f62260632373b4b7", "last_seen_epoch": "1533964901.598922000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964901.269376000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "smi2.ru", "evidence": [ { "udp_stream": 122, "frame_number": 11425, "display_filter": "frame.number == 11425", "timestamp_epoch": "1533964901.268836000" }, { "udp_stream": 122, "frame_number": 11789, "display_filter": "frame.number == 11789", "timestamp_epoch": "1533964901.574246000" }, { "tcp_stream": 307, "frame_number": 12000, "display_filter": "frame.number == 12000", "timestamp_epoch": "1533964901.816031000" }, { "tcp_stream": 306, "frame_number": 12008, "display_filter": "frame.number == 12008", "timestamp_epoch": "1533964901.819747000" } ], "is_private": null, "observable_id": "observable-1c52ff59ffc1a921dafa4d9c", "last_seen_epoch": "1533964901.819747000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964901.268836000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "smtp.yandex.com", "evidence": [ { "udp_stream": 88, "frame_number": 7088, "display_filter": "frame.number == 7088", "timestamp_epoch": "1533964677.171851000" }, { "udp_stream": 88, "frame_number": 7089, "display_filter": "frame.number == 7089", "timestamp_epoch": "1533964677.421170000" }, { "udp_stream": 319, "frame_number": 39903, "display_filter": "frame.number == 39903", "timestamp_epoch": "1533965605.526057000" }, { "udp_stream": 319, "frame_number": 39904, "display_filter": "frame.number == 39904", "timestamp_epoch": "1533965605.965885000" }, { "tcp_stream": 172, "frame_number": 7093, "display_filter": "frame.number == 7093", "timestamp_epoch": "1533964677.699779000" }, { "tcp_stream": 1059, "frame_number": 39908, "display_filter": "frame.number == 39908", "timestamp_epoch": "1533965606.395386000" } ], "is_private": null, "observable_id": "observable-639421cdbb4a7ac54093323c", "last_seen_epoch": "1533965606.395386000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964677.171851000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "smtp.yandex.ru", "evidence": [ { "udp_stream": 88, "frame_number": 7089, "display_filter": "frame.number == 7089", "timestamp_epoch": "1533964677.421170000" }, { "udp_stream": 319, "frame_number": 39904, "display_filter": "frame.number == 39904", "timestamp_epoch": "1533965605.965885000" } ], "is_private": null, "observable_id": "observable-c46be5a4c6b196d790545a89", "last_seen_epoch": "1533965605.965885000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964677.421170000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "sputnikhouse-dc.sputnikhouse.org", "evidence": [ { "udp_stream": 6, "frame_number": 15, "display_filter": "frame.number == 15", "timestamp_epoch": "1533964509.084305000" }, { "udp_stream": 6, "frame_number": 16, "display_filter": "frame.number == 16", "timestamp_epoch": "1533964509.084490000" }, { "udp_stream": 21, "frame_number": 334, "display_filter": "frame.number == 334", "timestamp_epoch": "1533964517.018976000" }, { "udp_stream": 21, "frame_number": 335, "display_filter": "frame.number == 335", "timestamp_epoch": "1533964517.019178000" } ], "is_private": null, "observable_id": "observable-fd3c7b24950abe944721a113", "last_seen_epoch": "1533964517.019178000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964509.084305000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "sputnikhouse.org", "evidence": [ { "udp_stream": 23, "frame_number": 376, "display_filter": "frame.number == 376", "timestamp_epoch": "1533964517.090941000" }, { "udp_stream": 23, "frame_number": 377, "display_filter": "frame.number == 377", "timestamp_epoch": "1533964517.092165000" }, { "udp_stream": 315, "frame_number": 39655, "display_filter": "frame.number == 39655", "timestamp_epoch": "1533965410.183603000" }, { "udp_stream": 315, "frame_number": 39656, "display_filter": "frame.number == 39656", "timestamp_epoch": "1533965410.184627000" }, { "udp_stream": 317, "frame_number": 39659, "display_filter": "frame.number == 39659", "timestamp_epoch": "1533965410.186117000" }, { "udp_stream": 317, "frame_number": 39660, "display_filter": "frame.number == 39660", "timestamp_epoch": "1533965410.186527000" } ], "is_private": null, "observable_id": "observable-f21185fc200c9a6eef3b0a3a", "last_seen_epoch": "1533965410.186527000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964517.090941000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "ss3.zedo.com", "evidence": [ { "udp_stream": 114, "frame_number": 10605, "display_filter": "frame.number == 10605", "timestamp_epoch": "1533964900.561105000" }, { "udp_stream": 114, "frame_number": 10640, "display_filter": "frame.number == 10640", "timestamp_epoch": "1533964900.661382000" }, { "tcp_stream": 284, "frame_number": 10687, "display_filter": "frame.number == 10687", "timestamp_epoch": "1533964900.709018000" }, { "tcp_stream": 285, "frame_number": 10717, "display_filter": "frame.number == 10717", "timestamp_epoch": "1533964900.716816000" }, { "tcp_stream": 336, "frame_number": 13104, "display_filter": "frame.number == 13104", "timestamp_epoch": "1533964903.067416000" }, { "tcp_stream": 386, "frame_number": 14590, "display_filter": "frame.number == 14590", "timestamp_epoch": "1533964904.627776000" }, { "tcp_stream": 389, "frame_number": 14606, "display_filter": "frame.number == 14606", "timestamp_epoch": "1533964904.635702000" } ], "is_private": null, "observable_id": "observable-e970649f782d9ce881145170", "last_seen_epoch": "1533964904.635702000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964900.561105000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "ssl.cdn.marphezis.com.c.footprint.net", "evidence": [ { "udp_stream": 107, "frame_number": 9794, "display_filter": "frame.number == 9794", "timestamp_epoch": "1533964899.640925000" } ], "is_private": null, "observable_id": "observable-65034a4ec011119eb75abb1b", "last_seen_epoch": "1533964899.640925000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964899.640925000" }, { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "ssl.trustwave.com", "evidence": [ { "udp_stream": 67, "frame_number": 5349, "display_filter": "frame.number == 5349", "timestamp_epoch": "1533964556.352409000" }, { "udp_stream": 68, "frame_number": 5350, "display_filter": "frame.number == 5350", "timestamp_epoch": "1533964556.353582000" }, { "udp_stream": 68, "frame_number": 5371, "display_filter": "frame.number == 5371", "timestamp_epoch": "1533964556.454915000" }, { "udp_stream": 67, "frame_number": 5372, "display_filter": "frame.number == 5372", "timestamp_epoch": "1533964556.455020000" }, { "tcp_stream": 127, "frame_number": 5383, "display_filter": "frame.number == 5383", "timestamp_epoch": "1533964556.494073000" }, { "tcp_stream": 128, "frame_number": 5387, "display_filter": "frame.number == 5387", "timestamp_epoch": "1533964556.515882000" } ], "is_private": null, "observable_id": "observable-15b9d82a9c8a53e806f88827", "last_seen_epoch": "1533964556.515882000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964556.352409000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "stags.bluekai.com", "evidence": [ { "udp_stream": 127, "frame_number": 11860, "display_filter": "frame.number == 11860", "timestamp_epoch": "1533964901.603537000" }, { "udp_stream": 127, "frame_number": 11957, "display_filter": "frame.number == 11957", "timestamp_epoch": "1533964901.767352000" }, { "tcp_stream": 312, "frame_number": 12022, "display_filter": "frame.number == 12022", "timestamp_epoch": "1533964901.828960000" }, { "tcp_stream": 313, "frame_number": 12023, "display_filter": "frame.number == 12023", "timestamp_epoch": "1533964901.829056000" }, { "tcp_stream": 752, "frame_number": 27530, "display_filter": "frame.number == 27530", "timestamp_epoch": "1533965035.693095000" }, { "tcp_stream": 753, "frame_number": 27540, "display_filter": "frame.number == 27540", "timestamp_epoch": "1533965035.697280000" } ], "is_private": null, "observable_id": "observable-ce1fd16a4cfab56f335ee427", "last_seen_epoch": "1533965035.697280000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964901.603537000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "stat.media", "evidence": [ { "udp_stream": 105, "frame_number": 9226, "display_filter": "frame.number == 9226", "timestamp_epoch": "1533964899.129114000" }, { "udp_stream": 105, "frame_number": 9340, "display_filter": "frame.number == 9340", "timestamp_epoch": "1533964899.269568000" }, { "tcp_stream": 244, "frame_number": 9758, "display_filter": "frame.number == 9758", "timestamp_epoch": "1533964899.626749000" }, { "tcp_stream": 245, "frame_number": 9775, "display_filter": "frame.number == 9775", "timestamp_epoch": "1533964899.632814000" }, { "tcp_stream": 1030, "frame_number": 39352, "display_filter": "frame.number == 39352", "timestamp_epoch": "1533965247.228409000" } ], "is_private": null, "observable_id": "observable-5efb2c47f38bcae101ac79f4", "last_seen_epoch": "1533965247.228409000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964899.129114000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "static-doubleclick-net.l.google.com", "evidence": [ { "udp_stream": 70, "frame_number": 5456, "display_filter": "frame.number == 5456", "timestamp_epoch": "1533964556.909758000" } ], "is_private": null, "observable_id": "observable-6258a03ac4ea72d0d9f1272f", "last_seen_epoch": "1533964556.909758000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964556.909758000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "static.chartbeat.com", "evidence": [ { "udp_stream": 72, "frame_number": 5845, "display_filter": "frame.number == 5845", "timestamp_epoch": "1533964559.338775000" }, { "udp_stream": 72, "frame_number": 5857, "display_filter": "frame.number == 5857", "timestamp_epoch": "1533964559.422782000" }, { "tcp_stream": 138, "frame_number": 5881, "display_filter": "frame.number == 5881", "timestamp_epoch": "1533964559.508438000" }, { "tcp_stream": 139, "frame_number": 5887, "display_filter": "frame.number == 5887", "timestamp_epoch": "1533964559.509117000" } ], "is_private": null, "observable_id": "observable-71119eac0fa72837c91c31f6", "last_seen_epoch": "1533964559.509117000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964559.338775000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "static.criteo.net", "evidence": [ { "udp_stream": 161, "frame_number": 15268, "display_filter": "frame.number == 15268", "timestamp_epoch": "1533964906.418364000" }, { "udp_stream": 161, "frame_number": 15402, "display_filter": "frame.number == 15402", "timestamp_epoch": "1533964906.564513000" }, { "tcp_stream": 423, "frame_number": 15565, "display_filter": "frame.number == 15565", "timestamp_epoch": "1533964906.748908000" }, { "tcp_stream": 424, "frame_number": 15569, "display_filter": "frame.number == 15569", "timestamp_epoch": "1533964906.750692000" } ], "is_private": null, "observable_id": "observable-22d785f45d8af228c076c4f3", "last_seen_epoch": "1533964906.750692000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964906.418364000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "static.doubleclick.net", "evidence": [ { "udp_stream": 70, "frame_number": 5433, "display_filter": "frame.number == 5433", "timestamp_epoch": "1533964556.839610000" }, { "udp_stream": 70, "frame_number": 5456, "display_filter": "frame.number == 5456", "timestamp_epoch": "1533964556.909758000" }, { "tcp_stream": 132, "frame_number": 5541, "display_filter": "frame.number == 5541", "timestamp_epoch": "1533964557.014836000" }, { "tcp_stream": 133, "frame_number": 5551, "display_filter": "frame.number == 5551", "timestamp_epoch": "1533964557.021044000" } ], "is_private": null, "observable_id": "observable-de6d640b8c40ffea9be0bb7e", "last_seen_epoch": "1533964557.021044000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964556.839610000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "static.mixi.media", "evidence": [ { "udp_stream": 103, "frame_number": 9215, "display_filter": "frame.number == 9215", "timestamp_epoch": "1533964899.117813000" }, { "udp_stream": 103, "frame_number": 9470, "display_filter": "frame.number == 9470", "timestamp_epoch": "1533964899.377567000" }, { "tcp_stream": 257, "frame_number": 9724, "display_filter": "frame.number == 9724", "timestamp_epoch": "1533964899.606021000" }, { "tcp_stream": 255, "frame_number": 9735, "display_filter": "frame.number == 9735", "timestamp_epoch": "1533964899.613515000" } ], "is_private": null, "observable_id": "observable-baeaa698b6eecdba87b814e7", "last_seen_epoch": "1533964899.613515000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964899.117813000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "static2.mixi.media", "evidence": [ { "udp_stream": 131, "frame_number": 12058, "display_filter": "frame.number == 12058", "timestamp_epoch": "1533964901.857130000" }, { "udp_stream": 131, "frame_number": 12208, "display_filter": "frame.number == 12208", "timestamp_epoch": "1533964901.980409000" }, { "tcp_stream": 318, "frame_number": 12443, "display_filter": "frame.number == 12443", "timestamp_epoch": "1533964902.281194000" }, { "tcp_stream": 319, "frame_number": 12455, "display_filter": "frame.number == 12455", "timestamp_epoch": "1533964902.286395000" } ], "is_private": null, "observable_id": "observable-d46353b238dfea541613e838", "last_seen_epoch": "1533964902.286395000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964901.857130000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "static4.mixi.media", "evidence": [ { "udp_stream": 130, "frame_number": 12052, "display_filter": "frame.number == 12052", "timestamp_epoch": "1533964901.855110000" }, { "udp_stream": 130, "frame_number": 12212, "display_filter": "frame.number == 12212", "timestamp_epoch": "1533964901.981250000" }, { "tcp_stream": 321, "frame_number": 12437, "display_filter": "frame.number == 12437", "timestamp_epoch": "1533964902.280038000" }, { "tcp_stream": 320, "frame_number": 12477, "display_filter": "frame.number == 12477", "timestamp_epoch": "1533964902.313628000" }, { "tcp_stream": 326, "frame_number": 12727, "display_filter": "frame.number == 12727", "timestamp_epoch": "1533964902.689619000" }, { "tcp_stream": 327, "frame_number": 12751, "display_filter": "frame.number == 12751", "timestamp_epoch": "1533964902.700649000" } ], "is_private": null, "observable_id": "observable-d841dc4fba998a511800844e", "last_seen_epoch": "1533964902.700649000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964901.855110000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "static5.mixi.media", "evidence": [ { "udp_stream": 134, "frame_number": 12649, "display_filter": "frame.number == 12649", "timestamp_epoch": "1533964902.596451000" }, { "udp_stream": 134, "frame_number": 12763, "display_filter": "frame.number == 12763", "timestamp_epoch": "1533964902.706045000" }, { "tcp_stream": 328, "frame_number": 12824, "display_filter": "frame.number == 12824", "timestamp_epoch": "1533964902.792686000" }, { "tcp_stream": 329, "frame_number": 12847, "display_filter": "frame.number == 12847", "timestamp_epoch": "1533964902.811465000" } ], "is_private": null, "observable_id": "observable-0260b6f9624747d3f21c6bdd", "last_seen_epoch": "1533964902.811465000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964902.596451000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "staticxx.facebook.com", "evidence": [ { "udp_stream": 348, "frame_number": 44116, "display_filter": "frame.number == 44116", "timestamp_epoch": "1533965784.194344000" }, { "udp_stream": 348, "frame_number": 44214, "display_filter": "frame.number == 44214", "timestamp_epoch": "1533965784.461656000" }, { "tcp_stream": 1168, "frame_number": 44338, "display_filter": "frame.number == 44338", "timestamp_epoch": "1533965784.993306000" }, { "tcp_stream": 1169, "frame_number": 44341, "display_filter": "frame.number == 44341", "timestamp_epoch": "1533965784.994092000" } ], "is_private": null, "observable_id": "observable-52c9f4f1fd3cceb704a7fb8c", "last_seen_epoch": "1533965784.994092000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965784.194344000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "stats.g.doubleclick.net", "evidence": [ { "udp_stream": 57, "frame_number": 4243, "display_filter": "frame.number == 4243", "timestamp_epoch": "1533964554.012005000" }, { "udp_stream": 57, "frame_number": 4326, "display_filter": "frame.number == 4326", "timestamp_epoch": "1533964554.232211000" }, { "udp_stream": 355, "frame_number": 44973, "display_filter": "frame.number == 44973", "timestamp_epoch": "1533965786.582537000" }, { "udp_stream": 355, "frame_number": 45074, "display_filter": "frame.number == 45074", "timestamp_epoch": "1533965786.808030000" }, { "tcp_stream": 105, "frame_number": 4404, "display_filter": "frame.number == 4404", "timestamp_epoch": "1533964554.396779000" }, { "tcp_stream": 106, "frame_number": 4412, "display_filter": "frame.number == 4412", "timestamp_epoch": "1533964554.397822000" }, { "tcp_stream": 219, "frame_number": 8691, "display_filter": "frame.number == 8691", "timestamp_epoch": "1533964898.653579000" }, { "tcp_stream": 220, "frame_number": 8693, "display_filter": "frame.number == 8693", "timestamp_epoch": "1533964898.654114000" }, { "tcp_stream": 1193, "frame_number": 45285, "display_filter": "frame.number == 45285", "timestamp_epoch": "1533965787.316948000" }, { "tcp_stream": 1194, "frame_number": 45288, "display_filter": "frame.number == 45288", "timestamp_epoch": "1533965787.317460000" }, { "tcp_stream": 1199, "frame_number": 45475, "display_filter": "frame.number == 45475", "timestamp_epoch": "1533965787.976322000" } ], "is_private": null, "observable_id": "observable-e3af2e201ccd463d8408bdc2", "last_seen_epoch": "1533965787.976322000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964554.012005000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "stats.l.doubleclick.net", "evidence": [ { "udp_stream": 57, "frame_number": 4326, "display_filter": "frame.number == 4326", "timestamp_epoch": "1533964554.232211000" }, { "udp_stream": 355, "frame_number": 45074, "display_filter": "frame.number == 45074", "timestamp_epoch": "1533965786.808030000" } ], "is_private": null, "observable_id": "observable-6dca5138dbb3f442ea4f11ea", "last_seen_epoch": "1533965786.808030000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964554.232211000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "su.addthis.com", "evidence": [ { "udp_stream": 238, "frame_number": 24025, "display_filter": "frame.number == 24025", "timestamp_epoch": "1533964999.378086000" }, { "udp_stream": 238, "frame_number": 24043, "display_filter": "frame.number == 24043", "timestamp_epoch": "1533964999.497119000" }, { "tcp_stream": 672, "frame_number": 24083, "display_filter": "frame.number == 24083", "timestamp_epoch": "1533964999.565656000" }, { "tcp_stream": 673, "frame_number": 24088, "display_filter": "frame.number == 24088", "timestamp_epoch": "1533964999.566369000" } ], "is_private": null, "observable_id": "observable-6830bd86bf151cf528592b13", "last_seen_epoch": "1533964999.566369000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964999.378086000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "synacor.autoplay-plugins.static-origin.syn-cdn.com", "evidence": [ { "udp_stream": 219, "frame_number": 20426, "display_filter": "frame.number == 20426", "timestamp_epoch": "1533964965.457165000" }, { "udp_stream": 219, "frame_number": 20551, "display_filter": "frame.number == 20551", "timestamp_epoch": "1533964965.682355000" }, { "tcp_stream": 595, "frame_number": 20746, "display_filter": "frame.number == 20746", "timestamp_epoch": "1533964966.367680000" }, { "tcp_stream": 596, "frame_number": 20749, "display_filter": "frame.number == 20749", "timestamp_epoch": "1533964966.368072000" } ], "is_private": null, "observable_id": "observable-60ab8cb6148eddf58a42d90f", "last_seen_epoch": "1533964966.368072000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964965.457165000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "sync-tm.everesttech.net", "evidence": [ { "udp_stream": 63, "frame_number": 5078, "display_filter": "frame.number == 5078", "timestamp_epoch": "1533964555.920668000" }, { "udp_stream": 63, "frame_number": 5155, "display_filter": "frame.number == 5155", "timestamp_epoch": "1533964556.031163000" }, { "tcp_stream": 125, "frame_number": 5214, "display_filter": "frame.number == 5214", "timestamp_epoch": "1533964556.094107000" }, { "tcp_stream": 126, "frame_number": 5218, "display_filter": "frame.number == 5218", "timestamp_epoch": "1533964556.094443000" }, { "tcp_stream": 446, "frame_number": 16001, "display_filter": "frame.number == 16001", "timestamp_epoch": "1533964908.387464000" }, { "tcp_stream": 445, "frame_number": 16002, "display_filter": "frame.number == 16002", "timestamp_epoch": "1533964908.387715000" }, { "tcp_stream": 735, "frame_number": 27313, "display_filter": "frame.number == 27313", "timestamp_epoch": "1533965035.371926000" }, { "tcp_stream": 734, "frame_number": 27315, "display_filter": "frame.number == 27315", "timestamp_epoch": "1533965035.374382000" } ], "is_private": null, "observable_id": "observable-4d8b31486e214b8b299baecb", "last_seen_epoch": "1533965035.374382000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964555.920668000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "sync.1rx.io", "evidence": [ { "udp_stream": 186, "frame_number": 18168, "display_filter": "frame.number == 18168", "timestamp_epoch": "1533964958.352910000" }, { "udp_stream": 186, "frame_number": 18183, "display_filter": "frame.number == 18183", "timestamp_epoch": "1533964958.434721000" }, { "tcp_stream": 507, "frame_number": 18238, "display_filter": "frame.number == 18238", "timestamp_epoch": "1533964958.548661000" }, { "tcp_stream": 506, "frame_number": 18239, "display_filter": "frame.number == 18239", "timestamp_epoch": "1533964958.549363000" }, { "tcp_stream": 800, "frame_number": 29920, "display_filter": "frame.number == 29920", "timestamp_epoch": "1533965097.843316000" }, { "tcp_stream": 801, "frame_number": 29921, "display_filter": "frame.number == 29921", "timestamp_epoch": "1533965097.843521000" } ], "is_private": null, "observable_id": "observable-03cfc4a9abad3c07a273f07a", "last_seen_epoch": "1533965097.843521000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964958.352910000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "sync.adotmob.com", "evidence": [ { "udp_stream": 303, "frame_number": 35494, "display_filter": "frame.number == 35494", "timestamp_epoch": "1533965160.271065000" }, { "udp_stream": 303, "frame_number": 35536, "display_filter": "frame.number == 35536", "timestamp_epoch": "1533965160.370088000" }, { "tcp_stream": 966, "frame_number": 35619, "display_filter": "frame.number == 35619", "timestamp_epoch": "1533965160.477153000" }, { "tcp_stream": 967, "frame_number": 35623, "display_filter": "frame.number == 35623", "timestamp_epoch": "1533965160.478568000" } ], "is_private": null, "observable_id": "observable-077d732115b658a278858ae7", "last_seen_epoch": "1533965160.478568000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965160.271065000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "sync.aralego.com", "evidence": [ { "udp_stream": 187, "frame_number": 18169, "display_filter": "frame.number == 18169", "timestamp_epoch": "1533964958.353897000" }, { "udp_stream": 187, "frame_number": 18189, "display_filter": "frame.number == 18189", "timestamp_epoch": "1533964958.450799000" }, { "tcp_stream": 508, "frame_number": 18254, "display_filter": "frame.number == 18254", "timestamp_epoch": "1533964958.577179000" }, { "tcp_stream": 509, "frame_number": 18255, "display_filter": "frame.number == 18255", "timestamp_epoch": "1533964958.577252000" }, { "tcp_stream": 608, "frame_number": 22962, "display_filter": "frame.number == 22962", "timestamp_epoch": "1533964996.224007000" }, { "tcp_stream": 609, "frame_number": 22964, "display_filter": "frame.number == 22964", "timestamp_epoch": "1533964996.224362000" }, { "tcp_stream": 691, "frame_number": 26336, "display_filter": "frame.number == 26336", "timestamp_epoch": "1533965032.448005000" }, { "tcp_stream": 690, "frame_number": 26340, "display_filter": "frame.number == 26340", "timestamp_epoch": "1533965032.448472000" }, { "tcp_stream": 802, "frame_number": 29929, "display_filter": "frame.number == 29929", "timestamp_epoch": "1533965097.843912000" }, { "tcp_stream": 803, "frame_number": 32200, "display_filter": "frame.number == 32200", "timestamp_epoch": "1533965101.975590000" }, { "tcp_stream": 932, "frame_number": 33796, "display_filter": "frame.number == 33796", "timestamp_epoch": "1533965157.589684000" }, { "tcp_stream": 933, "frame_number": 33798, "display_filter": "frame.number == 33798", "timestamp_epoch": "1533965157.590054000" } ], "is_private": null, "observable_id": "observable-3c0b506b1a253b6bd83095b5", "last_seen_epoch": "1533965157.590054000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964958.353897000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "sync.crwdcntrl.net", "evidence": [ { "udp_stream": 242, "frame_number": 24211, "display_filter": "frame.number == 24211", "timestamp_epoch": "1533965000.652945000" }, { "udp_stream": 242, "frame_number": 24227, "display_filter": "frame.number == 24227", "timestamp_epoch": "1533965001.652660000" }, { "udp_stream": 242, "frame_number": 24228, "display_filter": "frame.number == 24228", "timestamp_epoch": "1533965001.681775000" }, { "tcp_stream": 676, "frame_number": 24245, "display_filter": "frame.number == 24245", "timestamp_epoch": "1533965002.158999000" }, { "tcp_stream": 677, "frame_number": 24246, "display_filter": "frame.number == 24246", "timestamp_epoch": "1533965002.159159000" } ], "is_private": null, "observable_id": "observable-1df51e6d328380bf802f2668", "last_seen_epoch": "1533965002.159159000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965000.652945000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "sync.extend.tv", "evidence": [ { "udp_stream": 250, "frame_number": 26700, "display_filter": "frame.number == 26700", "timestamp_epoch": "1533965033.402325000" }, { "udp_stream": 250, "frame_number": 26727, "display_filter": "frame.number == 26727", "timestamp_epoch": "1533965033.481280000" }, { "tcp_stream": 715, "frame_number": 26787, "display_filter": "frame.number == 26787", "timestamp_epoch": "1533965033.600626000" }, { "tcp_stream": 716, "frame_number": 26792, "display_filter": "frame.number == 26792", "timestamp_epoch": "1533965033.601127000" } ], "is_private": null, "observable_id": "observable-d6d20f0e0b8b14e52bec9cb4", "last_seen_epoch": "1533965033.601127000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965033.402325000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "sync.ipredictive.com", "evidence": [ { "udp_stream": 227, "frame_number": 23249, "display_filter": "frame.number == 23249", "timestamp_epoch": "1533964997.188987000" }, { "udp_stream": 227, "frame_number": 23293, "display_filter": "frame.number == 23293", "timestamp_epoch": "1533964997.291196000" }, { "tcp_stream": 634, "frame_number": 23420, "display_filter": "frame.number == 23420", "timestamp_epoch": "1533964997.428617000" }, { "tcp_stream": 635, "frame_number": 23422, "display_filter": "frame.number == 23422", "timestamp_epoch": "1533964997.428749000" }, { "tcp_stream": 822, "frame_number": 30826, "display_filter": "frame.number == 30826", "timestamp_epoch": "1533965099.301400000" }, { "tcp_stream": 823, "frame_number": 30827, "display_filter": "frame.number == 30827", "timestamp_epoch": "1533965099.301617000" }, { "tcp_stream": 954, "frame_number": 35577, "display_filter": "frame.number == 35577", "timestamp_epoch": "1533965160.397970000" }, { "tcp_stream": 955, "frame_number": 35578, "display_filter": "frame.number == 35578", "timestamp_epoch": "1533965160.398032000" } ], "is_private": null, "observable_id": "observable-70db6675cba1133cab8a89eb", "last_seen_epoch": "1533965160.398032000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964997.188987000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "sync.ligadx.com", "evidence": [ { "udp_stream": 286, "frame_number": 31612, "display_filter": "frame.number == 31612", "timestamp_epoch": "1533965100.695740000" }, { "udp_stream": 286, "frame_number": 31668, "display_filter": "frame.number == 31668", "timestamp_epoch": "1533965100.795644000" }, { "tcp_stream": 859, "frame_number": 31772, "display_filter": "frame.number == 31772", "timestamp_epoch": "1533965100.889802000" }, { "tcp_stream": 863, "frame_number": 31804, "display_filter": "frame.number == 31804", "timestamp_epoch": "1533965100.914146000" } ], "is_private": null, "observable_id": "observable-637a468a7136b9a0e96224f3", "last_seen_epoch": "1533965100.914146000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965100.695740000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "sync.mathtag.com", "evidence": [ { "udp_stream": 61, "frame_number": 5075, "display_filter": "frame.number == 5075", "timestamp_epoch": "1533964555.919335000" }, { "udp_stream": 61, "frame_number": 5120, "display_filter": "frame.number == 5120", "timestamp_epoch": "1533964555.984165000" }, { "tcp_stream": 115, "frame_number": 5234, "display_filter": "frame.number == 5234", "timestamp_epoch": "1533964556.109083000" }, { "tcp_stream": 116, "frame_number": 5237, "display_filter": "frame.number == 5237", "timestamp_epoch": "1533964556.109634000" }, { "tcp_stream": 448, "frame_number": 16046, "display_filter": "frame.number == 16046", "timestamp_epoch": "1533964908.428705000" }, { "tcp_stream": 447, "frame_number": 16047, "display_filter": "frame.number == 16047", "timestamp_epoch": "1533964908.428863000" }, { "tcp_stream": 834, "frame_number": 31082, "display_filter": "frame.number == 31082", "timestamp_epoch": "1533965099.810576000" }, { "tcp_stream": 835, "frame_number": 31084, "display_filter": "frame.number == 31084", "timestamp_epoch": "1533965099.810884000" } ], "is_private": null, "observable_id": "observable-f41604ef74c26925619e658d", "last_seen_epoch": "1533965099.810884000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964555.919335000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "sync.search.spotxchange.com", "evidence": [ { "udp_stream": 209, "frame_number": 19655, "display_filter": "frame.number == 19655", "timestamp_epoch": "1533964962.787611000" }, { "udp_stream": 209, "frame_number": 19708, "display_filter": "frame.number == 19708", "timestamp_epoch": "1533964962.901909000" }, { "tcp_stream": 571, "frame_number": 19769, "display_filter": "frame.number == 19769", "timestamp_epoch": "1533964962.999760000" }, { "tcp_stream": 570, "frame_number": 19784, "display_filter": "frame.number == 19784", "timestamp_epoch": "1533964963.001886000" } ], "is_private": null, "observable_id": "observable-91d26e2caf83668f569287b7", "last_seen_epoch": "1533964963.001886000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964962.787611000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "sync.springserve.com", "evidence": [ { "udp_stream": 185, "frame_number": 18167, "display_filter": "frame.number == 18167", "timestamp_epoch": "1533964958.352142000" }, { "udp_stream": 185, "frame_number": 18200, "display_filter": "frame.number == 18200", "timestamp_epoch": "1533964958.477773000" }, { "tcp_stream": 512, "frame_number": 18262, "display_filter": "frame.number == 18262", "timestamp_epoch": "1533964958.578339000" }, { "tcp_stream": 513, "frame_number": 18263, "display_filter": "frame.number == 18263", "timestamp_epoch": "1533964958.578487000" }, { "tcp_stream": 798, "frame_number": 29816, "display_filter": "frame.number == 29816", "timestamp_epoch": "1533965097.616748000" }, { "tcp_stream": 799, "frame_number": 29829, "display_filter": "frame.number == 29829", "timestamp_epoch": "1533965097.622782000" } ], "is_private": null, "observable_id": "observable-d0ad87d83b940e521dec400b", "last_seen_epoch": "1533965097.622782000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964958.352142000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "sync.teads.tv", "evidence": [ { "udp_stream": 266, "frame_number": 27458, "display_filter": "frame.number == 27458", "timestamp_epoch": "1533965035.636894000" }, { "udp_stream": 266, "frame_number": 27558, "display_filter": "frame.number == 27558", "timestamp_epoch": "1533965035.720501000" }, { "tcp_stream": 762, "frame_number": 27715, "display_filter": "frame.number == 27715", "timestamp_epoch": "1533965035.911213000" }, { "tcp_stream": 763, "frame_number": 27723, "display_filter": "frame.number == 27723", "timestamp_epoch": "1533965035.926535000" } ], "is_private": null, "observable_id": "observable-8fbf32ad297ed39e32b126c6", "last_seen_epoch": "1533965035.926535000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965035.636894000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "sync.tidaltv.com", "evidence": [ { "udp_stream": 252, "frame_number": 26702, "display_filter": "frame.number == 26702", "timestamp_epoch": "1533965033.403252000" }, { "udp_stream": 252, "frame_number": 26736, "display_filter": "frame.number == 26736", "timestamp_epoch": "1533965033.496493000" }, { "tcp_stream": 717, "frame_number": 26779, "display_filter": "frame.number == 26779", "timestamp_epoch": "1533965033.599995000" }, { "tcp_stream": 718, "frame_number": 26780, "display_filter": "frame.number == 26780", "timestamp_epoch": "1533965033.600087000" }, { "tcp_stream": 819, "frame_number": 30670, "display_filter": "frame.number == 30670", "timestamp_epoch": "1533965099.047943000" }, { "tcp_stream": 818, "frame_number": 30675, "display_filter": "frame.number == 30675", "timestamp_epoch": "1533965099.048530000" } ], "is_private": null, "observable_id": "observable-f9fa8ac6d816991f38332f0b", "last_seen_epoch": "1533965099.048530000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965033.403252000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "synchroscript.deliveryengine.adswizz.com", "evidence": [ { "udp_stream": 305, "frame_number": 35496, "display_filter": "frame.number == 35496", "timestamp_epoch": "1533965160.271640000" }, { "udp_stream": 305, "frame_number": 35537, "display_filter": "frame.number == 35537", "timestamp_epoch": "1533965160.370309000" }, { "tcp_stream": 969, "frame_number": 35709, "display_filter": "frame.number == 35709", "timestamp_epoch": "1533965160.581392000" }, { "tcp_stream": 968, "frame_number": 35730, "display_filter": "frame.number == 35730", "timestamp_epoch": "1533965160.668665000" } ], "is_private": null, "observable_id": "observable-b592ac0bf7ba67806fe96635", "last_seen_epoch": "1533965160.668665000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965160.271640000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "syndication.twitter.com", "evidence": [ { "udp_stream": 352, "frame_number": 44228, "display_filter": "frame.number == 44228", "timestamp_epoch": "1533965784.469953000" }, { "udp_stream": 352, "frame_number": 44343, "display_filter": "frame.number == 44343", "timestamp_epoch": "1533965785.001653000" }, { "tcp_stream": 1176, "frame_number": 44622, "display_filter": "frame.number == 44622", "timestamp_epoch": "1533965785.932997000" }, { "tcp_stream": 1175, "frame_number": 44626, "display_filter": "frame.number == 44626", "timestamp_epoch": "1533965785.935461000" } ], "is_private": null, "observable_id": "observable-737ea5e6401fb1563d580f4c", "last_seen_epoch": "1533965785.935461000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965784.469953000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "t.cwkuki.com", "evidence": [ { "udp_stream": 112, "frame_number": 10580, "display_filter": "frame.number == 10580", "timestamp_epoch": "1533964900.525737000" }, { "udp_stream": 112, "frame_number": 10606, "display_filter": "frame.number == 10606", "timestamp_epoch": "1533964900.584234000" }, { "tcp_stream": 269, "frame_number": 10679, "display_filter": "frame.number == 10679", "timestamp_epoch": "1533964900.703345000" }, { "tcp_stream": 270, "frame_number": 10707, "display_filter": "frame.number == 10707", "timestamp_epoch": "1533964900.713504000" } ], "is_private": null, "observable_id": "observable-4a651af8135c3e607fee3148", "last_seen_epoch": "1533964900.713504000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964900.525737000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "t.lkqd.net", "evidence": [ { "udp_stream": 163, "frame_number": 15606, "display_filter": "frame.number == 15606", "timestamp_epoch": "1533964906.852301000" }, { "udp_stream": 163, "frame_number": 15635, "display_filter": "frame.number == 15635", "timestamp_epoch": "1533964906.967863000" }, { "tcp_stream": 428, "frame_number": 15676, "display_filter": "frame.number == 15676", "timestamp_epoch": "1533964907.180598000" }, { "tcp_stream": 429, "frame_number": 15677, "display_filter": "frame.number == 15677", "timestamp_epoch": "1533964907.180602000" }, { "tcp_stream": 427, "frame_number": 15682, "display_filter": "frame.number == 15682", "timestamp_epoch": "1533964907.187736000" }, { "tcp_stream": 430, "frame_number": 15727, "display_filter": "frame.number == 15727", "timestamp_epoch": "1533964907.339216000" }, { "tcp_stream": 431, "frame_number": 15735, "display_filter": "frame.number == 15735", "timestamp_epoch": "1533964907.423343000" }, { "tcp_stream": 434, "frame_number": 15831, "display_filter": "frame.number == 15831", "timestamp_epoch": "1533964907.716650000" } ], "is_private": null, "observable_id": "observable-6d436e72d60c68bfa80f25b2", "last_seen_epoch": "1533964907.716650000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964906.852301000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "t.mookie1.com", "evidence": [ { "udp_stream": 234, "frame_number": 23569, "display_filter": "frame.number == 23569", "timestamp_epoch": "1533964997.744678000" }, { "udp_stream": 234, "frame_number": 23623, "display_filter": "frame.number == 23623", "timestamp_epoch": "1533964997.803829000" }, { "tcp_stream": 654, "frame_number": 23717, "display_filter": "frame.number == 23717", "timestamp_epoch": "1533964997.934130000" }, { "tcp_stream": 655, "frame_number": 23731, "display_filter": "frame.number == 23731", "timestamp_epoch": "1533964997.937638000" } ], "is_private": null, "observable_id": "observable-bfd4f01fb5e9280dec2412ed", "last_seen_epoch": "1533964997.937638000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964997.744678000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "t.wayfair.com", "evidence": [ { "udp_stream": 232, "frame_number": 23567, "display_filter": "frame.number == 23567", "timestamp_epoch": "1533964997.736160000" }, { "udp_stream": 232, "frame_number": 23638, "display_filter": "frame.number == 23638", "timestamp_epoch": "1533964997.826472000" }, { "tcp_stream": 658, "frame_number": 23702, "display_filter": "frame.number == 23702", "timestamp_epoch": "1533964997.907612000" }, { "tcp_stream": 659, "frame_number": 23705, "display_filter": "frame.number == 23705", "timestamp_epoch": "1533964997.908221000" } ], "is_private": null, "observable_id": "observable-3ac6be24016c5515d382b5c5", "last_seen_epoch": "1533964997.908221000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964997.736160000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "tag.1rx.io", "evidence": [ { "udp_stream": 137, "frame_number": 12971, "display_filter": "frame.number == 12971", "timestamp_epoch": "1533964902.913737000" }, { "udp_stream": 137, "frame_number": 13018, "display_filter": "frame.number == 13018", "timestamp_epoch": "1533964902.980837000" }, { "tcp_stream": 335, "frame_number": 13105, "display_filter": "frame.number == 13105", "timestamp_epoch": "1533964903.067494000" }, { "tcp_stream": 334, "frame_number": 13115, "display_filter": "frame.number == 13115", "timestamp_epoch": "1533964903.080511000" } ], "is_private": null, "observable_id": "observable-16864e5fdda2d0203e42c59a", "last_seen_epoch": "1533964903.080511000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964902.913737000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "tags.bluekai.com", "evidence": [ { "udp_stream": 241, "frame_number": 24028, "display_filter": "frame.number == 24028", "timestamp_epoch": "1533964999.378484000" }, { "udp_stream": 241, "frame_number": 24044, "display_filter": "frame.number == 24044", "timestamp_epoch": "1533964999.506406000" }, { "tcp_stream": 675, "frame_number": 24084, "display_filter": "frame.number == 24084", "timestamp_epoch": "1533964999.566031000" }, { "tcp_stream": 674, "frame_number": 24089, "display_filter": "frame.number == 24089", "timestamp_epoch": "1533964999.566541000" } ], "is_private": null, "observable_id": "observable-488dd99b2e3243d1ebc9e36a", "last_seen_epoch": "1533964999.566541000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964999.378484000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "tags.crwdcntrl.net", "evidence": [ { "udp_stream": 204, "frame_number": 19275, "display_filter": "frame.number == 19275", "timestamp_epoch": "1533964961.689236000" }, { "udp_stream": 204, "frame_number": 19335, "display_filter": "frame.number == 19335", "timestamp_epoch": "1533964961.815071000" }, { "tcp_stream": 558, "frame_number": 19374, "display_filter": "frame.number == 19374", "timestamp_epoch": "1533964961.873178000" }, { "tcp_stream": 559, "frame_number": 19381, "display_filter": "frame.number == 19381", "timestamp_epoch": "1533964961.876009000" } ], "is_private": null, "observable_id": "observable-59bcde5efce29d9b5252d8a9", "last_seen_epoch": "1533964961.876009000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964961.689236000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "target.mixi.media", "evidence": [ { "udp_stream": 104, "frame_number": 9220, "display_filter": "frame.number == 9220", "timestamp_epoch": "1533964899.124450000" }, { "udp_stream": 104, "frame_number": 9471, "display_filter": "frame.number == 9471", "timestamp_epoch": "1533964899.377655000" }, { "tcp_stream": 256, "frame_number": 9722, "display_filter": "frame.number == 9722", "timestamp_epoch": "1533964899.605767000" }, { "tcp_stream": 254, "frame_number": 9734, "display_filter": "frame.number == 9734", "timestamp_epoch": "1533964899.613514000" } ], "is_private": null, "observable_id": "observable-d36da193eb5ec8e3057b0268", "last_seen_epoch": "1533964899.613514000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964899.124450000" }, { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "tass.com", "evidence": [ { "udp_stream": 126, "frame_number": 40086, "display_filter": "frame.number == 40086", "timestamp_epoch": "1533965768.345089000" }, { "udp_stream": 126, "frame_number": 40087, "display_filter": "frame.number == 40087", "timestamp_epoch": "1533965768.408215000" }, { "tcp_stream": 1071, "frame_number": 40100, "display_filter": "frame.number == 40100", "timestamp_epoch": "1533965768.745327000" }, { "tcp_stream": 1070, "frame_number": 40113, "display_filter": "frame.number == 40113", "timestamp_epoch": "1533965770.052650000" }, { "tcp_stream": 1074, "frame_number": 40165, "display_filter": "frame.number == 40165", "timestamp_epoch": "1533965770.465535000" }, { "tcp_stream": 1072, "frame_number": 40171, "display_filter": "frame.number == 40171", "timestamp_epoch": "1533965770.466207000" }, { "tcp_stream": 1073, "frame_number": 40173, "display_filter": "frame.number == 40173", "timestamp_epoch": "1533965770.466368000" }, { "tcp_stream": 1075, "frame_number": 40177, "display_filter": "frame.number == 40177", "timestamp_epoch": "1533965770.467225000" }, { "tcp_stream": 1071, "frame_number": 40213, "display_filter": "frame.number == 40213", "timestamp_epoch": "1533965770.489095000" }, { "tcp_stream": 1071, "frame_number": 40361, "display_filter": "frame.number == 40361", "timestamp_epoch": "1533965770.816258000" }, { "tcp_stream": 1074, "frame_number": 40510, "display_filter": "frame.number == 40510", "timestamp_epoch": "1533965771.062766000" }, { "tcp_stream": 1072, "frame_number": 40518, "display_filter": "frame.number == 40518", "timestamp_epoch": "1533965771.072573000" }, { "tcp_stream": 1075, "frame_number": 40562, "display_filter": "frame.number == 40562", "timestamp_epoch": "1533965771.132264000" }, { "tcp_stream": 1071, "frame_number": 40737, "display_filter": "frame.number == 40737", "timestamp_epoch": "1533965771.477596000" }, { "tcp_stream": 1073, "frame_number": 41022, "display_filter": "frame.number == 41022", "timestamp_epoch": "1533965773.993678000" }, { "tcp_stream": 1070, "frame_number": 41026, "display_filter": "frame.number == 41026", "timestamp_epoch": "1533965774.002334000" }, { "tcp_stream": 1072, "frame_number": 41034, "display_filter": "frame.number == 41034", "timestamp_epoch": "1533965774.016397000" }, { "tcp_stream": 1074, "frame_number": 41036, "display_filter": "frame.number == 41036", "timestamp_epoch": "1533965774.016484000" }, { "tcp_stream": 1075, "frame_number": 41060, "display_filter": "frame.number == 41060", "timestamp_epoch": "1533965774.048915000" }, { "tcp_stream": 1071, "frame_number": 41126, "display_filter": "frame.number == 41126", "timestamp_epoch": "1533965772.393285000" } ], "is_private": null, "observable_id": "observable-d458120e432992d199b50450", "last_seen_epoch": "1533965791.472841000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965768.345089000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "td.thebrighttag.com", "evidence": [ { "udp_stream": 260, "frame_number": 27324, "display_filter": "frame.number == 27324", "timestamp_epoch": "1533965035.406855000" } ], "is_private": null, "observable_id": "observable-abab6f57883a3f35a2229b8d", "last_seen_epoch": "1533965035.406855000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965035.406855000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "teutorigos-cat.com", "evidence": [ { "udp_stream": 111, "frame_number": 10577, "display_filter": "frame.number == 10577", "timestamp_epoch": "1533964900.523369000" }, { "udp_stream": 111, "frame_number": 10617, "display_filter": "frame.number == 10617", "timestamp_epoch": "1533964900.621189000" }, { "tcp_stream": 274, "frame_number": 10675, "display_filter": "frame.number == 10675", "timestamp_epoch": "1533964900.703100000" }, { "tcp_stream": 273, "frame_number": 10680, "display_filter": "frame.number == 10680", "timestamp_epoch": "1533964900.703501000" } ], "is_private": null, "observable_id": "observable-20eabb31357d266f1353b7e1", "last_seen_epoch": "1533964900.703501000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964900.523369000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "thrtle.com", "evidence": [ { "udp_stream": 240, "frame_number": 24027, "display_filter": "frame.number == 24027", "timestamp_epoch": "1533964999.378366000" }, { "udp_stream": 240, "frame_number": 24040, "display_filter": "frame.number == 24040", "timestamp_epoch": "1533964999.467395000" }, { "tcp_stream": 670, "frame_number": 24101, "display_filter": "frame.number == 24101", "timestamp_epoch": "1533964999.588590000" }, { "tcp_stream": 671, "frame_number": 24107, "display_filter": "frame.number == 24107", "timestamp_epoch": "1533964999.608486000" } ], "is_private": null, "observable_id": "observable-77085cead15e1e92cdd71c86", "last_seen_epoch": "1533964999.608486000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964999.378366000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "token.rubiconproject.com", "evidence": [ { "udp_stream": 174, "frame_number": 16538, "display_filter": "frame.number == 16538", "timestamp_epoch": "1533964909.995908000" }, { "udp_stream": 174, "frame_number": 16558, "display_filter": "frame.number == 16558", "timestamp_epoch": "1533964910.093175000" }, { "tcp_stream": 469, "frame_number": 16588, "display_filter": "frame.number == 16588", "timestamp_epoch": "1533964910.150506000" }, { "tcp_stream": 470, "frame_number": 16592, "display_filter": "frame.number == 16592", "timestamp_epoch": "1533964910.156208000" }, { "tcp_stream": 471, "frame_number": 16600, "display_filter": "frame.number == 16600", "timestamp_epoch": "1533964910.171224000" }, { "tcp_stream": 667, "frame_number": 24033, "display_filter": "frame.number == 24033", "timestamp_epoch": "1533964999.451299000" }, { "tcp_stream": 666, "frame_number": 24034, "display_filter": "frame.number == 24034", "timestamp_epoch": "1533964999.451579000" } ], "is_private": null, "observable_id": "observable-a3d92c3b10000f7b9dc41231", "last_seen_epoch": "1533964999.451579000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964909.995908000" }, { "type": "domain", "roles": [ "dns-query", "http-host", "tls-sni" ], "value": "tpc.googlesyndication.com", "evidence": [ { "udp_stream": 60, "frame_number": 4895, "display_filter": "frame.number == 4895", "timestamp_epoch": "1533964555.650027000" }, { "udp_stream": 60, "frame_number": 4936, "display_filter": "frame.number == 4936", "timestamp_epoch": "1533964555.714019000" }, { "udp_stream": 347, "frame_number": 44102, "display_filter": "frame.number == 44102", "timestamp_epoch": "1533965784.176878000" }, { "udp_stream": 347, "frame_number": 44193, "display_filter": "frame.number == 44193", "timestamp_epoch": "1533965784.401633000" }, { "tcp_stream": 1165, "frame_number": 44277, "display_filter": "frame.number == 44277", "timestamp_epoch": "1533965784.655535000" }, { "tcp_stream": 1166, "frame_number": 44398, "display_filter": "frame.number == 44398", "timestamp_epoch": "1533965785.099585000" }, { "tcp_stream": 113, "frame_number": 4986, "display_filter": "frame.number == 4986", "timestamp_epoch": "1533964555.774473000" }, { "tcp_stream": 114, "frame_number": 4996, "display_filter": "frame.number == 4996", "timestamp_epoch": "1533964555.787234000" }, { "tcp_stream": 248, "frame_number": 9666, "display_filter": "frame.number == 9666", "timestamp_epoch": "1533964899.587924000" }, { "tcp_stream": 249, "frame_number": 9668, "display_filter": "frame.number == 9668", "timestamp_epoch": "1533964899.588139000" }, { "tcp_stream": 258, "frame_number": 9716, "display_filter": "frame.number == 9716", "timestamp_epoch": "1533964899.603619000" }, { "tcp_stream": 906, "frame_number": 33110, "display_filter": "frame.number == 33110", "timestamp_epoch": "1533965137.166579000" }, { "tcp_stream": 907, "frame_number": 33118, "display_filter": "frame.number == 33118", "timestamp_epoch": "1533965137.186092000" }, { "tcp_stream": 1016, "frame_number": 39042, "display_filter": "frame.number == 39042", "timestamp_epoch": "1533965240.902415000" }, { "tcp_stream": 1017, "frame_number": 39050, "display_filter": "frame.number == 39050", "timestamp_epoch": "1533965240.916740000" }, { "tcp_stream": 1179, "frame_number": 44710, "display_filter": "frame.number == 44710", "timestamp_epoch": "1533965786.046910000" }, { "tcp_stream": 1177, "frame_number": 44716, "display_filter": "frame.number == 44716", "timestamp_epoch": "1533965786.047696000" }, { "tcp_stream": 1178, "frame_number": 44718, "display_filter": "frame.number == 44718", "timestamp_epoch": "1533965786.047800000" }, { "tcp_stream": 1185, "frame_number": 44726, "display_filter": "frame.number == 44726", "timestamp_epoch": "1533965786.084904000" }, { "tcp_stream": 1184, "frame_number": 44730, "display_filter": "frame.number == 44730", "timestamp_epoch": "1533965786.085797000" } ], "is_private": null, "observable_id": "observable-255e87911e59b41153333be3", "last_seen_epoch": "1533965786.361740000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964555.650027000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "tps.doubleverify.com", "evidence": [ { "udp_stream": 298, "frame_number": 33372, "display_filter": "frame.number == 33372", "timestamp_epoch": "1533965137.714649000" }, { "udp_stream": 298, "frame_number": 33377, "display_filter": "frame.number == 33377", "timestamp_epoch": "1533965137.904526000" }, { "tcp_stream": 917, "frame_number": 33386, "display_filter": "frame.number == 33386", "timestamp_epoch": "1533965137.996576000" }, { "tcp_stream": 918, "frame_number": 33388, "display_filter": "frame.number == 33388", "timestamp_epoch": "1533965137.996654000" } ], "is_private": null, "observable_id": "observable-a94419c92ff8df0945c9e032", "last_seen_epoch": "1533965137.996654000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965137.714649000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "tps700.doubleverify.com", "evidence": [ { "udp_stream": 307, "frame_number": 38808, "display_filter": "frame.number == 38808", "timestamp_epoch": "1533965240.128848000" }, { "udp_stream": 307, "frame_number": 38809, "display_filter": "frame.number == 38809", "timestamp_epoch": "1533965240.205005000" }, { "tcp_stream": 1002, "frame_number": 38818, "display_filter": "frame.number == 38818", "timestamp_epoch": "1533965240.283333000" }, { "tcp_stream": 1003, "frame_number": 38824, "display_filter": "frame.number == 38824", "timestamp_epoch": "1533965240.296201000" }, { "tcp_stream": 1004, "frame_number": 38830, "display_filter": "frame.number == 38830", "timestamp_epoch": "1533965240.322685000" }, { "tcp_stream": 1005, "frame_number": 38850, "display_filter": "frame.number == 38850", "timestamp_epoch": "1533965240.367062000" }, { "tcp_stream": 1011, "frame_number": 38972, "display_filter": "frame.number == 38972", "timestamp_epoch": "1533965240.702883000" }, { "tcp_stream": 1012, "frame_number": 38974, "display_filter": "frame.number == 38974", "timestamp_epoch": "1533965240.703207000" }, { "tcp_stream": 1013, "frame_number": 38986, "display_filter": "frame.number == 38986", "timestamp_epoch": "1533965240.732190000" }, { "tcp_stream": 1018, "frame_number": 39046, "display_filter": "frame.number == 39046", "timestamp_epoch": "1533965240.915990000" }, { "tcp_stream": 1019, "frame_number": 39090, "display_filter": "frame.number == 39090", "timestamp_epoch": "1533965241.033400000" }, { "tcp_stream": 1020, "frame_number": 39136, "display_filter": "frame.number == 39136", "timestamp_epoch": "1533965241.351114000" } ], "is_private": null, "observable_id": "observable-3d3a664b5fb06d9361a7bdba", "last_seen_epoch": "1533965241.351114000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965240.128848000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "tps702.doubleverify.com", "evidence": [ { "udp_stream": 297, "frame_number": 33067, "display_filter": "frame.number == 33067", "timestamp_epoch": "1533965137.026488000" }, { "udp_stream": 297, "frame_number": 33093, "display_filter": "frame.number == 33093", "timestamp_epoch": "1533965137.114452000" }, { "tcp_stream": 908, "frame_number": 33119, "display_filter": "frame.number == 33119", "timestamp_epoch": "1533965137.186096000" }, { "tcp_stream": 911, "frame_number": 33132, "display_filter": "frame.number == 33132", "timestamp_epoch": "1533965137.203286000" }, { "tcp_stream": 910, "frame_number": 33133, "display_filter": "frame.number == 33133", "timestamp_epoch": "1533965137.203289000" }, { "tcp_stream": 909, "frame_number": 33135, "display_filter": "frame.number == 33135", "timestamp_epoch": "1533965137.203629000" }, { "tcp_stream": 913, "frame_number": 33136, "display_filter": "frame.number == 33136", "timestamp_epoch": "1533965137.203720000" }, { "tcp_stream": 912, "frame_number": 33139, "display_filter": "frame.number == 33139", "timestamp_epoch": "1533965137.203985000" }, { "tcp_stream": 915, "frame_number": 33350, "display_filter": "frame.number == 33350", "timestamp_epoch": "1533965137.611935000" }, { "tcp_stream": 916, "frame_number": 33358, "display_filter": "frame.number == 33358", "timestamp_epoch": "1533965137.615961000" } ], "is_private": null, "observable_id": "observable-e9cc20913710a8f7ce65a45d", "last_seen_epoch": "1533965137.615961000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965137.026488000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "track-eu.adformnet.akadns.net", "evidence": [ { "udp_stream": 235, "frame_number": 23649, "display_filter": "frame.number == 23649", "timestamp_epoch": "1533964997.831687000" } ], "is_private": null, "observable_id": "observable-6e61f4d495da78b41cf66845", "last_seen_epoch": "1533964997.831687000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964997.831687000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "track.eyeviewads.com", "evidence": [ { "udp_stream": 248, "frame_number": 26698, "display_filter": "frame.number == 26698", "timestamp_epoch": "1533965033.400951000" }, { "udp_stream": 248, "frame_number": 26728, "display_filter": "frame.number == 26728", "timestamp_epoch": "1533965033.481510000" }, { "tcp_stream": 713, "frame_number": 26766, "display_filter": "frame.number == 26766", "timestamp_epoch": "1533965033.590350000" }, { "tcp_stream": 714, "frame_number": 26791, "display_filter": "frame.number == 26791", "timestamp_epoch": "1533965033.601028000" } ], "is_private": null, "observable_id": "observable-b9c3760cca1254ca0f41a646", "last_seen_epoch": "1533965033.601028000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965033.400951000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "tracking-prod-public-741746200.us-west-1.elb.amazonaws.com", "evidence": [ { "udp_stream": 154, "frame_number": 14640, "display_filter": "frame.number == 14640", "timestamp_epoch": "1533964904.663956000" }, { "udp_stream": 364, "frame_number": 46080, "display_filter": "frame.number == 46080", "timestamp_epoch": "1533965789.714227000" } ], "is_private": null, "observable_id": "observable-3cc7663e2a08ea553217811a", "last_seen_epoch": "1533965789.714227000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964904.663956000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "trc.taboola.com", "evidence": [ { "udp_stream": 279, "frame_number": 31566, "display_filter": "frame.number == 31566", "timestamp_epoch": "1533965100.651079000" }, { "udp_stream": 279, "frame_number": 31673, "display_filter": "frame.number == 31673", "timestamp_epoch": "1533965100.796418000" }, { "tcp_stream": 865, "frame_number": 31800, "display_filter": "frame.number == 31800", "timestamp_epoch": "1533965100.912658000" }, { "tcp_stream": 864, "frame_number": 31806, "display_filter": "frame.number == 31806", "timestamp_epoch": "1533965100.914287000" } ], "is_private": null, "observable_id": "observable-dded06e97a7431cfd3ca8af4", "last_seen_epoch": "1533965100.914287000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965100.651079000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "trc.taboola.map.fastly.net", "evidence": [ { "udp_stream": 191, "frame_number": 18574, "display_filter": "frame.number == 18574", "timestamp_epoch": "1533964959.368247000" }, { "udp_stream": 287, "frame_number": 32144, "display_filter": "frame.number == 32144", "timestamp_epoch": "1533965101.694508000" } ], "is_private": null, "observable_id": "observable-e84cdc0986031b8253fb6ca3", "last_seen_epoch": "1533965101.694508000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964959.368247000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "tru.am", "evidence": [ { "udp_stream": 51, "frame_number": 3215, "display_filter": "frame.number == 3215", "timestamp_epoch": "1533964552.431390000" }, { "udp_stream": 51, "frame_number": 3335, "display_filter": "frame.number == 3335", "timestamp_epoch": "1533964552.717075000" }, { "tcp_stream": 92, "frame_number": 3486, "display_filter": "frame.number == 3486", "timestamp_epoch": "1533964552.880734000" }, { "tcp_stream": 93, "frame_number": 3494, "display_filter": "frame.number == 3494", "timestamp_epoch": "1533964552.882566000" } ], "is_private": null, "observable_id": "observable-f7d7b04b96fc88f0fa96e872", "last_seen_epoch": "1533964552.882566000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964552.431390000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "tt.onthe.io", "evidence": [ { "udp_stream": 358, "frame_number": 45115, "display_filter": "frame.number == 45115", "timestamp_epoch": "1533965786.906355000" }, { "udp_stream": 358, "frame_number": 45340, "display_filter": "frame.number == 45340", "timestamp_epoch": "1533965787.454378000" }, { "tcp_stream": 1201, "frame_number": 45586, "display_filter": "frame.number == 45586", "timestamp_epoch": "1533965788.247122000" }, { "tcp_stream": 1200, "frame_number": 45594, "display_filter": "frame.number == 45594", "timestamp_epoch": "1533965788.250586000" } ], "is_private": null, "observable_id": "observable-3f3240459f55fd88e32b5c06", "last_seen_epoch": "1533965788.250586000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965786.906355000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "tt1.zedo.com", "evidence": [ { "udp_stream": 135, "frame_number": 12773, "display_filter": "frame.number == 12773", "timestamp_epoch": "1533964902.709304000" }, { "udp_stream": 135, "frame_number": 12799, "display_filter": "frame.number == 12799", "timestamp_epoch": "1533964902.763199000" }, { "tcp_stream": 331, "frame_number": 12887, "display_filter": "frame.number == 12887", "timestamp_epoch": "1533964902.838650000" }, { "tcp_stream": 330, "frame_number": 12889, "display_filter": "frame.number == 12889", "timestamp_epoch": "1533964902.838771000" }, { "tcp_stream": 338, "frame_number": 13336, "display_filter": "frame.number == 13336", "timestamp_epoch": "1533964903.232805000" }, { "tcp_stream": 337, "frame_number": 13337, "display_filter": "frame.number == 13337", "timestamp_epoch": "1533964903.232952000" }, { "tcp_stream": 346, "frame_number": 13496, "display_filter": "frame.number == 13496", "timestamp_epoch": "1533964903.482466000" }, { "tcp_stream": 345, "frame_number": 13505, "display_filter": "frame.number == 13505", "timestamp_epoch": "1533964903.493197000" }, { "tcp_stream": 348, "frame_number": 13511, "display_filter": "frame.number == 13511", "timestamp_epoch": "1533964903.504997000" }, { "tcp_stream": 347, "frame_number": 13512, "display_filter": "frame.number == 13512", "timestamp_epoch": "1533964903.505113000" }, { "tcp_stream": 351, "frame_number": 13601, "display_filter": "frame.number == 13601", "timestamp_epoch": "1533964903.579811000" }, { "tcp_stream": 354, "frame_number": 13631, "display_filter": "frame.number == 13631", "timestamp_epoch": "1533964903.624503000" }, { "tcp_stream": 359, "frame_number": 13872, "display_filter": "frame.number == 13872", "timestamp_epoch": "1533964903.772678000" }, { "tcp_stream": 358, "frame_number": 13880, "display_filter": "frame.number == 13880", "timestamp_epoch": "1533964903.781394000" }, { "tcp_stream": 360, "frame_number": 13913, "display_filter": "frame.number == 13913", "timestamp_epoch": "1533964903.793456000" }, { "tcp_stream": 361, "frame_number": 13915, "display_filter": "frame.number == 13915", "timestamp_epoch": "1533964903.793584000" }, { "tcp_stream": 365, "frame_number": 14009, "display_filter": "frame.number == 14009", "timestamp_epoch": "1533964903.870950000" }, { "tcp_stream": 366, "frame_number": 14047, "display_filter": "frame.number == 14047", "timestamp_epoch": "1533964903.937187000" }, { "tcp_stream": 367, "frame_number": 14191, "display_filter": "frame.number == 14191", "timestamp_epoch": "1533964904.073957000" }, { "tcp_stream": 368, "frame_number": 14244, "display_filter": "frame.number == 14244", "timestamp_epoch": "1533964904.125634000" } ], "is_private": null, "observable_id": "observable-61d5bc0985707baae74d7d8e", "last_seen_epoch": "1533964954.912900000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964902.709304000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "tt3.zedo.com", "evidence": [ { "udp_stream": 159, "frame_number": 14974, "display_filter": "frame.number == 14974", "timestamp_epoch": "1533964904.971944000" }, { "udp_stream": 159, "frame_number": 15053, "display_filter": "frame.number == 15053", "timestamp_epoch": "1533964905.068551000" }, { "tcp_stream": 415, "frame_number": 15084, "display_filter": "frame.number == 15084", "timestamp_epoch": "1533964905.116295000" }, { "tcp_stream": 416, "frame_number": 15091, "display_filter": "frame.number == 15091", "timestamp_epoch": "1533964905.125018000" } ], "is_private": null, "observable_id": "observable-575e147c253236dde73615a3", "last_seen_epoch": "1533964905.125018000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964904.971944000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "uat-net.technoratimedia.com", "evidence": [ { "udp_stream": 182, "frame_number": 17854, "display_filter": "frame.number == 17854", "timestamp_epoch": "1533964957.358429000" }, { "udp_stream": 182, "frame_number": 17855, "display_filter": "frame.number == 17855", "timestamp_epoch": "1533964957.358759000" }, { "tcp_stream": 500, "frame_number": 17946, "display_filter": "frame.number == 17946", "timestamp_epoch": "1533964957.595012000" }, { "tcp_stream": 501, "frame_number": 17957, "display_filter": "frame.number == 17957", "timestamp_epoch": "1533964957.625014000" }, { "tcp_stream": 514, "frame_number": 18298, "display_filter": "frame.number == 18298", "timestamp_epoch": "1533964958.637131000" }, { "tcp_stream": 794, "frame_number": 29645, "display_filter": "frame.number == 29645", "timestamp_epoch": "1533965096.936583000" }, { "tcp_stream": 795, "frame_number": 29655, "display_filter": "frame.number == 29655", "timestamp_epoch": "1533965096.962190000" }, { "tcp_stream": 842, "frame_number": 31402, "display_filter": "frame.number == 31402", "timestamp_epoch": "1533965100.369048000" } ], "is_private": null, "observable_id": "observable-ae798a2f813a380f8fb83d55", "last_seen_epoch": "1533965100.369048000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964957.358429000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "uat-secure.technoratimedia.com", "evidence": [ { "udp_stream": 179, "frame_number": 17346, "display_filter": "frame.number == 17346", "timestamp_epoch": "1533964956.246434000" }, { "udp_stream": 179, "frame_number": 17349, "display_filter": "frame.number == 17349", "timestamp_epoch": "1533964956.315471000" }, { "tcp_stream": 493, "frame_number": 17386, "display_filter": "frame.number == 17386", "timestamp_epoch": "1533964956.426876000" }, { "tcp_stream": 494, "frame_number": 17387, "display_filter": "frame.number == 17387", "timestamp_epoch": "1533964956.427338000" } ], "is_private": null, "observable_id": "observable-bd78d613be7025b9ac548b74", "last_seen_epoch": "1533964956.427338000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964956.246434000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "ucs02.engageya.com", "evidence": [ { "udp_stream": 115, "frame_number": 10615, "display_filter": "frame.number == 10615", "timestamp_epoch": "1533964900.592860000" }, { "udp_stream": 115, "frame_number": 10632, "display_filter": "frame.number == 10632", "timestamp_epoch": "1533964900.643556000" }, { "tcp_stream": 280, "frame_number": 10878, "display_filter": "frame.number == 10878", "timestamp_epoch": "1533964900.852025000" }, { "tcp_stream": 281, "frame_number": 10881, "display_filter": "frame.number == 10881", "timestamp_epoch": "1533964900.852278000" } ], "is_private": null, "observable_id": "observable-7ddf00bd86473f5ba4fe5bf0", "last_seen_epoch": "1533964900.852278000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964900.592860000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "um.simpli.fi", "evidence": [ { "udp_stream": 75, "frame_number": 5852, "display_filter": "frame.number == 5852", "timestamp_epoch": "1533964559.407246000" }, { "udp_stream": 75, "frame_number": 5872, "display_filter": "frame.number == 5872", "timestamp_epoch": "1533964559.485716000" }, { "tcp_stream": 147, "frame_number": 5913, "display_filter": "frame.number == 5913", "timestamp_epoch": "1533964559.549609000" }, { "tcp_stream": 149, "frame_number": 5920, "display_filter": "frame.number == 5920", "timestamp_epoch": "1533964559.550654000" }, { "tcp_stream": 629, "frame_number": 23296, "display_filter": "frame.number == 23296", "timestamp_epoch": "1533964997.291763000" }, { "tcp_stream": 628, "frame_number": 23305, "display_filter": "frame.number == 23305", "timestamp_epoch": "1533964997.295515000" } ], "is_private": null, "observable_id": "observable-7fb09f1e9b9437ca3b15a0c4", "last_seen_epoch": "1533964997.295515000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964559.407246000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "us-u.openx.net", "evidence": [ { "udp_stream": 59, "frame_number": 4853, "display_filter": "frame.number == 4853", "timestamp_epoch": "1533964555.557011000" }, { "udp_stream": 59, "frame_number": 4896, "display_filter": "frame.number == 4896", "timestamp_epoch": "1533964555.650800000" }, { "tcp_stream": 111, "frame_number": 4925, "display_filter": "frame.number == 4925", "timestamp_epoch": "1533964555.708590000" }, { "tcp_stream": 112, "frame_number": 4934, "display_filter": "frame.number == 4934", "timestamp_epoch": "1533964555.710501000" }, { "tcp_stream": 222, "frame_number": 8695, "display_filter": "frame.number == 8695", "timestamp_epoch": "1533964898.654670000" }, { "tcp_stream": 221, "frame_number": 8699, "display_filter": "frame.number == 8699", "timestamp_epoch": "1533964898.655738000" }, { "tcp_stream": 374, "frame_number": 14364, "display_filter": "frame.number == 14364", "timestamp_epoch": "1533964904.327679000" }, { "tcp_stream": 376, "frame_number": 14366, "display_filter": "frame.number == 14366", "timestamp_epoch": "1533964904.327827000" }, { "tcp_stream": 373, "frame_number": 14368, "display_filter": "frame.number == 14368", "timestamp_epoch": "1533964904.328213000" }, { "tcp_stream": 375, "frame_number": 14369, "display_filter": "frame.number == 14369", "timestamp_epoch": "1533964904.328294000" } ], "is_private": null, "observable_id": "observable-b3e63eba85e4b91e7a7f62e8", "last_seen_epoch": "1533964904.328294000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964555.557011000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "usorlzdiprd-external-190420686.us-west-2.elb.amazonaws.com", "evidence": [ { "udp_stream": 252, "frame_number": 26736, "display_filter": "frame.number == 26736", "timestamp_epoch": "1533965033.496493000" } ], "is_private": null, "observable_id": "observable-52b7722e8059b34b71cce374", "last_seen_epoch": "1533965033.496493000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965033.496493000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "v.lkqd.net", "evidence": [ { "udp_stream": 157, "frame_number": 14624, "display_filter": "frame.number == 14624", "timestamp_epoch": "1533964904.640864000" }, { "udp_stream": 157, "frame_number": 14679, "display_filter": "frame.number == 14679", "timestamp_epoch": "1533964904.689217000" }, { "tcp_stream": 409, "frame_number": 14930, "display_filter": "frame.number == 14930", "timestamp_epoch": "1533964904.905276000" }, { "tcp_stream": 411, "frame_number": 14934, "display_filter": "frame.number == 14934", "timestamp_epoch": "1533964904.912081000" }, { "tcp_stream": 410, "frame_number": 14935, "display_filter": "frame.number == 14935", "timestamp_epoch": "1533964904.912221000" }, { "tcp_stream": 412, "frame_number": 14938, "display_filter": "frame.number == 14938", "timestamp_epoch": "1533964904.912592000" } ], "is_private": null, "observable_id": "observable-5262bc4a0a545ee10c81f277", "last_seen_epoch": "1533964904.912592000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964904.640864000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "vap.lijit.com", "evidence": [ { "udp_stream": 284, "frame_number": 31672, "display_filter": "frame.number == 31672", "timestamp_epoch": "1533965100.795928000" } ], "is_private": null, "observable_id": "observable-85f325c27426fd96d6234106", "last_seen_epoch": "1533965100.795928000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965100.795928000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "vcdn.adnxs.com", "evidence": [ { "udp_stream": 226, "frame_number": 23164, "display_filter": "frame.number == 23164", "timestamp_epoch": "1533964996.955481000" }, { "udp_stream": 226, "frame_number": 23216, "display_filter": "frame.number == 23216", "timestamp_epoch": "1533964997.081499000" }, { "tcp_stream": 624, "frame_number": 23271, "display_filter": "frame.number == 23271", "timestamp_epoch": "1533964997.212549000" }, { "tcp_stream": 625, "frame_number": 23272, "display_filter": "frame.number == 23272", "timestamp_epoch": "1533964997.212875000" } ], "is_private": null, "observable_id": "observable-71ef8a3ce9222a08d8513b22", "last_seen_epoch": "1533964997.212875000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964996.955481000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "vid-io.springserve.com", "evidence": [ { "udp_stream": 180, "frame_number": 17429, "display_filter": "frame.number == 17429", "timestamp_epoch": "1533964956.524984000" }, { "udp_stream": 180, "frame_number": 17691, "display_filter": "frame.number == 17691", "timestamp_epoch": "1533964957.010961000" }, { "tcp_stream": 499, "frame_number": 17781, "display_filter": "frame.number == 17781", "timestamp_epoch": "1533964957.193121000" }, { "tcp_stream": 498, "frame_number": 17782, "display_filter": "frame.number == 17782", "timestamp_epoch": "1533964957.193122000" } ], "is_private": null, "observable_id": "observable-6a9d0e2848434463b998229c", "last_seen_epoch": "1533964957.193122000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964956.524984000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "vid-io.springserve.net", "evidence": [ { "udp_stream": 199, "frame_number": 19230, "display_filter": "frame.number == 19230", "timestamp_epoch": "1533964961.289231000" }, { "udp_stream": 199, "frame_number": 19231, "display_filter": "frame.number == 19231", "timestamp_epoch": "1533964961.387623000" }, { "tcp_stream": 549, "frame_number": 19235, "display_filter": "frame.number == 19235", "timestamp_epoch": "1533964961.462412000" }, { "tcp_stream": 603, "frame_number": 22011, "display_filter": "frame.number == 22011", "timestamp_epoch": "1533964981.293633000" }, { "tcp_stream": 678, "frame_number": 24295, "display_filter": "frame.number == 24295", "timestamp_epoch": "1533965002.762043000" }, { "tcp_stream": 681, "frame_number": 24464, "display_filter": "frame.number == 24464", "timestamp_epoch": "1533965016.446820000" }, { "tcp_stream": 772, "frame_number": 27956, "display_filter": "frame.number == 27956", "timestamp_epoch": "1533965036.405195000" }, { "tcp_stream": 779, "frame_number": 28264, "display_filter": "frame.number == 28264", "timestamp_epoch": "1533965056.460554000" }, { "tcp_stream": 782, "frame_number": 28501, "display_filter": "frame.number == 28501", "timestamp_epoch": "1533965076.803944000" }, { "tcp_stream": 785, "frame_number": 28646, "display_filter": "frame.number == 28646", "timestamp_epoch": "1533965091.432884000" }, { "tcp_stream": 884, "frame_number": 32429, "display_filter": "frame.number == 32429", "timestamp_epoch": "1533965111.411023000" }, { "tcp_stream": 887, "frame_number": 32608, "display_filter": "frame.number == 32608", "timestamp_epoch": "1533965131.843881000" }, { "tcp_stream": 923, "frame_number": 33544, "display_filter": "frame.number == 33544", "timestamp_epoch": "1533965152.660854000" }, { "tcp_stream": 976, "frame_number": 36112, "display_filter": "frame.number == 36112", "timestamp_epoch": "1533965174.416273000" }, { "tcp_stream": 979, "frame_number": 36276, "display_filter": "frame.number == 36276", "timestamp_epoch": "1533965195.109749000" }, { "tcp_stream": 989, "frame_number": 38643, "display_filter": "frame.number == 38643", "timestamp_epoch": "1533965235.986415000" } ], "is_private": null, "observable_id": "observable-250aa3332cacace8ab00b941", "last_seen_epoch": "1533965235.986415000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964961.289231000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "vid.springserve.com", "evidence": [ { "udp_stream": 181, "frame_number": 17792, "display_filter": "frame.number == 17792", "timestamp_epoch": "1533964957.237351000" }, { "udp_stream": 181, "frame_number": 17890, "display_filter": "frame.number == 17890", "timestamp_epoch": "1533964957.470463000" }, { "tcp_stream": 502, "frame_number": 17965, "display_filter": "frame.number == 17965", "timestamp_epoch": "1533964957.628407000" }, { "tcp_stream": 503, "frame_number": 17966, "display_filter": "frame.number == 17966", "timestamp_epoch": "1533964957.628409000" } ], "is_private": null, "observable_id": "observable-f6be2edc73c2e55fbb01531e", "last_seen_epoch": "1533964957.628409000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964957.237351000" }, { "type": "domain", "roles": [ "dns-query", "http-host", "tls-sni" ], "value": "vk.com", "evidence": [ { "udp_stream": 34, "frame_number": 603, "display_filter": "frame.number == 603", "timestamp_epoch": "1533964545.589318000" }, { "udp_stream": 34, "frame_number": 614, "display_filter": "frame.number == 614", "timestamp_epoch": "1533964545.653915000" }, { "udp_stream": 323, "frame_number": 40119, "display_filter": "frame.number == 40119", "timestamp_epoch": "1533965770.058014000" }, { "udp_stream": 323, "frame_number": 40120, "display_filter": "frame.number == 40120", "timestamp_epoch": "1533965770.136548000" }, { "tcp_stream": 1076, "frame_number": 40209, "display_filter": "frame.number == 40209", "timestamp_epoch": "1533965770.487843000" }, { "tcp_stream": 49, "frame_number": 747, "display_filter": "frame.number == 747", "timestamp_epoch": "1533964545.885142000" }, { "tcp_stream": 50, "frame_number": 758, "display_filter": "frame.number == 758", "timestamp_epoch": "1533964545.899143000" } ], "is_private": null, "observable_id": "observable-ab2217bf6e2a522a1543de3d", "last_seen_epoch": "1533965770.487843000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964545.589318000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "vpaid-springserve-net.ssmb.netdna-cdn.com", "evidence": [ { "udp_stream": 189, "frame_number": 18270, "display_filter": "frame.number == 18270", "timestamp_epoch": "1533964958.600112000" } ], "is_private": null, "observable_id": "observable-d467d184c5bb15cfa57a8165", "last_seen_epoch": "1533964958.600112000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964958.600112000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "vpaid.springserve.net", "evidence": [ { "udp_stream": 189, "frame_number": 18233, "display_filter": "frame.number == 18233", "timestamp_epoch": "1533964958.535877000" }, { "udp_stream": 189, "frame_number": 18270, "display_filter": "frame.number == 18270", "timestamp_epoch": "1533964958.600112000" }, { "tcp_stream": 517, "frame_number": 18317, "display_filter": "frame.number == 18317", "timestamp_epoch": "1533964958.687621000" }, { "tcp_stream": 518, "frame_number": 18326, "display_filter": "frame.number == 18326", "timestamp_epoch": "1533964958.690508000" } ], "is_private": null, "observable_id": "observable-0ac9009813f07ad6657fce5e", "last_seen_epoch": "1533964958.690508000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964958.535877000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "widget.engageya.com", "evidence": [ { "udp_stream": 92, "frame_number": 7801, "display_filter": "frame.number == 7801", "timestamp_epoch": "1533964897.663527000" }, { "udp_stream": 92, "frame_number": 8147, "display_filter": "frame.number == 8147", "timestamp_epoch": "1533964897.948811000" }, { "tcp_stream": 207, "frame_number": 8377, "display_filter": "frame.number == 8377", "timestamp_epoch": "1533964898.226439000" }, { "tcp_stream": 206, "frame_number": 8379, "display_filter": "frame.number == 8379", "timestamp_epoch": "1533964898.226623000" } ], "is_private": null, "observable_id": "observable-06a4eb58e2aed2bd3e3716b8", "last_seen_epoch": "1533964898.226623000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964897.663527000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "widgets.outbrain.com", "evidence": [ { "udp_stream": 118, "frame_number": 10976, "display_filter": "frame.number == 10976", "timestamp_epoch": "1533964900.966203000" }, { "udp_stream": 118, "frame_number": 11285, "display_filter": "frame.number == 11285", "timestamp_epoch": "1533964901.153957000" }, { "tcp_stream": 293, "frame_number": 11393, "display_filter": "frame.number == 11393", "timestamp_epoch": "1533964901.234478000" }, { "tcp_stream": 292, "frame_number": 11399, "display_filter": "frame.number == 11399", "timestamp_epoch": "1533964901.236361000" } ], "is_private": null, "observable_id": "observable-9fd76303214145ce412e74d5", "last_seen_epoch": "1533964901.236361000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964900.966203000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "wpad.localdomain", "evidence": [ { "udp_stream": 18, "frame_number": 292, "display_filter": "frame.number == 292", "timestamp_epoch": "1533964512.094062000" }, { "udp_stream": 18, "frame_number": 293, "display_filter": "frame.number == 293", "timestamp_epoch": "1533964512.094245000" }, { "udp_stream": 321, "frame_number": 40090, "display_filter": "frame.number == 40090", "timestamp_epoch": "1533965768.474924000" }, { "udp_stream": 321, "frame_number": 40095, "display_filter": "frame.number == 40095", "timestamp_epoch": "1533965768.531747000" } ], "is_private": null, "observable_id": "observable-4d9c3d11633432de285fb4de", "last_seen_epoch": "1533965768.531747000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964512.094062000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "wpad.sputnikhouse.org", "evidence": [ { "udp_stream": 17, "frame_number": 290, "display_filter": "frame.number == 290", "timestamp_epoch": "1533964512.093157000" }, { "udp_stream": 17, "frame_number": 291, "display_filter": "frame.number == 291", "timestamp_epoch": "1533964512.093493000" }, { "udp_stream": 320, "frame_number": 40088, "display_filter": "frame.number == 40088", "timestamp_epoch": "1533965768.474387000" }, { "udp_stream": 320, "frame_number": 40089, "display_filter": "frame.number == 40089", "timestamp_epoch": "1533965768.474612000" } ], "is_private": null, "observable_id": "observable-0e349b07febe00d49d4a389e", "last_seen_epoch": "1533965768.474612000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964512.093157000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "wpc.en.rt.com", "evidence": [ { "udp_stream": 28, "frame_number": 542, "display_filter": "frame.number == 542", "timestamp_epoch": "1533964544.690929000" }, { "udp_stream": 27, "frame_number": 543, "display_filter": "frame.number == 543", "timestamp_epoch": "1533964544.690931000" } ], "is_private": null, "observable_id": "observable-902669b7995b7b6254b98b4e", "last_seen_epoch": "1533964544.690931000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964544.690929000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "www-google-analytics.l.google.com", "evidence": [ { "udp_stream": 48, "frame_number": 3327, "display_filter": "frame.number == 3327", "timestamp_epoch": "1533964552.700183000" }, { "udp_stream": 351, "frame_number": 44230, "display_filter": "frame.number == 44230", "timestamp_epoch": "1533965784.477104000" } ], "is_private": null, "observable_id": "observable-d08d631236a6321e263fa479", "last_seen_epoch": "1533965784.477104000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964552.700183000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "www-googletagmanager.l.google.com", "evidence": [ { "udp_stream": 339, "frame_number": 43662, "display_filter": "frame.number == 43662", "timestamp_epoch": "1533965783.090968000" } ], "is_private": null, "observable_id": "observable-4dde73c118afffbca84325d9", "last_seen_epoch": "1533965783.090968000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965783.090968000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "www.bing.com", "evidence": [ { "udp_stream": 37, "frame_number": 2031, "display_filter": "frame.number == 2031", "timestamp_epoch": "1533964548.338549000" }, { "udp_stream": 38, "frame_number": 2033, "display_filter": "frame.number == 2033", "timestamp_epoch": "1533964548.338744000" }, { "udp_stream": 39, "frame_number": 2034, "display_filter": "frame.number == 2034", "timestamp_epoch": "1533964548.339435000" }, { "udp_stream": 40, "frame_number": 2035, "display_filter": "frame.number == 2035", "timestamp_epoch": "1533964548.339533000" }, { "udp_stream": 38, "frame_number": 2263, "display_filter": "frame.number == 2263", "timestamp_epoch": "1533964549.230108000" }, { "udp_stream": 39, "frame_number": 2265, "display_filter": "frame.number == 2265", "timestamp_epoch": "1533964549.230112000" }, { "udp_stream": 40, "frame_number": 2266, "display_filter": "frame.number == 2266", "timestamp_epoch": "1533964549.230247000" }, { "udp_stream": 37, "frame_number": 2268, "display_filter": "frame.number == 2268", "timestamp_epoch": "1533964549.230297000" }, { "udp_stream": 332, "frame_number": 41224, "display_filter": "frame.number == 41224", "timestamp_epoch": "1533965772.518384000" }, { "udp_stream": 333, "frame_number": 41225, "display_filter": "frame.number == 41225", "timestamp_epoch": "1533965772.518739000" }, { "udp_stream": 334, "frame_number": 41226, "display_filter": "frame.number == 41226", "timestamp_epoch": "1533965772.519191000" }, { "udp_stream": 335, "frame_number": 41227, "display_filter": "frame.number == 41227", "timestamp_epoch": "1533965772.519388000" }, { "udp_stream": 332, "frame_number": 41445, "display_filter": "frame.number == 41445", "timestamp_epoch": "1533965773.531006000" }, { "udp_stream": 333, "frame_number": 41446, "display_filter": "frame.number == 41446", "timestamp_epoch": "1533965773.531031000" }, { "udp_stream": 334, "frame_number": 41447, "display_filter": "frame.number == 41447", "timestamp_epoch": "1533965773.531293000" }, { "udp_stream": 335, "frame_number": 41448, "display_filter": "frame.number == 41448", "timestamp_epoch": "1533965773.531295000" }, { "udp_stream": 332, "frame_number": 41730, "display_filter": "frame.number == 41730", "timestamp_epoch": "1533965774.543297000" }, { "udp_stream": 334, "frame_number": 41731, "display_filter": "frame.number == 41731", "timestamp_epoch": "1533965774.543389000" }, { "udp_stream": 333, "frame_number": 41732, "display_filter": "frame.number == 41732", "timestamp_epoch": "1533965774.543470000" }, { "udp_stream": 335, "frame_number": 41733, "display_filter": "frame.number == 41733", "timestamp_epoch": "1533965774.543565000" } ], "is_private": null, "observable_id": "observable-fe054b0cdc25182dc089210f", "last_seen_epoch": "1533965778.973203000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964548.338549000" }, { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "www.download.windowsupdate.com", "evidence": [ { "udp_stream": 55, "frame_number": 4150, "display_filter": "frame.number == 4150", "timestamp_epoch": "1533964553.828629000" }, { "udp_stream": 56, "frame_number": 4172, "display_filter": "frame.number == 4172", "timestamp_epoch": "1533964553.832380000" }, { "udp_stream": 56, "frame_number": 4256, "display_filter": "frame.number == 4256", "timestamp_epoch": "1533964554.071566000" }, { "udp_stream": 55, "frame_number": 4257, "display_filter": "frame.number == 4257", "timestamp_epoch": "1533964554.071727000" }, { "udp_stream": 271, "frame_number": 27969, "display_filter": "frame.number == 27969", "timestamp_epoch": "1533965036.476052000" }, { "udp_stream": 272, "frame_number": 27970, "display_filter": "frame.number == 27970", "timestamp_epoch": "1533965036.476055000" }, { "udp_stream": 272, "frame_number": 27994, "display_filter": "frame.number == 27994", "timestamp_epoch": "1533965036.569466000" }, { "udp_stream": 271, "frame_number": 27995, "display_filter": "frame.number == 27995", "timestamp_epoch": "1533965036.569468000" }, { "udp_stream": 308, "frame_number": 39481, "display_filter": "frame.number == 39481", "timestamp_epoch": "1533965400.871842000" }, { "udp_stream": 308, "frame_number": 39482, "display_filter": "frame.number == 39482", "timestamp_epoch": "1533965401.063902000" }, { "tcp_stream": 104, "frame_number": 4331, "display_filter": "frame.number == 4331", "timestamp_epoch": "1533964554.234128000" }, { "tcp_stream": 103, "frame_number": 4350, "display_filter": "frame.number == 4350", "timestamp_epoch": "1533964554.236277000" }, { "tcp_stream": 773, "frame_number": 28015, "display_filter": "frame.number == 28015", "timestamp_epoch": "1533965036.696949000" }, { "tcp_stream": 774, "frame_number": 28018, "display_filter": "frame.number == 28018", "timestamp_epoch": "1533965036.700513000" }, { "tcp_stream": 775, "frame_number": 28026, "display_filter": "frame.number == 28026", "timestamp_epoch": "1533965036.752397000" }, { "tcp_stream": 776, "frame_number": 28030, "display_filter": "frame.number == 28030", "timestamp_epoch": "1533965036.807677000" }, { "tcp_stream": 1034, "frame_number": 39486, "display_filter": "frame.number == 39486", "timestamp_epoch": "1533965401.164021000" }, { "tcp_stream": 1035, "frame_number": 39496, "display_filter": "frame.number == 39496", "timestamp_epoch": "1533965406.568628000" } ], "is_private": null, "observable_id": "observable-f665b34099b63776fd85eb2e", "last_seen_epoch": "1533965406.568628000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964553.828629000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "www.google-analytics.com", "evidence": [ { "udp_stream": 48, "frame_number": 3209, "display_filter": "frame.number == 3209", "timestamp_epoch": "1533964552.427007000" }, { "udp_stream": 48, "frame_number": 3327, "display_filter": "frame.number == 3327", "timestamp_epoch": "1533964552.700183000" }, { "udp_stream": 351, "frame_number": 44137, "display_filter": "frame.number == 44137", "timestamp_epoch": "1533965784.278556000" }, { "udp_stream": 351, "frame_number": 44230, "display_filter": "frame.number == 44230", "timestamp_epoch": "1533965784.477104000" }, { "tcp_stream": 89, "frame_number": 3448, "display_filter": "frame.number == 3448", "timestamp_epoch": "1533964552.872865000" }, { "tcp_stream": 88, "frame_number": 3452, "display_filter": "frame.number == 3452", "timestamp_epoch": "1533964552.874123000" }, { "tcp_stream": 214, "frame_number": 8417, "display_filter": "frame.number == 8417", "timestamp_epoch": "1533964898.250746000" }, { "tcp_stream": 215, "frame_number": 8425, "display_filter": "frame.number == 8425", "timestamp_epoch": "1533964898.266221000" }, { "tcp_stream": 1172, "frame_number": 44348, "display_filter": "frame.number == 44348", "timestamp_epoch": "1533965785.003892000" }, { "tcp_stream": 1171, "frame_number": 44368, "display_filter": "frame.number == 44368", "timestamp_epoch": "1533965785.010072000" }, { "tcp_stream": 1192, "frame_number": 45082, "display_filter": "frame.number == 45082", "timestamp_epoch": "1533965786.819879000" } ], "is_private": null, "observable_id": "observable-21da2dd0fd56b47ebecaf3d6", "last_seen_epoch": "1533965786.819879000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964552.427007000" }, { "type": "domain", "roles": [ "dns-query", "http-host", "tls-sni" ], "value": "www.google.com", "evidence": [ { "udp_stream": 58, "frame_number": 4677, "display_filter": "frame.number == 4677", "timestamp_epoch": "1533964555.194756000" }, { "udp_stream": 58, "frame_number": 4750, "display_filter": "frame.number == 4750", "timestamp_epoch": "1533964555.307152000" }, { "udp_stream": 360, "frame_number": 45622, "display_filter": "frame.number == 45622", "timestamp_epoch": "1533965788.343931000" }, { "udp_stream": 360, "frame_number": 45837, "display_filter": "frame.number == 45837", "timestamp_epoch": "1533965789.095261000" }, { "tcp_stream": 1208, "frame_number": 45898, "display_filter": "frame.number == 45898", "timestamp_epoch": "1533965789.194892000" }, { "tcp_stream": 109, "frame_number": 4775, "display_filter": "frame.number == 4775", "timestamp_epoch": "1533964555.360271000" }, { "tcp_stream": 110, "frame_number": 4777, "display_filter": "frame.number == 4777", "timestamp_epoch": "1533964555.360273000" }, { "tcp_stream": 236, "frame_number": 9024, "display_filter": "frame.number == 9024", "timestamp_epoch": "1533964898.996399000" }, { "tcp_stream": 237, "frame_number": 9027, "display_filter": "frame.number == 9027", "timestamp_epoch": "1533964898.996583000" }, { "tcp_stream": 1210, "frame_number": 45939, "display_filter": "frame.number == 45939", "timestamp_epoch": "1533965789.321805000" }, { "tcp_stream": 1217, "frame_number": 46105, "display_filter": "frame.number == 46105", "timestamp_epoch": "1533965789.758615000" }, { "tcp_stream": 1216, "frame_number": 46107, "display_filter": "frame.number == 46107", "timestamp_epoch": "1533965789.759079000" } ], "is_private": null, "observable_id": "observable-fa186fa730f7bbff48167855", "last_seen_epoch": "1533965789.759079000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964555.194756000" }, { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "www.googletagmanager.com", "evidence": [ { "udp_stream": 339, "frame_number": 43640, "display_filter": "frame.number == 43640", "timestamp_epoch": "1533965783.005376000" }, { "udp_stream": 339, "frame_number": 43662, "display_filter": "frame.number == 43662", "timestamp_epoch": "1533965783.090968000" }, { "tcp_stream": 1147, "frame_number": 43686, "display_filter": "frame.number == 43686", "timestamp_epoch": "1533965783.173455000" } ], "is_private": null, "observable_id": "observable-cd5a6ab6cd79e9a50658623b", "last_seen_epoch": "1533965783.173455000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965783.005376000" }, { "type": "domain", "roles": [ "dns-query", "http-host", "tls-sni" ], "value": "www.googletagservices.com", "evidence": [ { "udp_stream": 43, "frame_number": 3061, "display_filter": "frame.number == 3061", "timestamp_epoch": "1533964551.909128000" }, { "udp_stream": 43, "frame_number": 3185, "display_filter": "frame.number == 3185", "timestamp_epoch": "1533964552.354010000" }, { "udp_stream": 336, "frame_number": 43637, "display_filter": "frame.number == 43637", "timestamp_epoch": "1533965782.964876000" }, { "udp_stream": 336, "frame_number": 43648, "display_filter": "frame.number == 43648", "timestamp_epoch": "1533965783.044158000" }, { "tcp_stream": 1139, "frame_number": 43669, "display_filter": "frame.number == 43669", "timestamp_epoch": "1533965783.098093000" }, { "tcp_stream": 69, "frame_number": 3238, "display_filter": "frame.number == 3238", "timestamp_epoch": "1533964552.452910000" }, { "tcp_stream": 68, "frame_number": 3246, "display_filter": "frame.number == 3246", "timestamp_epoch": "1533964552.457436000" } ], "is_private": null, "observable_id": "observable-2f4cd8106dd545bea9c25565", "last_seen_epoch": "1533965783.098093000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964551.909128000" }, { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "www.msftncsi.com", "evidence": [ { "udp_stream": 24, "frame_number": 380, "display_filter": "frame.number == 380", "timestamp_epoch": "1533964519.258567000" }, { "udp_stream": 24, "frame_number": 381, "display_filter": "frame.number == 381", "timestamp_epoch": "1533964519.500541000" }, { "tcp_stream": 26, "frame_number": 385, "display_filter": "frame.number == 385", "timestamp_epoch": "1533964519.556735000" } ], "is_private": null, "observable_id": "observable-cc152019295b5193b24fda22", "last_seen_epoch": "1533964519.556735000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964519.258567000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "www.rt.com", "evidence": [ { "udp_stream": 27, "frame_number": 539, "display_filter": "frame.number == 539", "timestamp_epoch": "1533964544.230776000" }, { "udp_stream": 28, "frame_number": 541, "display_filter": "frame.number == 541", "timestamp_epoch": "1533964544.571554000" }, { "udp_stream": 28, "frame_number": 542, "display_filter": "frame.number == 542", "timestamp_epoch": "1533964544.690929000" }, { "udp_stream": 27, "frame_number": 543, "display_filter": "frame.number == 543", "timestamp_epoch": "1533964544.690931000" }, { "tcp_stream": 37, "frame_number": 550, "display_filter": "frame.number == 550", "timestamp_epoch": "1533964544.926326000" }, { "tcp_stream": 38, "frame_number": 552, "display_filter": "frame.number == 552", "timestamp_epoch": "1533964544.926457000" }, { "tcp_stream": 42, "frame_number": 636, "display_filter": "frame.number == 636", "timestamp_epoch": "1533964545.733784000" }, { "tcp_stream": 39, "frame_number": 638, "display_filter": "frame.number == 638", "timestamp_epoch": "1533964545.733803000" }, { "tcp_stream": 41, "frame_number": 642, "display_filter": "frame.number == 642", "timestamp_epoch": "1533964545.736658000" }, { "tcp_stream": 40, "frame_number": 646, "display_filter": "frame.number == 646", "timestamp_epoch": "1533964545.736960000" }, { "tcp_stream": 77, "frame_number": 3376, "display_filter": "frame.number == 3376", "timestamp_epoch": "1533964552.740894000" }, { "tcp_stream": 70, "frame_number": 3378, "display_filter": "frame.number == 3378", "timestamp_epoch": "1533964552.741152000" }, { "tcp_stream": 78, "frame_number": 3380, "display_filter": "frame.number == 3380", "timestamp_epoch": "1533964552.741239000" }, { "tcp_stream": 79, "frame_number": 3382, "display_filter": "frame.number == 3382", "timestamp_epoch": "1533964552.741451000" }, { "tcp_stream": 76, "frame_number": 3384, "display_filter": "frame.number == 3384", "timestamp_epoch": "1533964552.741554000" }, { "tcp_stream": 94, "frame_number": 3768, "display_filter": "frame.number == 3768", "timestamp_epoch": "1533964553.364593000" }, { "tcp_stream": 95, "frame_number": 3770, "display_filter": "frame.number == 3770", "timestamp_epoch": "1533964553.365363000" }, { "tcp_stream": 186, "frame_number": 7410, "display_filter": "frame.number == 7410", "timestamp_epoch": "1533964896.704230000" }, { "tcp_stream": 187, "frame_number": 7414, "display_filter": "frame.number == 7414", "timestamp_epoch": "1533964896.704820000" } ], "is_private": null, "observable_id": "observable-ef286096e361e1968a9523d1", "last_seen_epoch": "1533964896.704820000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964544.230776000" }, { "type": "domain", "roles": [ "dns-query", "http-host", "tls-sni" ], "value": "www.tns-counter.ru", "evidence": [ { "udp_stream": 50, "frame_number": 3211, "display_filter": "frame.number == 3211", "timestamp_epoch": "1533964552.429958000" }, { "udp_stream": 50, "frame_number": 3303, "display_filter": "frame.number == 3303", "timestamp_epoch": "1533964552.639522000" }, { "udp_stream": 341, "frame_number": 43642, "display_filter": "frame.number == 43642", "timestamp_epoch": "1533965783.028088000" }, { "udp_stream": 341, "frame_number": 43643, "display_filter": "frame.number == 43643", "timestamp_epoch": "1533965783.028284000" }, { "tcp_stream": 1137, "frame_number": 43727, "display_filter": "frame.number == 43727", "timestamp_epoch": "1533965783.254353000" }, { "tcp_stream": 1137, "frame_number": 43933, "display_filter": "frame.number == 43933", "timestamp_epoch": "1533965783.795213000" }, { "tcp_stream": 85, "frame_number": 3557, "display_filter": "frame.number == 3557", "timestamp_epoch": "1533964552.967444000" }, { "tcp_stream": 84, "frame_number": 3563, "display_filter": "frame.number == 3563", "timestamp_epoch": "1533964552.967938000" }, { "tcp_stream": 211, "frame_number": 8454, "display_filter": "frame.number == 8454", "timestamp_epoch": "1533964898.311765000" }, { "tcp_stream": 210, "frame_number": 8477, "display_filter": "frame.number == 8477", "timestamp_epoch": "1533964898.327920000" } ], "is_private": null, "observable_id": "observable-1d3c4b53bc5f07778c954ff5", "last_seen_epoch": "1533965783.795213000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964552.429958000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "www.youtube.com", "evidence": [ { "udp_stream": 46, "frame_number": 3147, "display_filter": "frame.number == 3147", "timestamp_epoch": "1533964552.244810000" }, { "udp_stream": 46, "frame_number": 3212, "display_filter": "frame.number == 3212", "timestamp_epoch": "1533964552.430269000" }, { "udp_stream": 350, "frame_number": 44128, "display_filter": "frame.number == 44128", "timestamp_epoch": "1533965784.248113000" }, { "udp_stream": 350, "frame_number": 44229, "display_filter": "frame.number == 44229", "timestamp_epoch": "1533965784.476926000" }, { "tcp_stream": 81, "frame_number": 3318, "display_filter": "frame.number == 3318", "timestamp_epoch": "1533964552.685613000" }, { "tcp_stream": 80, "frame_number": 3321, "display_filter": "frame.number == 3321", "timestamp_epoch": "1533964552.686031000" }, { "tcp_stream": 98, "frame_number": 3953, "display_filter": "frame.number == 3953", "timestamp_epoch": "1533964553.582136000" }, { "tcp_stream": 96, "frame_number": 3955, "display_filter": "frame.number == 3955", "timestamp_epoch": "1533964553.582237000" }, { "tcp_stream": 97, "frame_number": 3969, "display_filter": "frame.number == 3969", "timestamp_epoch": "1533964553.584391000" }, { "tcp_stream": 203, "frame_number": 8129, "display_filter": "frame.number == 8129", "timestamp_epoch": "1533964897.943050000" }, { "tcp_stream": 202, "frame_number": 8131, "display_filter": "frame.number == 8131", "timestamp_epoch": "1533964897.943323000" }, { "tcp_stream": 229, "frame_number": 8743, "display_filter": "frame.number == 8743", "timestamp_epoch": "1533964898.710388000" }, { "tcp_stream": 228, "frame_number": 8745, "display_filter": "frame.number == 8745", "timestamp_epoch": "1533964898.710484000" }, { "tcp_stream": 1174, "frame_number": 44356, "display_filter": "frame.number == 44356", "timestamp_epoch": "1533965785.009008000" }, { "tcp_stream": 1173, "frame_number": 44366, "display_filter": "frame.number == 44366", "timestamp_epoch": "1533965785.009849000" } ], "is_private": null, "observable_id": "observable-e586ef68a407a60bb6b18881", "last_seen_epoch": "1533965785.009849000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964552.244810000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "x.bidswitch.net", "evidence": [ { "udp_stream": 99, "frame_number": 8911, "display_filter": "frame.number == 8911", "timestamp_epoch": "1533964898.854136000" }, { "udp_stream": 99, "frame_number": 8979, "display_filter": "frame.number == 8979", "timestamp_epoch": "1533964898.946941000" }, { "tcp_stream": 243, "frame_number": 9061, "display_filter": "frame.number == 9061", "timestamp_epoch": "1533964899.026077000" }, { "tcp_stream": 242, "frame_number": 9063, "display_filter": "frame.number == 9063", "timestamp_epoch": "1533964899.026517000" }, { "tcp_stream": 610, "frame_number": 22977, "display_filter": "frame.number == 22977", "timestamp_epoch": "1533964996.316193000" }, { "tcp_stream": 611, "frame_number": 22980, "display_filter": "frame.number == 22980", "timestamp_epoch": "1533964996.316528000" } ], "is_private": null, "observable_id": "observable-6afafd5a71fc08769c1add69", "last_seen_epoch": "1533964996.316528000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964898.854136000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "x.dlx.addthis.com", "evidence": [ { "udp_stream": 270, "frame_number": 27879, "display_filter": "frame.number == 27879", "timestamp_epoch": "1533965036.166310000" }, { "udp_stream": 270, "frame_number": 27927, "display_filter": "frame.number == 27927", "timestamp_epoch": "1533965036.249006000" }, { "tcp_stream": 770, "frame_number": 27948, "display_filter": "frame.number == 27948", "timestamp_epoch": "1533965036.402477000" }, { "tcp_stream": 771, "frame_number": 27949, "display_filter": "frame.number == 27949", "timestamp_epoch": "1533965036.402479000" } ], "is_private": null, "observable_id": "observable-fe12c54b83f87a28d66ee186", "last_seen_epoch": "1533965036.402479000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965036.166310000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "x.skimresources.com", "evidence": [ { "udp_stream": 217, "frame_number": 20181, "display_filter": "frame.number == 20181", "timestamp_epoch": "1533964964.890983000" }, { "udp_stream": 217, "frame_number": 20227, "display_filter": "frame.number == 20227", "timestamp_epoch": "1533964965.012520000" }, { "tcp_stream": 586, "frame_number": 20285, "display_filter": "frame.number == 20285", "timestamp_epoch": "1533964965.248555000" }, { "tcp_stream": 587, "frame_number": 20301, "display_filter": "frame.number == 20301", "timestamp_epoch": "1533964965.249899000" } ], "is_private": null, "observable_id": "observable-2479630fb1e6308fe76cc1d5", "last_seen_epoch": "1533964965.249899000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964964.890983000" }, { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "x.ss2.us", "evidence": [ { "udp_stream": 83, "frame_number": 6226, "display_filter": "frame.number == 6226", "timestamp_epoch": "1533964560.094890000" }, { "udp_stream": 84, "frame_number": 6227, "display_filter": "frame.number == 6227", "timestamp_epoch": "1533964560.102934000" }, { "udp_stream": 84, "frame_number": 6238, "display_filter": "frame.number == 6238", "timestamp_epoch": "1533964560.172654000" }, { "udp_stream": 83, "frame_number": 6239, "display_filter": "frame.number == 6239", "timestamp_epoch": "1533964560.172942000" }, { "tcp_stream": 158, "frame_number": 6267, "display_filter": "frame.number == 6267", "timestamp_epoch": "1533964560.250312000" }, { "tcp_stream": 159, "frame_number": 6271, "display_filter": "frame.number == 6271", "timestamp_epoch": "1533964560.267322000" } ], "is_private": null, "observable_id": "observable-e40df2c21da5dbfba56c517c", "last_seen_epoch": "1533964560.267322000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964560.094890000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "xs2-1096111735.us-east-1.elb.amazonaws.com", "evidence": [ { "udp_stream": 234, "frame_number": 23623, "display_filter": "frame.number == 23623", "timestamp_epoch": "1533964997.803829000" } ], "is_private": null, "observable_id": "observable-557c32bce40750d250148c04", "last_seen_epoch": "1533964997.803829000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964997.803829000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "yastatic.net", "evidence": [ { "udp_stream": 32, "frame_number": 596, "display_filter": "frame.number == 596", "timestamp_epoch": "1533964545.576638000" }, { "udp_stream": 32, "frame_number": 608, "display_filter": "frame.number == 608", "timestamp_epoch": "1533964545.638096000" }, { "tcp_stream": 46, "frame_number": 741, "display_filter": "frame.number == 741", "timestamp_epoch": "1533964545.878035000" }, { "tcp_stream": 45, "frame_number": 770, "display_filter": "frame.number == 770", "timestamp_epoch": "1533964545.905290000" }, { "tcp_stream": 295, "frame_number": 11792, "display_filter": "frame.number == 11792", "timestamp_epoch": "1533964901.575300000" }, { "tcp_stream": 294, "frame_number": 11803, "display_filter": "frame.number == 11803", "timestamp_epoch": "1533964901.578555000" } ], "is_private": null, "observable_id": "observable-293b6374167717db2b89f887", "last_seen_epoch": "1533964901.578555000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964545.576638000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "youtube-ui.l.google.com", "evidence": [ { "udp_stream": 46, "frame_number": 3212, "display_filter": "frame.number == 3212", "timestamp_epoch": "1533964552.430269000" }, { "udp_stream": 350, "frame_number": 44229, "display_filter": "frame.number == 44229", "timestamp_epoch": "1533965784.476926000" } ], "is_private": null, "observable_id": "observable-c17dcfbfdc90d0382eeb4107", "last_seen_epoch": "1533965784.476926000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964552.430269000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "ytimg-edge-static.l.google.com", "evidence": [ { "udp_stream": 71, "frame_number": 5698, "display_filter": "frame.number == 5698", "timestamp_epoch": "1533964558.771373000" } ], "is_private": null, "observable_id": "observable-1e8ebb97374ef7799279b3b3", "last_seen_epoch": "1533964558.771373000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964558.771373000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "ytstatic.l.google.com", "evidence": [ { "udp_stream": 356, "frame_number": 45110, "display_filter": "frame.number == 45110", "timestamp_epoch": "1533965786.890742000" } ], "is_private": null, "observable_id": "observable-1cd721c3cc1a93bb66d2aac8", "last_seen_epoch": "1533965786.890742000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965786.890742000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "z.moatads.com", "evidence": [ { "udp_stream": 125, "frame_number": 11727, "display_filter": "frame.number == 11727", "timestamp_epoch": "1533964901.537832000" }, { "udp_stream": 125, "frame_number": 11930, "display_filter": "frame.number == 11930", "timestamp_epoch": "1533964901.698652000" }, { "tcp_stream": 311, "frame_number": 11959, "display_filter": "frame.number == 11959", "timestamp_epoch": "1533964901.767859000" }, { "tcp_stream": 308, "frame_number": 11964, "display_filter": "frame.number == 11964", "timestamp_epoch": "1533964901.769138000" } ], "is_private": null, "observable_id": "observable-b51f981b7d92a561278c829f", "last_seen_epoch": "1533964901.769138000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964901.537832000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "zedo-d.openx.net", "evidence": [ { "udp_stream": 139, "frame_number": 13252, "display_filter": "frame.number == 13252", "timestamp_epoch": "1533964903.183367000" }, { "udp_stream": 139, "frame_number": 13383, "display_filter": "frame.number == 13383", "timestamp_epoch": "1533964903.261260000" }, { "tcp_stream": 342, "frame_number": 13425, "display_filter": "frame.number == 13425", "timestamp_epoch": "1533964903.335589000" }, { "tcp_stream": 341, "frame_number": 13427, "display_filter": "frame.number == 13427", "timestamp_epoch": "1533964903.335838000" } ], "is_private": null, "observable_id": "observable-2c430604a46045bf6acb687f", "last_seen_epoch": "1533964903.335838000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964903.183367000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "ztag-trackedevents-enterprise-1441845540.us-west-2.elb.amazonaws.com", "evidence": [ { "udp_stream": 162, "frame_number": 15556, "display_filter": "frame.number == 15556", "timestamp_epoch": "1533964906.746311000" } ], "is_private": null, "observable_id": "observable-73540aa58b5062e149836c34", "last_seen_epoch": "1533964906.746311000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964906.746311000" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "0.0.0.0", "evidence": [], "is_private": true, "observable_id": "observable-ed4ca891511ae13c1a4a7c2d", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "103.5.149.72", "evidence": [ { "udp_stream": 126, "frame_number": 40087, "display_filter": "frame.number == 40087", "timestamp_epoch": "1533965768.408215000" } ], "is_private": false, "observable_id": "observable-96aaa7bbf0447255e4ecb7b9", "last_seen_epoch": "1533965768.408215000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965768.408215000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "103.5.149.77", "evidence": [ { "udp_stream": 193, "frame_number": 44698, "display_filter": "frame.number == 44698", "timestamp_epoch": "1533965786.043507000" } ], "is_private": false, "observable_id": "observable-0caaf79606fdc5dc37e9590a", "last_seen_epoch": "1533965786.043507000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965786.043507000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "104.110.128.239", "evidence": [ { "udp_stream": 127, "frame_number": 11957, "display_filter": "frame.number == 11957", "timestamp_epoch": "1533964901.767352000" }, { "udp_stream": 241, "frame_number": 24044, "display_filter": "frame.number == 24044", "timestamp_epoch": "1533964999.506406000" } ], "is_private": false, "observable_id": "observable-a037596f43edfed333ec38c1", "last_seen_epoch": "1533964999.506406000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964901.767352000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "104.16.237.184", "evidence": [ { "udp_stream": 237, "frame_number": 23970, "display_filter": "frame.number == 23970", "timestamp_epoch": "1533964998.468790000" }, { "udp_stream": 236, "frame_number": 23971, "display_filter": "frame.number == 23971", "timestamp_epoch": "1533964998.468958000" } ], "is_private": false, "observable_id": "observable-cd7fb7958f0e2779d483933e", "last_seen_epoch": "1533964998.468958000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964998.468790000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "104.16.238.184", "evidence": [ { "udp_stream": 237, "frame_number": 23970, "display_filter": "frame.number == 23970", "timestamp_epoch": "1533964998.468790000" }, { "udp_stream": 236, "frame_number": 23971, "display_filter": "frame.number == 23971", "timestamp_epoch": "1533964998.468958000" } ], "is_private": false, "observable_id": "observable-c3a141b03c0fcb563c6c467a", "last_seen_epoch": "1533964998.468958000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964998.468790000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "104.16.239.184", "evidence": [ { "udp_stream": 237, "frame_number": 23970, "display_filter": "frame.number == 23970", "timestamp_epoch": "1533964998.468790000" }, { "udp_stream": 236, "frame_number": 23971, "display_filter": "frame.number == 23971", "timestamp_epoch": "1533964998.468958000" } ], "is_private": false, "observable_id": "observable-e1b5c61e54e446b76b2969aa", "last_seen_epoch": "1533964998.468958000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964998.468790000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "104.16.240.184", "evidence": [ { "udp_stream": 237, "frame_number": 23970, "display_filter": "frame.number == 23970", "timestamp_epoch": "1533964998.468790000" }, { "udp_stream": 236, "frame_number": 23971, "display_filter": "frame.number == 23971", "timestamp_epoch": "1533964998.468958000" } ], "is_private": false, "observable_id": "observable-a621802d9ba001552cbe2482", "last_seen_epoch": "1533964998.468958000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964998.468790000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "104.16.241.184", "evidence": [ { "udp_stream": 237, "frame_number": 23970, "display_filter": "frame.number == 23970", "timestamp_epoch": "1533964998.468790000" }, { "udp_stream": 236, "frame_number": 23971, "display_filter": "frame.number == 23971", "timestamp_epoch": "1533964998.468958000" } ], "is_private": false, "observable_id": "observable-2b813e1a7b061bac8bb4b909", "last_seen_epoch": "1533964998.468958000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964998.468790000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "104.16.89.188", "evidence": [ { "udp_stream": 121, "frame_number": 11428, "display_filter": "frame.number == 11428", "timestamp_epoch": "1533964901.270602000" }, { "udp_stream": 120, "frame_number": 11429, "display_filter": "frame.number == 11429", "timestamp_epoch": "1533964901.270707000" } ], "is_private": false, "observable_id": "observable-c4d3518f17c5c3341402dd18", "last_seen_epoch": "1533964901.270707000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964901.270602000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "104.16.90.188", "evidence": [ { "udp_stream": 121, "frame_number": 11428, "display_filter": "frame.number == 11428", "timestamp_epoch": "1533964901.270602000" }, { "udp_stream": 120, "frame_number": 11429, "display_filter": "frame.number == 11429", "timestamp_epoch": "1533964901.270707000" } ], "is_private": false, "observable_id": "observable-608b18b4b08109dee427e4cd", "last_seen_epoch": "1533964901.270707000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964901.270602000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "104.16.91.188", "evidence": [ { "udp_stream": 121, "frame_number": 11428, "display_filter": "frame.number == 11428", "timestamp_epoch": "1533964901.270602000" }, { "udp_stream": 120, "frame_number": 11429, "display_filter": "frame.number == 11429", "timestamp_epoch": "1533964901.270707000" } ], "is_private": false, "observable_id": "observable-6c31200e36e32c63d73f368a", "last_seen_epoch": "1533964901.270707000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964901.270602000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "104.16.92.188", "evidence": [ { "udp_stream": 121, "frame_number": 11428, "display_filter": "frame.number == 11428", "timestamp_epoch": "1533964901.270602000" }, { "udp_stream": 120, "frame_number": 11429, "display_filter": "frame.number == 11429", "timestamp_epoch": "1533964901.270707000" } ], "is_private": false, "observable_id": "observable-27512987e138866f89753fc2", "last_seen_epoch": "1533964901.270707000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964901.270602000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "104.16.93.188", "evidence": [ { "udp_stream": 121, "frame_number": 11428, "display_filter": "frame.number == 11428", "timestamp_epoch": "1533964901.270602000" }, { "udp_stream": 120, "frame_number": 11429, "display_filter": "frame.number == 11429", "timestamp_epoch": "1533964901.270707000" } ], "is_private": false, "observable_id": "observable-554b0daccc73aac4b2eb9c48", "last_seen_epoch": "1533964901.270707000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964901.270602000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "104.193.83.156", "evidence": [ { "udp_stream": 169, "frame_number": 16028, "display_filter": "frame.number == 16028", "timestamp_epoch": "1533964908.406114000" } ], "is_private": false, "observable_id": "observable-65da8391848ccf80f3fd04af", "last_seen_epoch": "1533964908.406114000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964908.406114000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "104.193.83.157", "evidence": [ { "udp_stream": 169, "frame_number": 16028, "display_filter": "frame.number == 16028", "timestamp_epoch": "1533964908.406114000" } ], "is_private": false, "observable_id": "observable-dfb30ca3154714bcb20705ee", "last_seen_epoch": "1533964908.406114000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964908.406114000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "104.198.109.132", "evidence": [ { "udp_stream": 99, "frame_number": 8979, "display_filter": "frame.number == 8979", "timestamp_epoch": "1533964898.946941000" } ], "is_private": false, "observable_id": "observable-e0b81521f345d3e8b13ce9d6", "last_seen_epoch": "1533964898.946941000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964898.946941000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "104.20.20.239", "evidence": [ { "udp_stream": 42, "frame_number": 3180, "display_filter": "frame.number == 3180", "timestamp_epoch": "1533964552.350754000" }, { "udp_stream": 74, "frame_number": 5863, "display_filter": "frame.number == 5863", "timestamp_epoch": "1533964559.449101000" } ], "is_private": false, "observable_id": "observable-388f98a86dd3cc25b6f08680", "last_seen_epoch": "1533964559.449101000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964552.350754000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "104.20.21.239", "evidence": [ { "udp_stream": 42, "frame_number": 3180, "display_filter": "frame.number == 3180", "timestamp_epoch": "1533964552.350754000" }, { "udp_stream": 74, "frame_number": 5863, "display_filter": "frame.number == 5863", "timestamp_epoch": "1533964559.449101000" } ], "is_private": false, "observable_id": "observable-ffa75f86e2186028de6256e9", "last_seen_epoch": "1533964559.449101000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964552.350754000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "104.24.246.16", "evidence": [ { "udp_stream": 245, "frame_number": 26408, "display_filter": "frame.number == 26408", "timestamp_epoch": "1533965032.676936000" } ], "is_private": false, "observable_id": "observable-c84183c56554dea3c309dbcf", "last_seen_epoch": "1533965032.676936000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965032.676936000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "104.24.247.16", "evidence": [ { "udp_stream": 245, "frame_number": 26408, "display_filter": "frame.number == 26408", "timestamp_epoch": "1533965032.676936000" } ], "is_private": false, "observable_id": "observable-f787bf9dd4359cf0ad667c2a", "last_seen_epoch": "1533965032.676936000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965032.676936000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "104.25.162.34", "evidence": [ { "udp_stream": 51, "frame_number": 3335, "display_filter": "frame.number == 3335", "timestamp_epoch": "1533964552.717075000" }, { "udp_stream": 93, "frame_number": 8506, "display_filter": "frame.number == 8506", "timestamp_epoch": "1533964898.378728000" } ], "is_private": false, "observable_id": "observable-256203749f16488b6341059c", "last_seen_epoch": "1533964898.378728000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964552.717075000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "104.25.163.34", "evidence": [ { "udp_stream": 51, "frame_number": 3335, "display_filter": "frame.number == 3335", "timestamp_epoch": "1533964552.717075000" }, { "udp_stream": 93, "frame_number": 8506, "display_filter": "frame.number == 8506", "timestamp_epoch": "1533964898.378728000" } ], "is_private": false, "observable_id": "observable-13b0d87c753b9debdb9e96e9", "last_seen_epoch": "1533964898.378728000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964552.717075000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "104.254.150.108", "evidence": [ { "udp_stream": 210, "frame_number": 19910, "display_filter": "frame.number == 19910", "timestamp_epoch": "1533964963.540458000" } ], "is_private": false, "observable_id": "observable-91673b98b50d053008c8ea1b", "last_seen_epoch": "1533964963.540458000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964963.540458000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "104.254.150.11", "evidence": [ { "udp_stream": 100, "frame_number": 8956, "display_filter": "frame.number == 8956", "timestamp_epoch": "1533964898.930148000" }, { "udp_stream": 184, "frame_number": 18186, "display_filter": "frame.number == 18186", "timestamp_epoch": "1533964958.450245000" }, { "udp_stream": 202, "frame_number": 19300, "display_filter": "frame.number == 19300", "timestamp_epoch": "1533964961.756585000" } ], "is_private": false, "observable_id": "observable-3c2b81e758c3d9a44ede8a37", "last_seen_epoch": "1533964961.756585000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964898.930148000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "104.254.150.13", "evidence": [ { "udp_stream": 100, "frame_number": 8956, "display_filter": "frame.number == 8956", "timestamp_epoch": "1533964898.930148000" }, { "udp_stream": 184, "frame_number": 18186, "display_filter": "frame.number == 18186", "timestamp_epoch": "1533964958.450245000" } ], "is_private": false, "observable_id": "observable-ac3886b441ecaed4560e9ab6", "last_seen_epoch": "1533964958.450245000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964898.930148000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "104.254.150.179", "evidence": [ { "udp_stream": 210, "frame_number": 19910, "display_filter": "frame.number == 19910", "timestamp_epoch": "1533964963.540458000" } ], "is_private": false, "observable_id": "observable-0248c44d6d3cc5ba99b1cea1", "last_seen_epoch": "1533964963.540458000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964963.540458000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "104.254.150.37", "evidence": [ { "udp_stream": 100, "frame_number": 8956, "display_filter": "frame.number == 8956", "timestamp_epoch": "1533964898.930148000" }, { "udp_stream": 184, "frame_number": 18186, "display_filter": "frame.number == 18186", "timestamp_epoch": "1533964958.450245000" }, { "udp_stream": 202, "frame_number": 19300, "display_filter": "frame.number == 19300", "timestamp_epoch": "1533964961.756585000" } ], "is_private": false, "observable_id": "observable-c2e4771f6243938295742a51", "last_seen_epoch": "1533964961.756585000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964898.930148000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "104.254.150.4", "evidence": [ { "udp_stream": 202, "frame_number": 19300, "display_filter": "frame.number == 19300", "timestamp_epoch": "1533964961.756585000" } ], "is_private": false, "observable_id": "observable-01dcc88640decf68314d2800", "last_seen_epoch": "1533964961.756585000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964961.756585000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "104.254.150.58", "evidence": [ { "udp_stream": 100, "frame_number": 8956, "display_filter": "frame.number == 8956", "timestamp_epoch": "1533964898.930148000" }, { "udp_stream": 184, "frame_number": 18186, "display_filter": "frame.number == 18186", "timestamp_epoch": "1533964958.450245000" }, { "udp_stream": 202, "frame_number": 19300, "display_filter": "frame.number == 19300", "timestamp_epoch": "1533964961.756585000" } ], "is_private": false, "observable_id": "observable-eee5e8216fba99b59a939884", "last_seen_epoch": "1533964961.756585000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964898.930148000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "104.254.150.59", "evidence": [ { "udp_stream": 100, "frame_number": 8956, "display_filter": "frame.number == 8956", "timestamp_epoch": "1533964898.930148000" }, { "udp_stream": 184, "frame_number": 18186, "display_filter": "frame.number == 18186", "timestamp_epoch": "1533964958.450245000" } ], "is_private": false, "observable_id": "observable-871189e0c432cc7b8f79aa02", "last_seen_epoch": "1533964958.450245000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964898.930148000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "104.254.150.69", "evidence": [ { "udp_stream": 100, "frame_number": 8956, "display_filter": "frame.number == 8956", "timestamp_epoch": "1533964898.930148000" }, { "udp_stream": 184, "frame_number": 18186, "display_filter": "frame.number == 18186", "timestamp_epoch": "1533964958.450245000" }, { "udp_stream": 202, "frame_number": 19300, "display_filter": "frame.number == 19300", "timestamp_epoch": "1533964961.756585000" } ], "is_private": false, "observable_id": "observable-19d1bd043b1eaa1798c9ca6c", "last_seen_epoch": "1533964961.756585000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964898.930148000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "104.254.150.70", "evidence": [ { "udp_stream": 202, "frame_number": 19300, "display_filter": "frame.number == 19300", "timestamp_epoch": "1533964961.756585000" } ], "is_private": false, "observable_id": "observable-73289d24150c8460c7926585", "last_seen_epoch": "1533964961.756585000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964961.756585000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "104.254.150.77", "evidence": [ { "udp_stream": 100, "frame_number": 8956, "display_filter": "frame.number == 8956", "timestamp_epoch": "1533964898.930148000" }, { "udp_stream": 184, "frame_number": 18186, "display_filter": "frame.number == 18186", "timestamp_epoch": "1533964958.450245000" }, { "udp_stream": 202, "frame_number": 19300, "display_filter": "frame.number == 19300", "timestamp_epoch": "1533964961.756585000" } ], "is_private": false, "observable_id": "observable-7795e4a894ba0c383de44beb", "last_seen_epoch": "1533964961.756585000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964898.930148000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "104.254.150.9", "evidence": [ { "udp_stream": 100, "frame_number": 8956, "display_filter": "frame.number == 8956", "timestamp_epoch": "1533964898.930148000" }, { "udp_stream": 184, "frame_number": 18186, "display_filter": "frame.number == 18186", "timestamp_epoch": "1533964958.450245000" }, { "udp_stream": 202, "frame_number": 19300, "display_filter": "frame.number == 19300", "timestamp_epoch": "1533964961.756585000" } ], "is_private": false, "observable_id": "observable-d7123cbae498a33d05a83609", "last_seen_epoch": "1533964961.756585000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964898.930148000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "104.36.113.17", "evidence": [ { "udp_stream": 128, "frame_number": 11978, "display_filter": "frame.number == 11978", "timestamp_epoch": "1533964901.783846000" }, { "udp_stream": 170, "frame_number": 16092, "display_filter": "frame.number == 16092", "timestamp_epoch": "1533964908.469322000" } ], "is_private": false, "observable_id": "observable-95641815635b924ec8a0258e", "last_seen_epoch": "1533964908.469322000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964901.783846000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "104.36.113.23", "evidence": [ { "udp_stream": 165, "frame_number": 15930, "display_filter": "frame.number == 15930", "timestamp_epoch": "1533964908.051426000" } ], "is_private": false, "observable_id": "observable-8eeacae169fe041a0233c110", "last_seen_epoch": "1533964908.051426000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964908.051426000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "104.36.113.24", "evidence": [ { "udp_stream": 171, "frame_number": 16389, "display_filter": "frame.number == 16389", "timestamp_epoch": "1533964908.885044000" }, { "udp_stream": 176, "frame_number": 16722, "display_filter": "frame.number == 16722", "timestamp_epoch": "1533964910.397514000" } ], "is_private": false, "observable_id": "observable-b57aa0cc1043b689e65ea7da", "last_seen_epoch": "1533964910.397514000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964908.885044000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "107.178.242.85", "evidence": [ { "udp_stream": 286, "frame_number": 31668, "display_filter": "frame.number == 31668", "timestamp_epoch": "1533965100.795644000" } ], "is_private": false, "observable_id": "observable-a66e65aac432fb8f9c5ba1e8", "last_seen_epoch": "1533965100.795644000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965100.795644000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "107.178.254.65", "evidence": [ { "udp_stream": 218, "frame_number": 20323, "display_filter": "frame.number == 20323", "timestamp_epoch": "1533964965.297460000" } ], "is_private": false, "observable_id": "observable-9c8f7bce39f5215993f65879", "last_seen_epoch": "1533964965.297460000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964965.297460000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "107.21.48.136", "evidence": [ { "udp_stream": 240, "frame_number": 24040, "display_filter": "frame.number == 24040", "timestamp_epoch": "1533964999.467395000" } ], "is_private": false, "observable_id": "observable-dd9497a4395dbb2881d7503a", "last_seen_epoch": "1533964999.467395000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964999.467395000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "107.23.160.218", "evidence": [ { "udp_stream": 112, "frame_number": 10606, "display_filter": "frame.number == 10606", "timestamp_epoch": "1533964900.584234000" } ], "is_private": false, "observable_id": "observable-17a7745e38a13c08315a0acc", "last_seen_epoch": "1533964900.584234000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964900.584234000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "107.23.83.163", "evidence": [ { "udp_stream": 190, "frame_number": 18568, "display_filter": "frame.number == 18568", "timestamp_epoch": "1533964959.365164000" } ], "is_private": false, "observable_id": "observable-755706316ba19459ee092e0f", "last_seen_epoch": "1533964959.365164000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964959.365164000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "108.177.12.120", "evidence": [ { "udp_stream": 151, "frame_number": 14626, "display_filter": "frame.number == 14626", "timestamp_epoch": "1533964904.641770000" } ], "is_private": false, "observable_id": "observable-7aba3a755465363099c2b3ae", "last_seen_epoch": "1533964904.641770000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964904.641770000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "108.177.12.94", "evidence": [ { "udp_stream": 151, "frame_number": 14626, "display_filter": "frame.number == 14626", "timestamp_epoch": "1533964904.641770000" } ], "is_private": false, "observable_id": "observable-f870cbc074aa5f6b73ac1873", "last_seen_epoch": "1533964904.641770000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964904.641770000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "108.59.0.12", "evidence": [ { "udp_stream": 113, "frame_number": 10616, "display_filter": "frame.number == 10616", "timestamp_epoch": "1533964900.621029000" } ], "is_private": false, "observable_id": "observable-9b9c1c7243f75246db674120", "last_seen_epoch": "1533964900.621029000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964900.621029000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "108.59.0.8", "evidence": [ { "udp_stream": 113, "frame_number": 10616, "display_filter": "frame.number == 10616", "timestamp_epoch": "1533964900.621029000" } ], "is_private": false, "observable_id": "observable-8a365e15ed870724ef72faca", "last_seen_epoch": "1533964900.621029000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964900.621029000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "108.59.4.171", "evidence": [ { "udp_stream": 113, "frame_number": 10616, "display_filter": "frame.number == 10616", "timestamp_epoch": "1533964900.621029000" } ], "is_private": false, "observable_id": "observable-55319fc89eaa18fb407aa9f9", "last_seen_epoch": "1533964900.621029000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964900.621029000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "108.59.4.172", "evidence": [ { "udp_stream": 113, "frame_number": 10616, "display_filter": "frame.number == 10616", "timestamp_epoch": "1533964900.621029000" } ], "is_private": false, "observable_id": "observable-0caa487a95688442a4a0ee9f", "last_seen_epoch": "1533964900.621029000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964900.621029000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "108.59.4.173", "evidence": [ { "udp_stream": 113, "frame_number": 10616, "display_filter": "frame.number == 10616", "timestamp_epoch": "1533964900.621029000" } ], "is_private": false, "observable_id": "observable-db87856edd3a46b67d15deb4", "last_seen_epoch": "1533964900.621029000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964900.621029000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "109.201.156.81", "evidence": [ { "udp_stream": 329, "frame_number": 40243, "display_filter": "frame.number == 40243", "timestamp_epoch": "1533965770.575466000" } ], "is_private": false, "observable_id": "observable-148f89512a04fa71fb41b300", "last_seen_epoch": "1533965770.575466000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965770.575466000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "109.232.197.110", "evidence": [ { "udp_stream": 200, "frame_number": 19258, "display_filter": "frame.number == 19258", "timestamp_epoch": "1533964961.633523000" } ], "is_private": false, "observable_id": "observable-0903e43d0eecf956699fabc0", "last_seen_epoch": "1533964961.633523000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964961.633523000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "109.232.197.33", "evidence": [ { "udp_stream": 200, "frame_number": 19258, "display_filter": "frame.number == 19258", "timestamp_epoch": "1533964961.633523000" } ], "is_private": false, "observable_id": "observable-a8e8d717d2f3c00897d001b7", "last_seen_epoch": "1533964961.633523000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964961.633523000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "13.107.21.200", "evidence": [ { "udp_stream": 38, "frame_number": 2263, "display_filter": "frame.number == 2263", "timestamp_epoch": "1533964549.230108000" }, { "udp_stream": 39, "frame_number": 2265, "display_filter": "frame.number == 2265", "timestamp_epoch": "1533964549.230112000" }, { "udp_stream": 40, "frame_number": 2266, "display_filter": "frame.number == 2266", "timestamp_epoch": "1533964549.230247000" }, { "udp_stream": 37, "frame_number": 2268, "display_filter": "frame.number == 2268", "timestamp_epoch": "1533964549.230297000" }, { "udp_stream": 206, "frame_number": 19673, "display_filter": "frame.number == 19673", "timestamp_epoch": "1533964962.856769000" }, { "udp_stream": 333, "frame_number": 43410, "display_filter": "frame.number == 43410", "timestamp_epoch": "1533965778.972314000" }, { "udp_stream": 334, "frame_number": 43411, "display_filter": "frame.number == 43411", "timestamp_epoch": "1533965778.972428000" }, { "udp_stream": 335, "frame_number": 43412, "display_filter": "frame.number == 43412", "timestamp_epoch": "1533965778.972581000" }, { "udp_stream": 333, "frame_number": 43413, "display_filter": "frame.number == 43413", "timestamp_epoch": "1533965778.972688000" }, { "udp_stream": 334, "frame_number": 43415, "display_filter": "frame.number == 43415", "timestamp_epoch": "1533965778.972803000" }, { "udp_stream": 335, "frame_number": 43417, "display_filter": "frame.number == 43417", "timestamp_epoch": "1533965778.972805000" }, { "udp_stream": 334, "frame_number": 43418, "display_filter": "frame.number == 43418", "timestamp_epoch": "1533965778.972933000" }, { "udp_stream": 333, "frame_number": 43419, "display_filter": "frame.number == 43419", "timestamp_epoch": "1533965778.972999000" }, { "udp_stream": 335, "frame_number": 43420, "display_filter": "frame.number == 43420", "timestamp_epoch": "1533965778.973091000" }, { "udp_stream": 332, "frame_number": 43421, "display_filter": "frame.number == 43421", "timestamp_epoch": "1533965778.973203000" } ], "is_private": false, "observable_id": "observable-431a8bebcf09aff10e381b32", "last_seen_epoch": "1533965778.973203000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964549.230108000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "13.107.4.50", "evidence": [ { "udp_stream": 272, "frame_number": 27994, "display_filter": "frame.number == 27994", "timestamp_epoch": "1533965036.569466000" }, { "udp_stream": 271, "frame_number": 27995, "display_filter": "frame.number == 27995", "timestamp_epoch": "1533965036.569468000" } ], "is_private": false, "observable_id": "observable-88a32548d4051118930887f8", "last_seen_epoch": "1533965036.569468000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965036.569466000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "13.107.5.80", "evidence": [ { "udp_stream": 35, "frame_number": 2030, "display_filter": "frame.number == 2030", "timestamp_epoch": "1533964548.338547000" }, { "udp_stream": 36, "frame_number": 2032, "display_filter": "frame.number == 2032", "timestamp_epoch": "1533964548.338743000" }, { "udp_stream": 331, "frame_number": 41615, "display_filter": "frame.number == 41615", "timestamp_epoch": "1533965774.364547000" }, { "udp_stream": 331, "frame_number": 41618, "display_filter": "frame.number == 41618", "timestamp_epoch": "1533965774.364689000" }, { "udp_stream": 330, "frame_number": 41619, "display_filter": "frame.number == 41619", "timestamp_epoch": "1533965774.364956000" } ], "is_private": false, "observable_id": "observable-735eb278fd02dee8709733eb", "last_seen_epoch": "1533965774.364956000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964548.338547000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "13.33.106.254", "evidence": [ { "udp_stream": 72, "frame_number": 5857, "display_filter": "frame.number == 5857", "timestamp_epoch": "1533964559.422782000" } ], "is_private": false, "observable_id": "observable-4b451257b265f47991f3fa71", "last_seen_epoch": "1533964559.422782000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964559.422782000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "13.33.107.131", "evidence": [ { "udp_stream": 111, "frame_number": 10617, "display_filter": "frame.number == 10617", "timestamp_epoch": "1533964900.621189000" } ], "is_private": false, "observable_id": "observable-76fa16bfab85d8dbe112d4d5", "last_seen_epoch": "1533964900.621189000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964900.621189000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "13.33.107.160", "evidence": [ { "udp_stream": 111, "frame_number": 10617, "display_filter": "frame.number == 10617", "timestamp_epoch": "1533964900.621189000" } ], "is_private": false, "observable_id": "observable-83270b02459a1d5755cf1a29", "last_seen_epoch": "1533964900.621189000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964900.621189000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "13.33.107.209", "evidence": [ { "udp_stream": 111, "frame_number": 10617, "display_filter": "frame.number == 10617", "timestamp_epoch": "1533964900.621189000" } ], "is_private": false, "observable_id": "observable-4fd8792c563fce9ab9d5eeb9", "last_seen_epoch": "1533964900.621189000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964900.621189000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "13.33.107.212", "evidence": [ { "udp_stream": 111, "frame_number": 10617, "display_filter": "frame.number == 10617", "timestamp_epoch": "1533964900.621189000" } ], "is_private": false, "observable_id": "observable-3c6faa35dad298b10a50bf8b", "last_seen_epoch": "1533964900.621189000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964900.621189000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "13.33.78.101", "evidence": [ { "udp_stream": 213, "frame_number": 20107, "display_filter": "frame.number == 20107", "timestamp_epoch": "1533964964.633293000" } ], "is_private": false, "observable_id": "observable-ae7470064df29eb6ce78ca84", "last_seen_epoch": "1533964964.633293000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964964.633293000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "13.33.78.144", "evidence": [ { "udp_stream": 213, "frame_number": 20107, "display_filter": "frame.number == 20107", "timestamp_epoch": "1533964964.633293000" } ], "is_private": false, "observable_id": "observable-a03eaa020c90236a3f038427", "last_seen_epoch": "1533964964.633293000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964964.633293000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "13.33.78.186", "evidence": [ { "udp_stream": 84, "frame_number": 6238, "display_filter": "frame.number == 6238", "timestamp_epoch": "1533964560.172654000" }, { "udp_stream": 83, "frame_number": 6239, "display_filter": "frame.number == 6239", "timestamp_epoch": "1533964560.172942000" } ], "is_private": false, "observable_id": "observable-2b3451f1322400ec96dc5360", "last_seen_epoch": "1533964560.172942000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964560.172654000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "13.33.78.214", "evidence": [ { "udp_stream": 84, "frame_number": 6238, "display_filter": "frame.number == 6238", "timestamp_epoch": "1533964560.172654000" }, { "udp_stream": 83, "frame_number": 6239, "display_filter": "frame.number == 6239", "timestamp_epoch": "1533964560.172942000" } ], "is_private": false, "observable_id": "observable-8b23663457051139c7d6a663", "last_seen_epoch": "1533964560.172942000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964560.172654000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "13.33.78.217", "evidence": [ { "udp_stream": 213, "frame_number": 20107, "display_filter": "frame.number == 20107", "timestamp_epoch": "1533964964.633293000" } ], "is_private": false, "observable_id": "observable-37ca79d2bfddd8afd9bb1827", "last_seen_epoch": "1533964964.633293000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964964.633293000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "13.33.78.38", "evidence": [ { "udp_stream": 213, "frame_number": 20107, "display_filter": "frame.number == 20107", "timestamp_epoch": "1533964964.633293000" } ], "is_private": false, "observable_id": "observable-13241b6c11e46674b6720b68", "last_seen_epoch": "1533964964.633293000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964964.633293000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "13.33.78.48", "evidence": [ { "udp_stream": 84, "frame_number": 6238, "display_filter": "frame.number == 6238", "timestamp_epoch": "1533964560.172654000" }, { "udp_stream": 83, "frame_number": 6239, "display_filter": "frame.number == 6239", "timestamp_epoch": "1533964560.172942000" } ], "is_private": false, "observable_id": "observable-23ab7029992ae0d03a601347", "last_seen_epoch": "1533964560.172942000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964560.172654000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "13.33.78.61", "evidence": [ { "udp_stream": 84, "frame_number": 6238, "display_filter": "frame.number == 6238", "timestamp_epoch": "1533964560.172654000" }, { "udp_stream": 83, "frame_number": 6239, "display_filter": "frame.number == 6239", "timestamp_epoch": "1533964560.172942000" } ], "is_private": false, "observable_id": "observable-26dbc1df975d91621a50d29d", "last_seen_epoch": "1533964560.172942000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964560.172654000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "13.56.1.77", "evidence": [ { "udp_stream": 102, "frame_number": 8976, "display_filter": "frame.number == 8976", "timestamp_epoch": "1533964898.938935000" } ], "is_private": false, "observable_id": "observable-42d788bcbb6f84a6a2032dbb", "last_seen_epoch": "1533964898.938935000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964898.938935000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "13.57.103.80", "evidence": [ { "udp_stream": 212, "frame_number": 20071, "display_filter": "frame.number == 20071", "timestamp_epoch": "1533964964.450971000" }, { "udp_stream": 242, "frame_number": 24228, "display_filter": "frame.number == 24228", "timestamp_epoch": "1533965001.681775000" } ], "is_private": false, "observable_id": "observable-644dddf741e2acd314da7516", "last_seen_epoch": "1533965001.681775000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964964.450971000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "13.57.162.22", "evidence": [ { "udp_stream": 277, "frame_number": 30810, "display_filter": "frame.number == 30810", "timestamp_epoch": "1533965099.289135000" } ], "is_private": false, "observable_id": "observable-3de91ba3161cbcfad2aaa019", "last_seen_epoch": "1533965099.289135000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965099.289135000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "13.57.70.199", "evidence": [ { "udp_stream": 141, "frame_number": 13494, "display_filter": "frame.number == 13494", "timestamp_epoch": "1533964903.481649000" } ], "is_private": false, "observable_id": "observable-b516ddc5c64a715511015154", "last_seen_epoch": "1533964903.481649000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964903.481649000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "13.57.96.247", "evidence": [ { "udp_stream": 217, "frame_number": 20227, "display_filter": "frame.number == 20227", "timestamp_epoch": "1533964965.012520000" } ], "is_private": false, "observable_id": "observable-fd9b2668bea4b45a64bc40e5", "last_seen_epoch": "1533964965.012520000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964965.012520000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "13.59.169.161", "evidence": [ { "udp_stream": 293, "frame_number": 32841, "display_filter": "frame.number == 32841", "timestamp_epoch": "1533965136.087192000" } ], "is_private": false, "observable_id": "observable-63402ffdc034d4492cadf4b7", "last_seen_epoch": "1533965136.087192000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965136.087192000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "13.59.61.143", "evidence": [ { "udp_stream": 293, "frame_number": 32841, "display_filter": "frame.number == 32841", "timestamp_epoch": "1533965136.087192000" } ], "is_private": false, "observable_id": "observable-9c1d4ab7b5d0af4014ea2cff", "last_seen_epoch": "1533965136.087192000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965136.087192000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "136.243.151.13", "evidence": [ { "udp_stream": 358, "frame_number": 45340, "display_filter": "frame.number == 45340", "timestamp_epoch": "1533965787.454378000" } ], "is_private": false, "observable_id": "observable-abde429364714712b36bd160", "last_seen_epoch": "1533965787.454378000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965787.454378000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "136.243.249.79", "evidence": [ { "udp_stream": 29, "frame_number": 605, "display_filter": "frame.number == 605", "timestamp_epoch": "1533964545.630742000" } ], "is_private": false, "observable_id": "observable-6ffaeef16043e82dc50f30bc", "last_seen_epoch": "1533964545.630742000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964545.630742000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "136.243.25.70", "evidence": [ { "udp_stream": 29, "frame_number": 605, "display_filter": "frame.number == 605", "timestamp_epoch": "1533964545.630742000" } ], "is_private": false, "observable_id": "observable-a1f67a43b4d0328ad2b42709", "last_seen_epoch": "1533964545.630742000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964545.630742000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "136.243.42.207", "evidence": [ { "udp_stream": 105, "frame_number": 9340, "display_filter": "frame.number == 9340", "timestamp_epoch": "1533964899.269568000" } ], "is_private": false, "observable_id": "observable-80e17f5b10edc8328dac0b52", "last_seen_epoch": "1533964899.269568000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964899.269568000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "136.243.42.249", "evidence": [ { "udp_stream": 105, "frame_number": 9340, "display_filter": "frame.number == 9340", "timestamp_epoch": "1533964899.269568000" } ], "is_private": false, "observable_id": "observable-8e5668d096ab487d142678da", "last_seen_epoch": "1533964899.269568000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964899.269568000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "136.243.7.47", "evidence": [ { "udp_stream": 122, "frame_number": 11789, "display_filter": "frame.number == 11789", "timestamp_epoch": "1533964901.574246000" } ], "is_private": false, "observable_id": "observable-dc3c5c7ac4fdfb2fb957d8b3", "last_seen_epoch": "1533964901.574246000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964901.574246000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "136.243.73.56", "evidence": [ { "udp_stream": 122, "frame_number": 11789, "display_filter": "frame.number == 11789", "timestamp_epoch": "1533964901.574246000" } ], "is_private": false, "observable_id": "observable-7ebad788b7c844f8f6c76ac6", "last_seen_epoch": "1533964901.574246000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964901.574246000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "136.243.95.174", "evidence": [ { "udp_stream": 29, "frame_number": 605, "display_filter": "frame.number == 605", "timestamp_epoch": "1533964545.630742000" } ], "is_private": false, "observable_id": "observable-f2ad0cbce89c596f79a2dec3", "last_seen_epoch": "1533964545.630742000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964545.630742000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "136.243.95.176", "evidence": [ { "udp_stream": 29, "frame_number": 605, "display_filter": "frame.number == 605", "timestamp_epoch": "1533964545.630742000" } ], "is_private": false, "observable_id": "observable-12305c763292151e238f63d2", "last_seen_epoch": "1533964545.630742000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964545.630742000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "142.93.53.73", "evidence": [ { "udp_stream": 349, "frame_number": 44215, "display_filter": "frame.number == 44215", "timestamp_epoch": "1533965784.462482000" } ], "is_private": false, "observable_id": "observable-9f82c8a5628c978b10d706c3", "last_seen_epoch": "1533965784.462482000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965784.462482000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "142.93.61.36", "evidence": [ { "udp_stream": 349, "frame_number": 44215, "display_filter": "frame.number == 44215", "timestamp_epoch": "1533965784.462482000" } ], "is_private": false, "observable_id": "observable-a60a74d688c33633ce5510db", "last_seen_epoch": "1533965784.462482000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965784.462482000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "142.93.61.37", "evidence": [ { "udp_stream": 349, "frame_number": 44215, "display_filter": "frame.number == 44215", "timestamp_epoch": "1533965784.462482000" } ], "is_private": false, "observable_id": "observable-2109a3bd4b88c075601377db", "last_seen_epoch": "1533965784.462482000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965784.462482000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "142.93.61.39", "evidence": [ { "udp_stream": 349, "frame_number": 44215, "display_filter": "frame.number == 44215", "timestamp_epoch": "1533965784.462482000" } ], "is_private": false, "observable_id": "observable-296063da5c21ef8de9d47d75", "last_seen_epoch": "1533965784.462482000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965784.462482000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "142.93.61.40", "evidence": [ { "udp_stream": 349, "frame_number": 44215, "display_filter": "frame.number == 44215", "timestamp_epoch": "1533965784.462482000" } ], "is_private": false, "observable_id": "observable-6eae8c16399ea5a5a709625a", "last_seen_epoch": "1533965784.462482000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965784.462482000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "144.76.121.172", "evidence": [ { "udp_stream": 29, "frame_number": 605, "display_filter": "frame.number == 605", "timestamp_epoch": "1533964545.630742000" } ], "is_private": false, "observable_id": "observable-cb1349d7a7401aab36f627e1", "last_seen_epoch": "1533964545.630742000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964545.630742000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "146.20.132.242", "evidence": [ { "udp_stream": 163, "frame_number": 15635, "display_filter": "frame.number == 15635", "timestamp_epoch": "1533964906.967863000" } ], "is_private": false, "observable_id": "observable-ff309a071771487afd419035", "last_seen_epoch": "1533964906.967863000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964906.967863000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "146.20.132.243", "evidence": [ { "udp_stream": 163, "frame_number": 15635, "display_filter": "frame.number == 15635", "timestamp_epoch": "1533964906.967863000" } ], "is_private": false, "observable_id": "observable-02bb05cec52c8fae7a4c8e93", "last_seen_epoch": "1533964906.967863000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964906.967863000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "146.20.132.244", "evidence": [ { "udp_stream": 163, "frame_number": 15635, "display_filter": "frame.number == 15635", "timestamp_epoch": "1533964906.967863000" } ], "is_private": false, "observable_id": "observable-d11a67f9eff3c4baaa91b6a7", "last_seen_epoch": "1533964906.967863000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964906.967863000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "146.20.132.245", "evidence": [ { "udp_stream": 163, "frame_number": 15635, "display_filter": "frame.number == 15635", "timestamp_epoch": "1533964906.967863000" } ], "is_private": false, "observable_id": "observable-b40e834ae969526d2af052f8", "last_seen_epoch": "1533964906.967863000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964906.967863000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "146.20.132.246", "evidence": [ { "udp_stream": 163, "frame_number": 15635, "display_filter": "frame.number == 15635", "timestamp_epoch": "1533964906.967863000" } ], "is_private": false, "observable_id": "observable-5664d3168b5f9573e03d8f5e", "last_seen_epoch": "1533964906.967863000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964906.967863000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "146.20.132.247", "evidence": [ { "udp_stream": 163, "frame_number": 15635, "display_filter": "frame.number == 15635", "timestamp_epoch": "1533964906.967863000" } ], "is_private": false, "observable_id": "observable-9cdd144aea08b9dba1619870", "last_seen_epoch": "1533964906.967863000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964906.967863000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "146.20.132.248", "evidence": [ { "udp_stream": 163, "frame_number": 15635, "display_filter": "frame.number == 15635", "timestamp_epoch": "1533964906.967863000" } ], "is_private": false, "observable_id": "observable-2353443b9c9551ab74189021", "last_seen_epoch": "1533964906.967863000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964906.967863000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "146.20.132.249", "evidence": [ { "udp_stream": 163, "frame_number": 15635, "display_filter": "frame.number == 15635", "timestamp_epoch": "1533964906.967863000" } ], "is_private": false, "observable_id": "observable-f31b6750936ec669d024dc2f", "last_seen_epoch": "1533964906.967863000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964906.967863000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "146.20.132.250", "evidence": [ { "udp_stream": 163, "frame_number": 15635, "display_filter": "frame.number == 15635", "timestamp_epoch": "1533964906.967863000" } ], "is_private": false, "observable_id": "observable-fabf0280ad790aa8f601c254", "last_seen_epoch": "1533964906.967863000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964906.967863000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "146.20.132.251", "evidence": [ { "udp_stream": 163, "frame_number": 15635, "display_filter": "frame.number == 15635", "timestamp_epoch": "1533964906.967863000" } ], "is_private": false, "observable_id": "observable-0848c5e065383867bff165f9", "last_seen_epoch": "1533964906.967863000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964906.967863000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "146.20.132.252", "evidence": [ { "udp_stream": 163, "frame_number": 15635, "display_filter": "frame.number == 15635", "timestamp_epoch": "1533964906.967863000" } ], "is_private": false, "observable_id": "observable-20d4838af0c15cee654cf37c", "last_seen_epoch": "1533964906.967863000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964906.967863000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "146.20.132.253", "evidence": [ { "udp_stream": 163, "frame_number": 15635, "display_filter": "frame.number == 15635", "timestamp_epoch": "1533964906.967863000" } ], "is_private": false, "observable_id": "observable-f4c798f6049033b02aa30116", "last_seen_epoch": "1533964906.967863000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964906.967863000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "146.20.132.254", "evidence": [ { "udp_stream": 163, "frame_number": 15635, "display_filter": "frame.number == 15635", "timestamp_epoch": "1533964906.967863000" } ], "is_private": false, "observable_id": "observable-8622f3ab505499dbcdcf852a", "last_seen_epoch": "1533964906.967863000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964906.967863000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "146.20.132.255", "evidence": [ { "udp_stream": 163, "frame_number": 15635, "display_filter": "frame.number == 15635", "timestamp_epoch": "1533964906.967863000" } ], "is_private": false, "observable_id": "observable-00b6d4e7c05c1c61acff0ccb", "last_seen_epoch": "1533964906.967863000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964906.967863000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "146.20.133.0", "evidence": [ { "udp_stream": 163, "frame_number": 15635, "display_filter": "frame.number == 15635", "timestamp_epoch": "1533964906.967863000" } ], "is_private": false, "observable_id": "observable-457f199b9960be382116fa5c", "last_seen_epoch": "1533964906.967863000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964906.967863000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "146.20.133.1", "evidence": [ { "udp_stream": 163, "frame_number": 15635, "display_filter": "frame.number == 15635", "timestamp_epoch": "1533964906.967863000" } ], "is_private": false, "observable_id": "observable-64d0593319b0815ffb920d1d", "last_seen_epoch": "1533964906.967863000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964906.967863000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "146.20.133.82", "evidence": [ { "udp_stream": 157, "frame_number": 14679, "display_filter": "frame.number == 14679", "timestamp_epoch": "1533964904.689217000" } ], "is_private": false, "observable_id": "observable-2d671221cedcc06cf1854b9e", "last_seen_epoch": "1533964904.689217000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964904.689217000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "146.20.133.83", "evidence": [ { "udp_stream": 157, "frame_number": 14679, "display_filter": "frame.number == 14679", "timestamp_epoch": "1533964904.689217000" } ], "is_private": false, "observable_id": "observable-e98cef13093f61c9f06d83e0", "last_seen_epoch": "1533964904.689217000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964904.689217000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "146.20.133.84", "evidence": [ { "udp_stream": 157, "frame_number": 14679, "display_filter": "frame.number == 14679", "timestamp_epoch": "1533964904.689217000" } ], "is_private": false, "observable_id": "observable-e69c9e01fa603839d0758dce", "last_seen_epoch": "1533964904.689217000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964904.689217000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "146.20.133.85", "evidence": [ { "udp_stream": 157, "frame_number": 14679, "display_filter": "frame.number == 14679", "timestamp_epoch": "1533964904.689217000" } ], "is_private": false, "observable_id": "observable-5f2e1c3b94ecd73a76177993", "last_seen_epoch": "1533964904.689217000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964904.689217000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "146.20.133.86", "evidence": [ { "udp_stream": 157, "frame_number": 14679, "display_filter": "frame.number == 14679", "timestamp_epoch": "1533964904.689217000" } ], "is_private": false, "observable_id": "observable-1f80af41b748f405b72b8bd7", "last_seen_epoch": "1533964904.689217000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964904.689217000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "146.20.133.87", "evidence": [ { "udp_stream": 157, "frame_number": 14679, "display_filter": "frame.number == 14679", "timestamp_epoch": "1533964904.689217000" } ], "is_private": false, "observable_id": "observable-89a8810622fc743e24be48a8", "last_seen_epoch": "1533964904.689217000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964904.689217000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "146.20.133.88", "evidence": [ { "udp_stream": 157, "frame_number": 14679, "display_filter": "frame.number == 14679", "timestamp_epoch": "1533964904.689217000" } ], "is_private": false, "observable_id": "observable-5302bc645751f78b78ad1625", "last_seen_epoch": "1533964904.689217000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964904.689217000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "146.20.133.89", "evidence": [ { "udp_stream": 157, "frame_number": 14679, "display_filter": "frame.number == 14679", "timestamp_epoch": "1533964904.689217000" } ], "is_private": false, "observable_id": "observable-03f378060419dc26995e0868", "last_seen_epoch": "1533964904.689217000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964904.689217000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "146.20.133.90", "evidence": [ { "udp_stream": 157, "frame_number": 14679, "display_filter": "frame.number == 14679", "timestamp_epoch": "1533964904.689217000" } ], "is_private": false, "observable_id": "observable-c517e49f4fe1fb4d099e8e97", "last_seen_epoch": "1533964904.689217000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964904.689217000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "146.20.133.91", "evidence": [ { "udp_stream": 157, "frame_number": 14679, "display_filter": "frame.number == 14679", "timestamp_epoch": "1533964904.689217000" } ], "is_private": false, "observable_id": "observable-dd97acc872854791c2c0649f", "last_seen_epoch": "1533964904.689217000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964904.689217000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "146.20.133.92", "evidence": [ { "udp_stream": 157, "frame_number": 14679, "display_filter": "frame.number == 14679", "timestamp_epoch": "1533964904.689217000" } ], "is_private": false, "observable_id": "observable-66421ac70b7a362d6cae74af", "last_seen_epoch": "1533964904.689217000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964904.689217000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "146.20.133.93", "evidence": [ { "udp_stream": 157, "frame_number": 14679, "display_filter": "frame.number == 14679", "timestamp_epoch": "1533964904.689217000" } ], "is_private": false, "observable_id": "observable-c38df622f741be56dbc5a3f2", "last_seen_epoch": "1533964904.689217000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964904.689217000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "146.20.133.94", "evidence": [ { "udp_stream": 157, "frame_number": 14679, "display_filter": "frame.number == 14679", "timestamp_epoch": "1533964904.689217000" } ], "is_private": false, "observable_id": "observable-d3654d3c19e1ae6f4290a597", "last_seen_epoch": "1533964904.689217000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964904.689217000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "146.20.133.95", "evidence": [ { "udp_stream": 157, "frame_number": 14679, "display_filter": "frame.number == 14679", "timestamp_epoch": "1533964904.689217000" } ], "is_private": false, "observable_id": "observable-a9b08dde55157c62483df084", "last_seen_epoch": "1533964904.689217000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964904.689217000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "146.20.133.96", "evidence": [ { "udp_stream": 157, "frame_number": 14679, "display_filter": "frame.number == 14679", "timestamp_epoch": "1533964904.689217000" } ], "is_private": false, "observable_id": "observable-65dec8e525e1a02cc7c1c964", "last_seen_epoch": "1533964904.689217000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964904.689217000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "146.20.133.97", "evidence": [ { "udp_stream": 157, "frame_number": 14679, "display_filter": "frame.number == 14679", "timestamp_epoch": "1533964904.689217000" } ], "is_private": false, "observable_id": "observable-8c5325a6e0af4360a59dbb01", "last_seen_epoch": "1533964904.689217000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964904.689217000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "148.251.82.59", "evidence": [ { "udp_stream": 123, "frame_number": 11477, "display_filter": "frame.number == 11477", "timestamp_epoch": "1533964901.323587000" }, { "udp_stream": 124, "frame_number": 11530, "display_filter": "frame.number == 11530", "timestamp_epoch": "1533964901.340738000" } ], "is_private": false, "observable_id": "observable-061cd4bb3a6285e0e9e82218", "last_seen_epoch": "1533964901.340738000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964901.323587000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "149.129.222.112", "evidence": [ { "udp_stream": 89, "frame_number": 7259, "display_filter": "frame.number == 7259", "timestamp_epoch": "1533964850.053278000" } ], "is_private": false, "observable_id": "observable-1ac3d2569214ee0d3b919151", "last_seen_epoch": "1533964850.053278000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964850.053278000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "149.174.66.131", "evidence": [ { "udp_stream": 79, "frame_number": 5893, "display_filter": "frame.number == 5893", "timestamp_epoch": "1533964559.525559000" }, { "udp_stream": 229, "frame_number": 23322, "display_filter": "frame.number == 23322", "timestamp_epoch": "1533964997.328492000" } ], "is_private": false, "observable_id": "observable-fe33be4f5c690aca2164e9f5", "last_seen_epoch": "1533964997.328492000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964559.525559000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "151.101.0.166", "evidence": [ { "udp_stream": 246, "frame_number": 26420, "display_filter": "frame.number == 26420", "timestamp_epoch": "1533965032.696494000" } ], "is_private": false, "observable_id": "observable-d4e72a469971dba3b5a8d8f0", "last_seen_epoch": "1533965032.696494000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965032.696494000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "151.101.128.166", "evidence": [ { "udp_stream": 246, "frame_number": 26420, "display_filter": "frame.number == 26420", "timestamp_epoch": "1533965032.696494000" } ], "is_private": false, "observable_id": "observable-f42ef9630b8c9fbf0f12486e", "last_seen_epoch": "1533965032.696494000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965032.696494000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "151.101.130.2", "evidence": [ { "udp_stream": 138, "frame_number": 13349, "display_filter": "frame.number == 13349", "timestamp_epoch": "1533964903.242983000" }, { "udp_stream": 279, "frame_number": 31673, "display_filter": "frame.number == 31673", "timestamp_epoch": "1533965100.796418000" } ], "is_private": false, "observable_id": "observable-18beb671a52243b24c4627f1", "last_seen_epoch": "1533965100.796418000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964903.242983000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "151.101.130.49", "evidence": [ { "udp_stream": 63, "frame_number": 5155, "display_filter": "frame.number == 5155", "timestamp_epoch": "1533964556.031163000" }, { "udp_stream": 191, "frame_number": 18574, "display_filter": "frame.number == 18574", "timestamp_epoch": "1533964959.368247000" }, { "udp_stream": 287, "frame_number": 32144, "display_filter": "frame.number == 32144", "timestamp_epoch": "1533965101.694508000" } ], "is_private": false, "observable_id": "observable-353e182073fdab85b32b2411", "last_seen_epoch": "1533965101.694508000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964556.031163000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "151.101.192.166", "evidence": [ { "udp_stream": 246, "frame_number": 26420, "display_filter": "frame.number == 26420", "timestamp_epoch": "1533965032.696494000" } ], "is_private": false, "observable_id": "observable-c4153ecca717eabe9584063d", "last_seen_epoch": "1533965032.696494000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965032.696494000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "151.101.194.2", "evidence": [ { "udp_stream": 138, "frame_number": 13349, "display_filter": "frame.number == 13349", "timestamp_epoch": "1533964903.242983000" }, { "udp_stream": 279, "frame_number": 31673, "display_filter": "frame.number == 31673", "timestamp_epoch": "1533965100.796418000" } ], "is_private": false, "observable_id": "observable-cff9cd7aba62d733cfccfa98", "last_seen_epoch": "1533965100.796418000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964903.242983000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "151.101.194.49", "evidence": [ { "udp_stream": 63, "frame_number": 5155, "display_filter": "frame.number == 5155", "timestamp_epoch": "1533964556.031163000" }, { "udp_stream": 191, "frame_number": 18574, "display_filter": "frame.number == 18574", "timestamp_epoch": "1533964959.368247000" }, { "udp_stream": 287, "frame_number": 32144, "display_filter": "frame.number == 32144", "timestamp_epoch": "1533965101.694508000" } ], "is_private": false, "observable_id": "observable-0cf18939e9ce1dd8dbc93b38", "last_seen_epoch": "1533965101.694508000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964556.031163000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "151.101.2.2", "evidence": [ { "udp_stream": 138, "frame_number": 13349, "display_filter": "frame.number == 13349", "timestamp_epoch": "1533964903.242983000" }, { "udp_stream": 279, "frame_number": 31673, "display_filter": "frame.number == 31673", "timestamp_epoch": "1533965100.796418000" } ], "is_private": false, "observable_id": "observable-8fc6cab21b2d851315f7b759", "last_seen_epoch": "1533965100.796418000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964903.242983000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "151.101.2.49", "evidence": [ { "udp_stream": 63, "frame_number": 5155, "display_filter": "frame.number == 5155", "timestamp_epoch": "1533964556.031163000" }, { "udp_stream": 191, "frame_number": 18574, "display_filter": "frame.number == 18574", "timestamp_epoch": "1533964959.368247000" }, { "udp_stream": 287, "frame_number": 32144, "display_filter": "frame.number == 32144", "timestamp_epoch": "1533965101.694508000" } ], "is_private": false, "observable_id": "observable-e121f2e249a0fdabea83979e", "last_seen_epoch": "1533965101.694508000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964556.031163000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "151.101.41.108", "evidence": [ { "udp_stream": 226, "frame_number": 23216, "display_filter": "frame.number == 23216", "timestamp_epoch": "1533964997.081499000" } ], "is_private": false, "observable_id": "observable-7dfa23bf13eaf7d72d956b6b", "last_seen_epoch": "1533964997.081499000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964997.081499000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "151.101.53.108", "evidence": [ { "udp_stream": 201, "frame_number": 19305, "display_filter": "frame.number == 19305", "timestamp_epoch": "1533964961.766961000" } ], "is_private": false, "observable_id": "observable-4e33cc23e91fa3598afad5fc", "last_seen_epoch": "1533964961.766961000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964961.766961000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "151.101.64.166", "evidence": [ { "udp_stream": 246, "frame_number": 26420, "display_filter": "frame.number == 26420", "timestamp_epoch": "1533965032.696494000" } ], "is_private": false, "observable_id": "observable-645a83affdcd1c2c39d85de0", "last_seen_epoch": "1533965032.696494000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965032.696494000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "151.101.66.2", "evidence": [ { "udp_stream": 138, "frame_number": 13349, "display_filter": "frame.number == 13349", "timestamp_epoch": "1533964903.242983000" }, { "udp_stream": 279, "frame_number": 31673, "display_filter": "frame.number == 31673", "timestamp_epoch": "1533965100.796418000" } ], "is_private": false, "observable_id": "observable-3da98076a3313d04ffe99719", "last_seen_epoch": "1533965100.796418000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964903.242983000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "151.101.66.49", "evidence": [ { "udp_stream": 63, "frame_number": 5155, "display_filter": "frame.number == 5155", "timestamp_epoch": "1533964556.031163000" }, { "udp_stream": 191, "frame_number": 18574, "display_filter": "frame.number == 18574", "timestamp_epoch": "1533964959.368247000" }, { "udp_stream": 287, "frame_number": 32144, "display_filter": "frame.number == 32144", "timestamp_epoch": "1533965101.694508000" } ], "is_private": false, "observable_id": "observable-60cd80a4a8bf52b8d413a422", "last_seen_epoch": "1533965101.694508000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964556.031163000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "151.236.120.42", "evidence": [ { "udp_stream": 326, "frame_number": 40222, "display_filter": "frame.number == 40222", "timestamp_epoch": "1533965770.569135000" } ], "is_private": false, "observable_id": "observable-cee83611b8ba8112bcb9594f", "last_seen_epoch": "1533965770.569135000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965770.569135000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "151.236.85.22", "evidence": [ { "udp_stream": 324, "frame_number": 40193, "display_filter": "frame.number == 40193", "timestamp_epoch": "1533965770.483961000" } ], "is_private": false, "observable_id": "observable-8a2bea20390fba77b5cdd505", "last_seen_epoch": "1533965770.483961000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965770.483961000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "151.236.98.22", "evidence": [ { "udp_stream": 328, "frame_number": 40224, "display_filter": "frame.number == 40224", "timestamp_epoch": "1533965770.569362000" } ], "is_private": false, "observable_id": "observable-014964de481a3052c7d6f8dd", "last_seen_epoch": "1533965770.569362000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965770.569362000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "152.163.13.4", "evidence": [ { "udp_stream": 79, "frame_number": 5893, "display_filter": "frame.number == 5893", "timestamp_epoch": "1533964559.525559000" }, { "udp_stream": 229, "frame_number": 23322, "display_filter": "frame.number == 23322", "timestamp_epoch": "1533964997.328492000" } ], "is_private": false, "observable_id": "observable-85f2cf451cf75d70aecb7b6d", "last_seen_epoch": "1533964997.328492000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964559.525559000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "152.195.14.112", "evidence": [ { "udp_stream": 247, "frame_number": 26644, "display_filter": "frame.number == 26644", "timestamp_epoch": "1533965033.203044000" } ], "is_private": false, "observable_id": "observable-52622f99b3a8cce37923e030", "last_seen_epoch": "1533965033.203044000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965033.203044000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "156.154.136.36", "evidence": [ { "udp_stream": 180, "frame_number": 20228, "display_filter": "frame.number == 20228", "timestamp_epoch": "1533964965.012614000" } ], "is_private": false, "observable_id": "observable-242824b6d9de3abd39c175ef", "last_seen_epoch": "1533964965.012614000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964965.012614000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "156.154.202.36", "evidence": [ { "udp_stream": 180, "frame_number": 20228, "display_filter": "frame.number == 20228", "timestamp_epoch": "1533964965.012614000" } ], "is_private": false, "observable_id": "observable-587813915083f68c98e1be61", "last_seen_epoch": "1533964965.012614000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964965.012614000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "157.240.11.22", "evidence": [ { "udp_stream": 342, "frame_number": 43674, "display_filter": "frame.number == 43674", "timestamp_epoch": "1533965783.128458000" }, { "udp_stream": 348, "frame_number": 44214, "display_filter": "frame.number == 44214", "timestamp_epoch": "1533965784.461656000" } ], "is_private": false, "observable_id": "observable-971ef05dd2064ac6ead2c21f", "last_seen_epoch": "1533965784.461656000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965783.128458000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "161.170.239.188", "evidence": [ { "udp_stream": 208, "frame_number": 19705, "display_filter": "frame.number == 19705", "timestamp_epoch": "1533964962.898059000" } ], "is_private": false, "observable_id": "observable-942f9234717f0ecae59f93fd", "last_seen_epoch": "1533964962.898059000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964962.898059000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "162.210.196.115", "evidence": [ { "udp_stream": 113, "frame_number": 10616, "display_filter": "frame.number == 10616", "timestamp_epoch": "1533964900.621029000" } ], "is_private": false, "observable_id": "observable-496dc6de5831a74cedcb1d7a", "last_seen_epoch": "1533964900.621029000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964900.621029000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "162.210.196.116", "evidence": [ { "udp_stream": 113, "frame_number": 10616, "display_filter": "frame.number == 10616", "timestamp_epoch": "1533964900.621029000" } ], "is_private": false, "observable_id": "observable-79d16283f77fcd5321a26b96", "last_seen_epoch": "1533964900.621029000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964900.621029000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "162.210.197.137", "evidence": [ { "udp_stream": 113, "frame_number": 10616, "display_filter": "frame.number == 10616", "timestamp_epoch": "1533964900.621029000" } ], "is_private": false, "observable_id": "observable-b407691369d51e198c88d6af", "last_seen_epoch": "1533964900.621029000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964900.621029000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "162.210.199.69", "evidence": [ { "udp_stream": 113, "frame_number": 10616, "display_filter": "frame.number == 10616", "timestamp_epoch": "1533964900.621029000" } ], "is_private": false, "observable_id": "observable-a126e0e9cef74f9438e1d7d2", "last_seen_epoch": "1533964900.621029000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964900.621029000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "172.217.0.42", "evidence": [ { "udp_stream": 30, "frame_number": 611, "display_filter": "frame.number == 611", "timestamp_epoch": "1533964545.651017000" } ], "is_private": false, "observable_id": "observable-52faf923055257c8d1a5ef2a", "last_seen_epoch": "1533964545.651017000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964545.651017000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "172.217.0.46", "evidence": [ { "udp_stream": 46, "frame_number": 3212, "display_filter": "frame.number == 3212", "timestamp_epoch": "1533964552.430269000" }, { "udp_stream": 350, "frame_number": 44229, "display_filter": "frame.number == 44229", "timestamp_epoch": "1533965784.476926000" } ], "is_private": false, "observable_id": "observable-baa626635df45cb6c19234c8", "last_seen_epoch": "1533965784.476926000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964552.430269000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "172.217.0.54", "evidence": [ { "udp_stream": 71, "frame_number": 5698, "display_filter": "frame.number == 5698", "timestamp_epoch": "1533964558.771373000" } ], "is_private": false, "observable_id": "observable-9b1bea06491420ec65a3c29d", "last_seen_epoch": "1533964558.771373000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964558.771373000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "172.217.6.66", "evidence": [ { "udp_stream": 66, "frame_number": 5140, "display_filter": "frame.number == 5140", "timestamp_epoch": "1533964556.025417000" }, { "udp_stream": 362, "frame_number": 46032, "display_filter": "frame.number == 46032", "timestamp_epoch": "1533965789.555893000" } ], "is_private": false, "observable_id": "observable-0c9773acbe67157c814a5a61", "last_seen_epoch": "1533965789.555893000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964556.025417000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "172.217.6.74", "evidence": [ { "udp_stream": 30, "frame_number": 611, "display_filter": "frame.number == 611", "timestamp_epoch": "1533964545.651017000" } ], "is_private": false, "observable_id": "observable-a604d37204943840ec698d49", "last_seen_epoch": "1533964545.651017000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964545.651017000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "172.217.6.78", "evidence": [ { "udp_stream": 46, "frame_number": 3212, "display_filter": "frame.number == 3212", "timestamp_epoch": "1533964552.430269000" }, { "udp_stream": 350, "frame_number": 44229, "display_filter": "frame.number == 44229", "timestamp_epoch": "1533965784.476926000" } ], "is_private": false, "observable_id": "observable-1857171736f65c1c8722f450", "last_seen_epoch": "1533965784.476926000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964552.430269000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "173.0.153.44", "evidence": [ { "udp_stream": 91, "frame_number": 8116, "display_filter": "frame.number == 8116", "timestamp_epoch": "1533964897.941119000" }, { "udp_stream": 103, "frame_number": 9470, "display_filter": "frame.number == 9470", "timestamp_epoch": "1533964899.377567000" }, { "udp_stream": 104, "frame_number": 9471, "display_filter": "frame.number == 9471", "timestamp_epoch": "1533964899.377655000" }, { "udp_stream": 131, "frame_number": 12208, "display_filter": "frame.number == 12208", "timestamp_epoch": "1533964901.980409000" }, { "udp_stream": 130, "frame_number": 12212, "display_filter": "frame.number == 12212", "timestamp_epoch": "1533964901.981250000" }, { "udp_stream": 134, "frame_number": 12763, "display_filter": "frame.number == 12763", "timestamp_epoch": "1533964902.706045000" } ], "is_private": false, "observable_id": "observable-ebefae67f94a1451f2f50c30", "last_seen_epoch": "1533964902.706045000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964897.941119000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "173.239.42.221", "evidence": [ { "udp_stream": 283, "frame_number": 31670, "display_filter": "frame.number == 31670", "timestamp_epoch": "1533965100.795818000" } ], "is_private": false, "observable_id": "observable-61531f0db337bbd6f0f4748e", "last_seen_epoch": "1533965100.795818000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965100.795818000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "173.241.250.104", "evidence": [ { "udp_stream": 76, "frame_number": 5871, "display_filter": "frame.number == 5871", "timestamp_epoch": "1533964559.485487000" } ], "is_private": false, "observable_id": "observable-de221b5755ad6372bc175c44", "last_seen_epoch": "1533964559.485487000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964559.485487000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "173.241.250.143", "evidence": [ { "udp_stream": 59, "frame_number": 4896, "display_filter": "frame.number == 4896", "timestamp_epoch": "1533964555.650800000" } ], "is_private": false, "observable_id": "observable-309c7b6ef4fe0172c4dde9de", "last_seen_epoch": "1533964555.650800000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964555.650800000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "173.241.250.220", "evidence": [ { "udp_stream": 31, "frame_number": 617, "display_filter": "frame.number == 617", "timestamp_epoch": "1533964545.677779000" }, { "udp_stream": 119, "frame_number": 11261, "display_filter": "frame.number == 11261", "timestamp_epoch": "1533964901.134370000" }, { "udp_stream": 139, "frame_number": 13383, "display_filter": "frame.number == 13383", "timestamp_epoch": "1533964903.261260000" } ], "is_private": false, "observable_id": "observable-2af8523b085bffc65a309ca8", "last_seen_epoch": "1533964903.261260000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964545.677779000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "176.9.67.12", "evidence": [ { "udp_stream": 29, "frame_number": 605, "display_filter": "frame.number == 605", "timestamp_epoch": "1533964545.630742000" } ], "is_private": false, "observable_id": "observable-09d7554751955443d5f1d580", "last_seen_epoch": "1533964545.630742000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964545.630742000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "178.154.131.215", "evidence": [ { "udp_stream": 32, "frame_number": 608, "display_filter": "frame.number == 608", "timestamp_epoch": "1533964545.638096000" } ], "is_private": false, "observable_id": "observable-5a6bd7f6567123003fd2dfef", "last_seen_epoch": "1533964545.638096000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964545.638096000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "178.154.131.216", "evidence": [ { "udp_stream": 32, "frame_number": 608, "display_filter": "frame.number == 608", "timestamp_epoch": "1533964545.638096000" } ], "is_private": false, "observable_id": "observable-e0baf28c4095518f57acc5ce", "last_seen_epoch": "1533964545.638096000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964545.638096000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "178.154.131.217", "evidence": [ { "udp_stream": 32, "frame_number": 608, "display_filter": "frame.number == 608", "timestamp_epoch": "1533964545.638096000" } ], "is_private": false, "observable_id": "observable-869d9f7e5c4f56869b897672", "last_seen_epoch": "1533964545.638096000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964545.638096000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "18.185.181.189", "evidence": [ { "udp_stream": 261, "frame_number": 27339, "display_filter": "frame.number == 27339", "timestamp_epoch": "1533965035.445254000" } ], "is_private": false, "observable_id": "observable-e81813376f707581d2e1db41", "last_seen_epoch": "1533965035.445254000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965035.445254000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "18.197.74.2", "evidence": [ { "udp_stream": 261, "frame_number": 27339, "display_filter": "frame.number == 27339", "timestamp_epoch": "1533965035.445254000" } ], "is_private": false, "observable_id": "observable-2f75b8abe131ec90fb7e67c3", "last_seen_epoch": "1533965035.445254000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965035.445254000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "18.211.105.159", "evidence": [ { "udp_stream": 234, "frame_number": 23623, "display_filter": "frame.number == 23623", "timestamp_epoch": "1533964997.803829000" } ], "is_private": false, "observable_id": "observable-26062e57d8d0c6e57e1f24bc", "last_seen_epoch": "1533964997.803829000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964997.803829000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "18.218.252.177", "evidence": [ { "udp_stream": 303, "frame_number": 35536, "display_filter": "frame.number == 35536", "timestamp_epoch": "1533965160.370088000" } ], "is_private": false, "observable_id": "observable-02af47575d899b0416a5037c", "last_seen_epoch": "1533965160.370088000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965160.370088000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "18.218.6.11", "evidence": [ { "udp_stream": 293, "frame_number": 32841, "display_filter": "frame.number == 32841", "timestamp_epoch": "1533965136.087192000" } ], "is_private": false, "observable_id": "observable-5ec7da20798587dc64468638", "last_seen_epoch": "1533965136.087192000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965136.087192000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "18.218.60.224", "evidence": [ { "udp_stream": 303, "frame_number": 35536, "display_filter": "frame.number == 35536", "timestamp_epoch": "1533965160.370088000" } ], "is_private": false, "observable_id": "observable-61c0c0ba8b7b063f387a3976", "last_seen_epoch": "1533965160.370088000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965160.370088000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "18.219.146.238", "evidence": [ { "udp_stream": 293, "frame_number": 32841, "display_filter": "frame.number == 32841", "timestamp_epoch": "1533965136.087192000" } ], "is_private": false, "observable_id": "observable-be003a2ce96b34cdc4e73070", "last_seen_epoch": "1533965136.087192000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965136.087192000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "18.220.35.131", "evidence": [ { "udp_stream": 293, "frame_number": 32841, "display_filter": "frame.number == 32841", "timestamp_epoch": "1533965136.087192000" } ], "is_private": false, "observable_id": "observable-2d580dc1f20ed011010bd7f3", "last_seen_epoch": "1533965136.087192000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965136.087192000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "18.221.66.92", "evidence": [ { "udp_stream": 293, "frame_number": 32841, "display_filter": "frame.number == 32841", "timestamp_epoch": "1533965136.087192000" } ], "is_private": false, "observable_id": "observable-b3e392d5837cea1a5b983381", "last_seen_epoch": "1533965136.087192000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965136.087192000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "184.26.122.58", "evidence": [ { "udp_stream": 172, "frame_number": 16445, "display_filter": "frame.number == 16445", "timestamp_epoch": "1533964909.104131000" } ], "is_private": false, "observable_id": "observable-4943fba9e6b855e4a471b376", "last_seen_epoch": "1533964909.104131000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964909.104131000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "185.167.164.37", "evidence": [ { "udp_stream": 97, "frame_number": 8972, "display_filter": "frame.number == 8972", "timestamp_epoch": "1533964898.937210000" }, { "udp_stream": 195, "frame_number": 18760, "display_filter": "frame.number == 18760", "timestamp_epoch": "1533964960.021343000" }, { "udp_stream": 255, "frame_number": 27166, "display_filter": "frame.number == 27166", "timestamp_epoch": "1533965034.849432000" } ], "is_private": false, "observable_id": "observable-6bdd303f46cee74de2527256", "last_seen_epoch": "1533965034.849432000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964898.937210000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "185.167.164.39", "evidence": [ { "udp_stream": 97, "frame_number": 8972, "display_filter": "frame.number == 8972", "timestamp_epoch": "1533964898.937210000" }, { "udp_stream": 195, "frame_number": 18760, "display_filter": "frame.number == 18760", "timestamp_epoch": "1533964960.021343000" }, { "udp_stream": 255, "frame_number": 27166, "display_filter": "frame.number == 27166", "timestamp_epoch": "1533965034.849432000" } ], "is_private": false, "observable_id": "observable-538026c3d03b50be81c3fa55", "last_seen_epoch": "1533965034.849432000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964898.937210000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "185.167.166.40", "evidence": [ { "udp_stream": 198, "frame_number": 19168, "display_filter": "frame.number == 19168", "timestamp_epoch": "1533964960.869060000" } ], "is_private": false, "observable_id": "observable-28ad3736011505ef20f4eca4", "last_seen_epoch": "1533964960.869060000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964960.869060000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "185.167.166.41", "evidence": [ { "udp_stream": 198, "frame_number": 19168, "display_filter": "frame.number == 19168", "timestamp_epoch": "1533964960.869060000" } ], "is_private": false, "observable_id": "observable-2cfd40d240524ced25427598", "last_seen_epoch": "1533964960.869060000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964960.869060000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "185.180.13.28", "evidence": [ { "udp_stream": 221, "frame_number": 21150, "display_filter": "frame.number == 21150", "timestamp_epoch": "1533964967.906377000" } ], "is_private": false, "observable_id": "observable-b2716b498a26bbd71310a7d9", "last_seen_epoch": "1533964967.906377000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964967.906377000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "185.28.71.53", "evidence": [ { "udp_stream": 33, "frame_number": 649, "display_filter": "frame.number == 649", "timestamp_epoch": "1533964545.745951000" } ], "is_private": false, "observable_id": "observable-9c099f0fd46ef6775f80364f", "last_seen_epoch": "1533964545.745951000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964545.745951000" }, { "type": "ipv4", "roles": [ "http-host", "network-endpoint" ], "value": "185.68.93.18", "evidence": [ { "tcp_stream": 1036, "frame_number": 39557, "display_filter": "frame.number == 39557", "timestamp_epoch": "1533965406.977212000" }, { "tcp_stream": 1046, "frame_number": 39676, "display_filter": "frame.number == 39676", "timestamp_epoch": "1533965418.580357000" }, { "tcp_stream": 1046, "frame_number": 39681, "display_filter": "frame.number == 39681", "timestamp_epoch": "1533965419.412338000" }, { "tcp_stream": 1047, "frame_number": 39699, "display_filter": "frame.number == 39699", "timestamp_epoch": "1533965435.576793000" }, { "tcp_stream": 1048, "frame_number": 39712, "display_filter": "frame.number == 39712", "timestamp_epoch": "1533965451.757604000" }, { "tcp_stream": 1049, "frame_number": 39725, "display_filter": "frame.number == 39725", "timestamp_epoch": "1533965467.936416000" }, { "tcp_stream": 1050, "frame_number": 39741, "display_filter": "frame.number == 39741", "timestamp_epoch": "1533965484.293094000" }, { "tcp_stream": 1051, "frame_number": 39754, "display_filter": "frame.number == 39754", "timestamp_epoch": "1533965500.471438000" }, { "tcp_stream": 1052, "frame_number": 39767, "display_filter": "frame.number == 39767", "timestamp_epoch": "1533965516.649335000" }, { "tcp_stream": 1053, "frame_number": 39781, "display_filter": "frame.number == 39781", "timestamp_epoch": "1533965532.902740000" }, { "tcp_stream": 1054, "frame_number": 39796, "display_filter": "frame.number == 39796", "timestamp_epoch": "1533965549.287287000" }, { "tcp_stream": 1055, "frame_number": 39809, "display_filter": "frame.number == 39809", "timestamp_epoch": "1533965565.437819000" }, { "tcp_stream": 1057, "frame_number": 39879, "display_filter": "frame.number == 39879", "timestamp_epoch": "1533965581.646796000" }, { "tcp_stream": 1058, "frame_number": 39895, "display_filter": "frame.number == 39895", "timestamp_epoch": "1533965597.772796000" }, { "tcp_stream": 1060, "frame_number": 39951, "display_filter": "frame.number == 39951", "timestamp_epoch": "1533965613.953658000" }, { "tcp_stream": 1061, "frame_number": 39970, "display_filter": "frame.number == 39970", "timestamp_epoch": "1533965630.124714000" }, { "tcp_stream": 1062, "frame_number": 39983, "display_filter": "frame.number == 39983", "timestamp_epoch": "1533965646.289888000" }, { "tcp_stream": 1063, "frame_number": 39996, "display_filter": "frame.number == 39996", "timestamp_epoch": "1533965662.463461000" }, { "tcp_stream": 1064, "frame_number": 40009, "display_filter": "frame.number == 40009", "timestamp_epoch": "1533965678.767587000" }, { "tcp_stream": 1065, "frame_number": 40022, "display_filter": "frame.number == 40022", "timestamp_epoch": "1533965694.815438000" } ], "is_private": false, "observable_id": "observable-e17f8b987c9ba869003a6d26", "last_seen_epoch": "1533965906.527374000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965406.977212000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "185.86.137.17", "evidence": [ { "udp_stream": 265, "frame_number": 27532, "display_filter": "frame.number == 27532", "timestamp_epoch": "1533965035.693277000" } ], "is_private": false, "observable_id": "observable-647e18feead336ed22e360d3", "last_seen_epoch": "1533965035.693277000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965035.693277000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "185.86.137.32", "evidence": [ { "udp_stream": 265, "frame_number": 27532, "display_filter": "frame.number == 27532", "timestamp_epoch": "1533965035.693277000" } ], "is_private": false, "observable_id": "observable-e85d6d3775b6542a5d22aeea", "last_seen_epoch": "1533965035.693277000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965035.693277000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "185.86.137.42", "evidence": [ { "udp_stream": 265, "frame_number": 27532, "display_filter": "frame.number == 27532", "timestamp_epoch": "1533965035.693277000" } ], "is_private": false, "observable_id": "observable-5e52ac605b62c00915d50437", "last_seen_epoch": "1533965035.693277000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965035.693277000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "185.86.137.43", "evidence": [ { "udp_stream": 265, "frame_number": 27532, "display_filter": "frame.number == 27532", "timestamp_epoch": "1533965035.693277000" } ], "is_private": false, "observable_id": "observable-3a12d2b7eda868b74f7c1dd2", "last_seen_epoch": "1533965035.693277000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965035.693277000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "185.99.9.116", "evidence": [ { "udp_stream": 365, "frame_number": 46422, "display_filter": "frame.number == 46422", "timestamp_epoch": "1533965791.276701000" } ], "is_private": false, "observable_id": "observable-3067df8b6a654db0c431c2a5", "last_seen_epoch": "1533965791.276701000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965791.276701000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "185.99.9.117", "evidence": [ { "udp_stream": 365, "frame_number": 46422, "display_filter": "frame.number == 46422", "timestamp_epoch": "1533965791.276701000" } ], "is_private": false, "observable_id": "observable-6ebcff8c6bdf1799c1a5cf00", "last_seen_epoch": "1533965791.276701000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965791.276701000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "185.99.9.123", "evidence": [ { "udp_stream": 365, "frame_number": 46422, "display_filter": "frame.number == 46422", "timestamp_epoch": "1533965791.276701000" } ], "is_private": false, "observable_id": "observable-4b0b9eb748eb9422c012dfe9", "last_seen_epoch": "1533965791.276701000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965791.276701000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "185.99.9.124", "evidence": [ { "udp_stream": 365, "frame_number": 46422, "display_filter": "frame.number == 46422", "timestamp_epoch": "1533965791.276701000" } ], "is_private": false, "observable_id": "observable-b0e10e0119a02a4066729c01", "last_seen_epoch": "1533965791.276701000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965791.276701000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "188.40.114.5", "evidence": [ { "udp_stream": 358, "frame_number": 45340, "display_filter": "frame.number == 45340", "timestamp_epoch": "1533965787.454378000" } ], "is_private": false, "observable_id": "observable-eb6562d3d5b26867a0de5dc8", "last_seen_epoch": "1533965787.454378000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965787.454378000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "188.40.114.52", "evidence": [ { "udp_stream": 358, "frame_number": 45340, "display_filter": "frame.number == 45340", "timestamp_epoch": "1533965787.454378000" } ], "is_private": false, "observable_id": "observable-968a0e4f9d96e4b2551628bd", "last_seen_epoch": "1533965787.454378000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965787.454378000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "188.40.115.111", "evidence": [ { "udp_stream": 358, "frame_number": 45340, "display_filter": "frame.number == 45340", "timestamp_epoch": "1533965787.454378000" } ], "is_private": false, "observable_id": "observable-6c6aef21ba85127603a8a536", "last_seen_epoch": "1533965787.454378000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965787.454378000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "188.40.115.112", "evidence": [ { "udp_stream": 358, "frame_number": 45340, "display_filter": "frame.number == 45340", "timestamp_epoch": "1533965787.454378000" } ], "is_private": false, "observable_id": "observable-97c6afb874030c57e5d6e120", "last_seen_epoch": "1533965787.454378000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965787.454378000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "188.40.118.169", "evidence": [ { "udp_stream": 358, "frame_number": 45340, "display_filter": "frame.number == 45340", "timestamp_epoch": "1533965787.454378000" } ], "is_private": false, "observable_id": "observable-08855ed6f27d08e66abe2d1c", "last_seen_epoch": "1533965787.454378000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965787.454378000" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "192.168.1.1", "evidence": [], "is_private": true, "observable_id": "observable-b38169eb51bdf4832e6938b5", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "192.168.1.254", "evidence": [], "is_private": true, "observable_id": "observable-91a90452fbd67a51f51e0bcf", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "192.168.1.255", "evidence": [], "is_private": true, "observable_id": "observable-8169a9e435ec231f96c45001", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "192.168.1.6", "evidence": [ { "udp_stream": 5, "frame_number": 14, "display_filter": "frame.number == 14", "timestamp_epoch": "1533964509.083115000" }, { "udp_stream": 6, "frame_number": 16, "display_filter": "frame.number == 16", "timestamp_epoch": "1533964509.084490000" }, { "udp_stream": 10, "frame_number": 25, "display_filter": "frame.number == 25", "timestamp_epoch": "1533964509.191910000" }, { "udp_stream": 21, "frame_number": 335, "display_filter": "frame.number == 335", "timestamp_epoch": "1533964517.019178000" }, { "udp_stream": 22, "frame_number": 375, "display_filter": "frame.number == 375", "timestamp_epoch": "1533964517.089954000" }, { "udp_stream": 309, "frame_number": 39583, "display_filter": "frame.number == 39583", "timestamp_epoch": "1533965407.390593000" }, { "udp_stream": 311, "frame_number": 39595, "display_filter": "frame.number == 39595", "timestamp_epoch": "1533965407.491736000" }, { "udp_stream": 314, "frame_number": 39654, "display_filter": "frame.number == 39654", "timestamp_epoch": "1533965410.183053000" }, { "udp_stream": 316, "frame_number": 39658, "display_filter": "frame.number == 39658", "timestamp_epoch": "1533965410.185581000" } ], "is_private": true, "observable_id": "observable-746dd24e5d6b1986fc5f7963", "last_seen_epoch": "1533965410.185581000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964509.083115000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "192.168.1.95", "evidence": [ { "udp_stream": 23, "frame_number": 376, "display_filter": "frame.number == 376", "timestamp_epoch": "1533964517.090941000" }, { "udp_stream": 23, "frame_number": 377, "display_filter": "frame.number == 377", "timestamp_epoch": "1533964517.092165000" }, { "udp_stream": 315, "frame_number": 39655, "display_filter": "frame.number == 39655", "timestamp_epoch": "1533965410.183603000" }, { "udp_stream": 315, "frame_number": 39656, "display_filter": "frame.number == 39656", "timestamp_epoch": "1533965410.184627000" }, { "udp_stream": 317, "frame_number": 39659, "display_filter": "frame.number == 39659", "timestamp_epoch": "1533965410.186117000" }, { "udp_stream": 317, "frame_number": 39660, "display_filter": "frame.number == 39660", "timestamp_epoch": "1533965410.186527000" } ], "is_private": true, "observable_id": "observable-1acef6b065f530508c789024", "last_seen_epoch": "1533965410.186527000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964517.090941000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "192.184.65.2", "evidence": [ { "udp_stream": 142, "frame_number": 13537, "display_filter": "frame.number == 13537", "timestamp_epoch": "1533964903.535108000" } ], "is_private": false, "observable_id": "observable-581e22079d56132df78b21d5", "last_seen_epoch": "1533964903.535108000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964903.535108000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "192.184.65.3", "evidence": [ { "udp_stream": 142, "frame_number": 13537, "display_filter": "frame.number == 13537", "timestamp_epoch": "1533964903.535108000" } ], "is_private": false, "observable_id": "observable-a38e574705304847cef00a57", "last_seen_epoch": "1533964903.535108000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964903.535108000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "192.184.65.4", "evidence": [ { "udp_stream": 142, "frame_number": 13537, "display_filter": "frame.number == 13537", "timestamp_epoch": "1533964903.535108000" } ], "is_private": false, "observable_id": "observable-004267b410c919bfe039d490", "last_seen_epoch": "1533964903.535108000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964903.535108000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "192.184.65.5", "evidence": [ { "udp_stream": 142, "frame_number": 13537, "display_filter": "frame.number == 13537", "timestamp_epoch": "1533964903.535108000" } ], "is_private": false, "observable_id": "observable-d10eacd8bb3ce9540afbe0c4", "last_seen_epoch": "1533964903.535108000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964903.535108000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "192.229.163.25", "evidence": [ { "udp_stream": 343, "frame_number": 43671, "display_filter": "frame.number == 43671", "timestamp_epoch": "1533965783.112888000" } ], "is_private": false, "observable_id": "observable-479266ab680239d5d28915ca", "last_seen_epoch": "1533965783.112888000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965783.112888000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "192.229.210.158", "evidence": [ { "udp_stream": 214, "frame_number": 20116, "display_filter": "frame.number == 20116", "timestamp_epoch": "1533964964.705871000" } ], "is_private": false, "observable_id": "observable-67640acc70c6d9b8cc78c390", "last_seen_epoch": "1533964964.705871000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964964.705871000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "192.35.177.64", "evidence": [ { "udp_stream": 95, "frame_number": 8582, "display_filter": "frame.number == 8582", "timestamp_epoch": "1533964898.485160000" }, { "udp_stream": 94, "frame_number": 8583, "display_filter": "frame.number == 8583", "timestamp_epoch": "1533964898.485161000" } ], "is_private": false, "observable_id": "observable-3ba29e3f71badf83d4c8d746", "last_seen_epoch": "1533964898.485161000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964898.485160000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "194.226.130.226", "evidence": [ { "udp_stream": 50, "frame_number": 3303, "display_filter": "frame.number == 3303", "timestamp_epoch": "1533964552.639522000" }, { "udp_stream": 341, "frame_number": 43643, "display_filter": "frame.number == 43643", "timestamp_epoch": "1533965783.028284000" } ], "is_private": false, "observable_id": "observable-a21ff2d99d79cc9f4bf81fe6", "last_seen_epoch": "1533965783.028284000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964552.639522000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "194.226.130.227", "evidence": [ { "udp_stream": 50, "frame_number": 3303, "display_filter": "frame.number == 3303", "timestamp_epoch": "1533964552.639522000" }, { "udp_stream": 341, "frame_number": 43643, "display_filter": "frame.number == 43643", "timestamp_epoch": "1533965783.028284000" } ], "is_private": false, "observable_id": "observable-b22b45a2962a992f9df73f3b", "last_seen_epoch": "1533965783.028284000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964552.639522000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "194.226.130.228", "evidence": [ { "udp_stream": 50, "frame_number": 3303, "display_filter": "frame.number == 3303", "timestamp_epoch": "1533964552.639522000" }, { "udp_stream": 341, "frame_number": 43643, "display_filter": "frame.number == 43643", "timestamp_epoch": "1533965783.028284000" } ], "is_private": false, "observable_id": "observable-8af1714d721911bf1ba38e75", "last_seen_epoch": "1533965783.028284000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964552.639522000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "194.226.130.229", "evidence": [ { "udp_stream": 50, "frame_number": 3303, "display_filter": "frame.number == 3303", "timestamp_epoch": "1533964552.639522000" }, { "udp_stream": 341, "frame_number": 43643, "display_filter": "frame.number == 43643", "timestamp_epoch": "1533965783.028284000" } ], "is_private": false, "observable_id": "observable-29cf7a6571d5ab232edfb7ea", "last_seen_epoch": "1533965783.028284000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964552.639522000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "195.244.31.10", "evidence": [ { "udp_stream": 146, "frame_number": 13566, "display_filter": "frame.number == 13566", "timestamp_epoch": "1533964903.560435000" } ], "is_private": false, "observable_id": "observable-ddc5f546a551755ec81f2e04", "last_seen_epoch": "1533964903.560435000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964903.560435000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "195.244.31.11", "evidence": [ { "udp_stream": 146, "frame_number": 13566, "display_filter": "frame.number == 13566", "timestamp_epoch": "1533964903.560435000" } ], "is_private": false, "observable_id": "observable-edf5382b8e7c90dc0f36528f", "last_seen_epoch": "1533964903.560435000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964903.560435000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "198.23.90.56", "evidence": [ { "udp_stream": 75, "frame_number": 5872, "display_filter": "frame.number == 5872", "timestamp_epoch": "1533964559.485716000" } ], "is_private": false, "observable_id": "observable-034af9e98486ff2b973ebcce", "last_seen_epoch": "1533964559.485716000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964559.485716000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "198.23.90.60", "evidence": [ { "udp_stream": 75, "frame_number": 5872, "display_filter": "frame.number == 5872", "timestamp_epoch": "1533964559.485716000" } ], "is_private": false, "observable_id": "observable-4381840b7c5030bd80c0bd6b", "last_seen_epoch": "1533964559.485716000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964559.485716000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "198.23.90.62", "evidence": [ { "udp_stream": 75, "frame_number": 5872, "display_filter": "frame.number == 5872", "timestamp_epoch": "1533964559.485716000" } ], "is_private": false, "observable_id": "observable-5330dbb153efa9c6a170557a", "last_seen_epoch": "1533964559.485716000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964559.485716000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "198.54.12.127", "evidence": [ { "udp_stream": 209, "frame_number": 19708, "display_filter": "frame.number == 19708", "timestamp_epoch": "1533964962.901909000" } ], "is_private": false, "observable_id": "observable-77efb9df3b8a635946b23000", "last_seen_epoch": "1533964962.901909000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964962.901909000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "198.54.12.145", "evidence": [ { "udp_stream": 209, "frame_number": 19708, "display_filter": "frame.number == 19708", "timestamp_epoch": "1533964962.901909000" } ], "is_private": false, "observable_id": "observable-c95601b6a07791e2e35b2165", "last_seen_epoch": "1533964962.901909000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964962.901909000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "198.7.56.229", "evidence": [ { "udp_stream": 113, "frame_number": 10616, "display_filter": "frame.number == 10616", "timestamp_epoch": "1533964900.621029000" } ], "is_private": false, "observable_id": "observable-bd482a1921dc3371e9748be3", "last_seen_epoch": "1533964900.621029000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964900.621029000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "198.70.71.144", "evidence": [ { "udp_stream": 56, "frame_number": 4256, "display_filter": "frame.number == 4256", "timestamp_epoch": "1533964554.071566000" }, { "udp_stream": 55, "frame_number": 4257, "display_filter": "frame.number == 4257", "timestamp_epoch": "1533964554.071727000" } ], "is_private": false, "observable_id": "observable-a39279106f37ad2aa60eb510", "last_seen_epoch": "1533964554.071727000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964554.071566000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "198.70.71.147", "evidence": [ { "udp_stream": 24, "frame_number": 381, "display_filter": "frame.number == 381", "timestamp_epoch": "1533964519.500541000" } ], "is_private": false, "observable_id": "observable-9e641980a234dc9f4d634834", "last_seen_epoch": "1533964519.500541000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964519.500541000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "198.70.71.161", "evidence": [ { "udp_stream": 24, "frame_number": 381, "display_filter": "frame.number == 381", "timestamp_epoch": "1533964519.500541000" }, { "udp_stream": 56, "frame_number": 4256, "display_filter": "frame.number == 4256", "timestamp_epoch": "1533964554.071566000" }, { "udp_stream": 55, "frame_number": 4257, "display_filter": "frame.number == 4257", "timestamp_epoch": "1533964554.071727000" } ], "is_private": false, "observable_id": "observable-40cb45cab86c23e6059b6823", "last_seen_epoch": "1533964554.071727000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964519.500541000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "199.38.167.128", "evidence": [ { "udp_stream": 78, "frame_number": 6313, "display_filter": "frame.number == 6313", "timestamp_epoch": "1533964560.553014000" } ], "is_private": false, "observable_id": "observable-74187595b41aea54aa066a74", "last_seen_epoch": "1533964560.553014000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964560.553014000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "199.59.149.201", "evidence": [ { "udp_stream": 352, "frame_number": 44343, "display_filter": "frame.number == 44343", "timestamp_epoch": "1533965785.001653000" } ], "is_private": false, "observable_id": "observable-1c7f0a807909521e8b4a1789", "last_seen_epoch": "1533965785.001653000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965785.001653000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "199.59.149.233", "evidence": [ { "udp_stream": 352, "frame_number": 44343, "display_filter": "frame.number == 44343", "timestamp_epoch": "1533965785.001653000" } ], "is_private": false, "observable_id": "observable-289ab7b7876b92eacc7425f2", "last_seen_epoch": "1533965785.001653000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965785.001653000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "204.11.109.65", "evidence": [ { "udp_stream": 193, "frame_number": 18627, "display_filter": "frame.number == 18627", "timestamp_epoch": "1533964959.502881000" } ], "is_private": false, "observable_id": "observable-216d0f0b3362b9b540866e1e", "last_seen_epoch": "1533964959.502881000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964959.502881000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "204.11.109.66", "evidence": [ { "udp_stream": 193, "frame_number": 18627, "display_filter": "frame.number == 18627", "timestamp_epoch": "1533964959.502881000" } ], "is_private": false, "observable_id": "observable-ee490f4b63b155c277fa126c", "last_seen_epoch": "1533964959.502881000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964959.502881000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "204.11.109.67", "evidence": [ { "udp_stream": 193, "frame_number": 18627, "display_filter": "frame.number == 18627", "timestamp_epoch": "1533964959.502881000" } ], "is_private": false, "observable_id": "observable-a02fa51e97ef753c9e8db1e7", "last_seen_epoch": "1533964959.502881000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964959.502881000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "204.11.109.68", "evidence": [ { "udp_stream": 193, "frame_number": 18627, "display_filter": "frame.number == 18627", "timestamp_epoch": "1533964959.502881000" } ], "is_private": false, "observable_id": "observable-6dfeabd0e470fe4d17715343", "last_seen_epoch": "1533964959.502881000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964959.502881000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "204.2.197.201", "evidence": [ { "udp_stream": 192, "frame_number": 18626, "display_filter": "frame.number == 18626", "timestamp_epoch": "1533964959.502753000" } ], "is_private": false, "observable_id": "observable-27efd57c37e8e3e5cf52cdb6", "last_seen_epoch": "1533964959.502753000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964959.502753000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "204.2.250.100", "evidence": [ { "udp_stream": 137, "frame_number": 13018, "display_filter": "frame.number == 13018", "timestamp_epoch": "1533964902.980837000" } ], "is_private": false, "observable_id": "observable-57ec0a4947bec6d1b7f41c52", "last_seen_epoch": "1533964902.980837000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964902.980837000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "204.236.186.16", "evidence": [ { "udp_stream": 262, "frame_number": 27340, "display_filter": "frame.number == 27340", "timestamp_epoch": "1533965035.445360000" } ], "is_private": false, "observable_id": "observable-82c356f87ebaf2a0d46a6bd0", "last_seen_epoch": "1533965035.445360000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965035.445360000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "204.79.197.200", "evidence": [ { "udp_stream": 38, "frame_number": 2263, "display_filter": "frame.number == 2263", "timestamp_epoch": "1533964549.230108000" }, { "udp_stream": 39, "frame_number": 2265, "display_filter": "frame.number == 2265", "timestamp_epoch": "1533964549.230112000" }, { "udp_stream": 40, "frame_number": 2266, "display_filter": "frame.number == 2266", "timestamp_epoch": "1533964549.230247000" }, { "udp_stream": 37, "frame_number": 2268, "display_filter": "frame.number == 2268", "timestamp_epoch": "1533964549.230297000" }, { "udp_stream": 206, "frame_number": 19673, "display_filter": "frame.number == 19673", "timestamp_epoch": "1533964962.856769000" }, { "udp_stream": 333, "frame_number": 43410, "display_filter": "frame.number == 43410", "timestamp_epoch": "1533965778.972314000" }, { "udp_stream": 334, "frame_number": 43411, "display_filter": "frame.number == 43411", "timestamp_epoch": "1533965778.972428000" }, { "udp_stream": 335, "frame_number": 43412, "display_filter": "frame.number == 43412", "timestamp_epoch": "1533965778.972581000" }, { "udp_stream": 333, "frame_number": 43413, "display_filter": "frame.number == 43413", "timestamp_epoch": "1533965778.972688000" }, { "udp_stream": 334, "frame_number": 43415, "display_filter": "frame.number == 43415", "timestamp_epoch": "1533965778.972803000" }, { "udp_stream": 335, "frame_number": 43417, "display_filter": "frame.number == 43417", "timestamp_epoch": "1533965778.972805000" }, { "udp_stream": 334, "frame_number": 43418, "display_filter": "frame.number == 43418", "timestamp_epoch": "1533965778.972933000" }, { "udp_stream": 333, "frame_number": 43419, "display_filter": "frame.number == 43419", "timestamp_epoch": "1533965778.972999000" }, { "udp_stream": 335, "frame_number": 43420, "display_filter": "frame.number == 43420", "timestamp_epoch": "1533965778.973091000" }, { "udp_stream": 332, "frame_number": 43421, "display_filter": "frame.number == 43421", "timestamp_epoch": "1533965778.973203000" } ], "is_private": false, "observable_id": "observable-0ed22b80d10e2ad7ec0de9e4", "last_seen_epoch": "1533965778.973203000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964549.230108000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "204.79.197.229", "evidence": [ { "udp_stream": 335, "frame_number": 42737, "display_filter": "frame.number == 42737", "timestamp_epoch": "1533965777.047036000" }, { "udp_stream": 334, "frame_number": 42738, "display_filter": "frame.number == 42738", "timestamp_epoch": "1533965777.047173000" }, { "udp_stream": 332, "frame_number": 42739, "display_filter": "frame.number == 42739", "timestamp_epoch": "1533965777.047205000" }, { "udp_stream": 333, "frame_number": 42741, "display_filter": "frame.number == 42741", "timestamp_epoch": "1533965777.047368000" } ], "is_private": false, "observable_id": "observable-d309e04a9772ccd90d3ec099", "last_seen_epoch": "1533965777.047368000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965777.047036000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "205.180.87.137", "evidence": [ { "udp_stream": 168, "frame_number": 16039, "display_filter": "frame.number == 16039", "timestamp_epoch": "1533964908.424347000" } ], "is_private": false, "observable_id": "observable-afed5841129f5f2873ec4b22", "last_seen_epoch": "1533964908.424347000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964908.424347000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "205.180.87.204", "evidence": [ { "udp_stream": 249, "frame_number": 26802, "display_filter": "frame.number == 26802", "timestamp_epoch": "1533965033.625618000" }, { "udp_stream": 267, "frame_number": 27573, "display_filter": "frame.number == 27573", "timestamp_epoch": "1533965035.747066000" } ], "is_private": false, "observable_id": "observable-083cf6e09d3074b369ffbb44", "last_seen_epoch": "1533965035.747066000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965033.625618000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "205.185.216.10", "evidence": [ { "udp_stream": 90, "frame_number": 7515, "display_filter": "frame.number == 7515", "timestamp_epoch": "1533964897.312123000" }, { "udp_stream": 160, "frame_number": 15186, "display_filter": "frame.number == 15186", "timestamp_epoch": "1533964906.152257000" }, { "udp_stream": 308, "frame_number": 39482, "display_filter": "frame.number == 39482", "timestamp_epoch": "1533965401.063902000" } ], "is_private": false, "observable_id": "observable-3cd0ad3c560ed16ab07ff408", "last_seen_epoch": "1533965401.063902000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964897.312123000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "205.185.216.42", "evidence": [ { "udp_stream": 90, "frame_number": 7515, "display_filter": "frame.number == 7515", "timestamp_epoch": "1533964897.312123000" }, { "udp_stream": 160, "frame_number": 15186, "display_filter": "frame.number == 15186", "timestamp_epoch": "1533964906.152257000" }, { "udp_stream": 308, "frame_number": 39482, "display_filter": "frame.number == 39482", "timestamp_epoch": "1533965401.063902000" } ], "is_private": false, "observable_id": "observable-621426fac0f69dbad84af286", "last_seen_epoch": "1533965401.063902000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964897.312123000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "207.244.102.143", "evidence": [ { "udp_stream": 187, "frame_number": 18189, "display_filter": "frame.number == 18189", "timestamp_epoch": "1533964958.450799000" } ], "is_private": false, "observable_id": "observable-c6f91e92ba642fd60e7fe1bf", "last_seen_epoch": "1533964958.450799000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964958.450799000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "207.244.108.217", "evidence": [ { "udp_stream": 113, "frame_number": 10616, "display_filter": "frame.number == 10616", "timestamp_epoch": "1533964900.621029000" } ], "is_private": false, "observable_id": "observable-4cb4b7e307a6f4af72d382a8", "last_seen_epoch": "1533964900.621029000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964900.621029000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "207.244.110.3", "evidence": [ { "udp_stream": 113, "frame_number": 10616, "display_filter": "frame.number == 10616", "timestamp_epoch": "1533964900.621029000" } ], "is_private": false, "observable_id": "observable-ad28a76e6bafc7270487bea4", "last_seen_epoch": "1533964900.621029000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964900.621029000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "207.244.121.25", "evidence": [ { "udp_stream": 113, "frame_number": 10616, "display_filter": "frame.number == 10616", "timestamp_epoch": "1533964900.621029000" } ], "is_private": false, "observable_id": "observable-84a33fddc38359ce695d606f", "last_seen_epoch": "1533964900.621029000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964900.621029000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "207.244.121.27", "evidence": [ { "udp_stream": 113, "frame_number": 10616, "display_filter": "frame.number == 10616", "timestamp_epoch": "1533964900.621029000" } ], "is_private": false, "observable_id": "observable-a177265ead569a870b878750", "last_seen_epoch": "1533964900.621029000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964900.621029000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "207.244.66.112", "evidence": [ { "udp_stream": 113, "frame_number": 10616, "display_filter": "frame.number == 10616", "timestamp_epoch": "1533964900.621029000" } ], "is_private": false, "observable_id": "observable-55342d117704343a6daae087", "last_seen_epoch": "1533964900.621029000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964900.621029000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "207.244.67.98", "evidence": [ { "udp_stream": 113, "frame_number": 10616, "display_filter": "frame.number == 10616", "timestamp_epoch": "1533964900.621029000" } ], "is_private": false, "observable_id": "observable-3e41d8da4cf6629d62290f7a", "last_seen_epoch": "1533964900.621029000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964900.621029000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "207.244.67.99", "evidence": [ { "udp_stream": 113, "frame_number": 10616, "display_filter": "frame.number == 10616", "timestamp_epoch": "1533964900.621029000" } ], "is_private": false, "observable_id": "observable-9f802443151fb648c9ed1d6b", "last_seen_epoch": "1533964900.621029000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964900.621029000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "207.244.76.83", "evidence": [ { "udp_stream": 113, "frame_number": 10616, "display_filter": "frame.number == 10616", "timestamp_epoch": "1533964900.621029000" } ], "is_private": false, "observable_id": "observable-f259ab3dea97ce65ac78d185", "last_seen_epoch": "1533964900.621029000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964900.621029000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "207.244.80.166", "evidence": [ { "udp_stream": 28, "frame_number": 542, "display_filter": "frame.number == 542", "timestamp_epoch": "1533964544.690929000" }, { "udp_stream": 27, "frame_number": 543, "display_filter": "frame.number == 543", "timestamp_epoch": "1533964544.690931000" } ], "is_private": false, "observable_id": "observable-07d8a8d7e44d2c4c2e0a6bac", "last_seen_epoch": "1533964544.690931000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964544.690929000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "207.244.94.20", "evidence": [ { "udp_stream": 113, "frame_number": 10616, "display_filter": "frame.number == 10616", "timestamp_epoch": "1533964900.621029000" } ], "is_private": false, "observable_id": "observable-a2db4073fa680f434b13ba3a", "last_seen_epoch": "1533964900.621029000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964900.621029000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "208.185.50.80", "evidence": [ { "udp_stream": 196, "frame_number": 18786, "display_filter": "frame.number == 18786", "timestamp_epoch": "1533964960.049215000" } ], "is_private": false, "observable_id": "observable-80954f0d15033a317ff35eca", "last_seen_epoch": "1533964960.049215000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964960.049215000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "208.185.50.90", "evidence": [ { "udp_stream": 196, "frame_number": 18786, "display_filter": "frame.number == 18786", "timestamp_epoch": "1533964960.049215000" } ], "is_private": false, "observable_id": "observable-72e1f81e0d4f43f6b0804909", "last_seen_epoch": "1533964960.049215000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964960.049215000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "209.191.163.208", "evidence": [ { "udp_stream": 284, "frame_number": 31672, "display_filter": "frame.number == 31672", "timestamp_epoch": "1533965100.795928000" } ], "is_private": false, "observable_id": "observable-f8822fefb70101aa37834e9c", "last_seen_epoch": "1533965100.795928000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965100.795928000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "209.191.163.209", "evidence": [ { "udp_stream": 284, "frame_number": 31672, "display_filter": "frame.number == 31672", "timestamp_epoch": "1533965100.795928000" } ], "is_private": false, "observable_id": "observable-f4933a964c80490792f7e548", "last_seen_epoch": "1533965100.795928000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965100.795928000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "209.191.163.213", "evidence": [ { "udp_stream": 284, "frame_number": 31672, "display_filter": "frame.number == 31672", "timestamp_epoch": "1533965100.795928000" } ], "is_private": false, "observable_id": "observable-f8fc766a9732ce162fcff7a8", "last_seen_epoch": "1533965100.795928000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965100.795928000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "209.58.136.29", "evidence": [ { "udp_stream": 223, "frame_number": 23086, "display_filter": "frame.number == 23086", "timestamp_epoch": "1533964996.618558000" }, { "udp_stream": 361, "frame_number": 46077, "display_filter": "frame.number == 46077", "timestamp_epoch": "1533965789.700898000" } ], "is_private": false, "observable_id": "observable-6855e375ae701b20b0627af4", "last_seen_epoch": "1533965789.700898000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964996.618558000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "209.58.136.30", "evidence": [ { "udp_stream": 223, "frame_number": 23086, "display_filter": "frame.number == 23086", "timestamp_epoch": "1533964996.618558000" }, { "udp_stream": 361, "frame_number": 46077, "display_filter": "frame.number == 46077", "timestamp_epoch": "1533965789.700898000" } ], "is_private": false, "observable_id": "observable-1e65ebe2cbcf6a090e74dbbf", "last_seen_epoch": "1533965789.700898000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964996.618558000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "209.58.136.32", "evidence": [ { "udp_stream": 223, "frame_number": 23086, "display_filter": "frame.number == 23086", "timestamp_epoch": "1533964996.618558000" }, { "udp_stream": 361, "frame_number": 46077, "display_filter": "frame.number == 46077", "timestamp_epoch": "1533965789.700898000" } ], "is_private": false, "observable_id": "observable-b12cece31f6959996ad07939", "last_seen_epoch": "1533965789.700898000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964996.618558000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "209.58.139.154", "evidence": [ { "udp_stream": 223, "frame_number": 23086, "display_filter": "frame.number == 23086", "timestamp_epoch": "1533964996.618558000" }, { "udp_stream": 361, "frame_number": 46077, "display_filter": "frame.number == 46077", "timestamp_epoch": "1533965789.700898000" } ], "is_private": false, "observable_id": "observable-1472887ee65bdf6fa6d18e70", "last_seen_epoch": "1533965789.700898000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964996.618558000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "213.155.156.164", "evidence": [ { "udp_stream": 243, "frame_number": 35522, "display_filter": "frame.number == 35522", "timestamp_epoch": "1533965160.354549000" } ], "is_private": false, "observable_id": "observable-d4f0d7eed12fb5675adbbdf4", "last_seen_epoch": "1533965160.354549000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965160.354549000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "213.155.156.165", "evidence": [ { "udp_stream": 243, "frame_number": 35522, "display_filter": "frame.number == 35522", "timestamp_epoch": "1533965160.354549000" } ], "is_private": false, "observable_id": "observable-5a246e5429cb187a8c2814cb", "last_seen_epoch": "1533965160.354549000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965160.354549000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "213.155.156.166", "evidence": [ { "udp_stream": 243, "frame_number": 35522, "display_filter": "frame.number == 35522", "timestamp_epoch": "1533965160.354549000" } ], "is_private": false, "observable_id": "observable-b52b4e755f0ad657a99c795a", "last_seen_epoch": "1533965160.354549000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965160.354549000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "213.155.156.167", "evidence": [ { "udp_stream": 243, "frame_number": 35522, "display_filter": "frame.number == 35522", "timestamp_epoch": "1533965160.354549000" } ], "is_private": false, "observable_id": "observable-f3a3f8adc155b9682060f440", "last_seen_epoch": "1533965160.354549000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965160.354549000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "213.155.156.168", "evidence": [ { "udp_stream": 243, "frame_number": 35522, "display_filter": "frame.number == 35522", "timestamp_epoch": "1533965160.354549000" } ], "is_private": false, "observable_id": "observable-c72c0c25307f94e3298d6829", "last_seen_epoch": "1533965160.354549000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965160.354549000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "213.155.156.169", "evidence": [ { "udp_stream": 243, "frame_number": 35522, "display_filter": "frame.number == 35522", "timestamp_epoch": "1533965160.354549000" } ], "is_private": false, "observable_id": "observable-24d4f0eb2b96a1384b0fe256", "last_seen_epoch": "1533965160.354549000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965160.354549000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "213.155.156.180", "evidence": [ { "udp_stream": 243, "frame_number": 35522, "display_filter": "frame.number == 35522", "timestamp_epoch": "1533965160.354549000" } ], "is_private": false, "observable_id": "observable-88356829632a7394259c2500", "last_seen_epoch": "1533965160.354549000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965160.354549000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "213.155.156.181", "evidence": [ { "udp_stream": 243, "frame_number": 35522, "display_filter": "frame.number == 35522", "timestamp_epoch": "1533965160.354549000" } ], "is_private": false, "observable_id": "observable-6c3078c98dbef908d21a7a5a", "last_seen_epoch": "1533965160.354549000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965160.354549000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "213.155.156.182", "evidence": [ { "udp_stream": 243, "frame_number": 35522, "display_filter": "frame.number == 35522", "timestamp_epoch": "1533965160.354549000" } ], "is_private": false, "observable_id": "observable-1e90897e0aca293168046ab8", "last_seen_epoch": "1533965160.354549000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965160.354549000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "213.155.156.183", "evidence": [ { "udp_stream": 243, "frame_number": 35522, "display_filter": "frame.number == 35522", "timestamp_epoch": "1533965160.354549000" } ], "is_private": false, "observable_id": "observable-3c1726dfcaedf67fe59ab8d1", "last_seen_epoch": "1533965160.354549000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965160.354549000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "213.155.156.184", "evidence": [ { "udp_stream": 243, "frame_number": 35522, "display_filter": "frame.number == 35522", "timestamp_epoch": "1533965160.354549000" } ], "is_private": false, "observable_id": "observable-1dda96c2bf79a94b11f14c0c", "last_seen_epoch": "1533965160.354549000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965160.354549000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "213.155.156.185", "evidence": [ { "udp_stream": 243, "frame_number": 35522, "display_filter": "frame.number == 35522", "timestamp_epoch": "1533965160.354549000" } ], "is_private": false, "observable_id": "observable-b59c4d96b90ce639411ee930", "last_seen_epoch": "1533965160.354549000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965160.354549000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "213.180.193.38", "evidence": [ { "udp_stream": 88, "frame_number": 7089, "display_filter": "frame.number == 7089", "timestamp_epoch": "1533964677.421170000" }, { "udp_stream": 319, "frame_number": 39904, "display_filter": "frame.number == 39904", "timestamp_epoch": "1533965605.965885000" } ], "is_private": false, "observable_id": "observable-3b92bfb65a50601af91e4b62", "last_seen_epoch": "1533965605.965885000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964677.421170000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "213.180.193.90", "evidence": [ { "udp_stream": 44, "frame_number": 3197, "display_filter": "frame.number == 3197", "timestamp_epoch": "1533964552.405569000" }, { "udp_stream": 337, "frame_number": 43651, "display_filter": "frame.number == 43651", "timestamp_epoch": "1533965783.060399000" } ], "is_private": false, "observable_id": "observable-d280dbeea7eadd96c459f3aa", "last_seen_epoch": "1533965783.060399000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964552.405569000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "213.180.204.37", "evidence": [ { "udp_stream": 87, "frame_number": 6567, "display_filter": "frame.number == 6567", "timestamp_epoch": "1533964577.203660000" }, { "udp_stream": 318, "frame_number": 39814, "display_filter": "frame.number == 39814", "timestamp_epoch": "1533965567.514714000" } ], "is_private": false, "observable_id": "observable-16530eaebf9e9a0a80a4a54d", "last_seen_epoch": "1533965567.514714000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964577.203660000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "213.180.204.38", "evidence": [ { "udp_stream": 88, "frame_number": 7089, "display_filter": "frame.number == 7089", "timestamp_epoch": "1533964677.421170000" }, { "udp_stream": 319, "frame_number": 39904, "display_filter": "frame.number == 39904", "timestamp_epoch": "1533965605.965885000" } ], "is_private": false, "observable_id": "observable-3ba20341aeea758c3138a0e6", "last_seen_epoch": "1533965605.965885000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964677.421170000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "213.180.204.90", "evidence": [ { "udp_stream": 44, "frame_number": 3197, "display_filter": "frame.number == 3197", "timestamp_epoch": "1533964552.405569000" }, { "udp_stream": 337, "frame_number": 43651, "display_filter": "frame.number == 43651", "timestamp_epoch": "1533965783.060399000" } ], "is_private": false, "observable_id": "observable-fa7babca841453878b2221dc", "last_seen_epoch": "1533965783.060399000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964552.405569000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "216.115.100.123", "evidence": [ { "udp_stream": 194, "frame_number": 18742, "display_filter": "frame.number == 18742", "timestamp_epoch": "1533964959.980701000" } ], "is_private": false, "observable_id": "observable-89efe3582775e8524cd7302f", "last_seen_epoch": "1533964959.980701000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964959.980701000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "216.115.100.124", "evidence": [ { "udp_stream": 194, "frame_number": 18742, "display_filter": "frame.number == 18742", "timestamp_epoch": "1533964959.980701000" } ], "is_private": false, "observable_id": "observable-1a14340b8b4ca1739e37d220", "last_seen_epoch": "1533964959.980701000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964959.980701000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "216.200.232.221", "evidence": [ { "udp_stream": 61, "frame_number": 5120, "display_filter": "frame.number == 5120", "timestamp_epoch": "1533964555.984165000" } ], "is_private": false, "observable_id": "observable-413ced18688a4b04daf33a10", "last_seen_epoch": "1533964555.984165000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964555.984165000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "216.200.232.234", "evidence": [ { "udp_stream": 61, "frame_number": 5120, "display_filter": "frame.number == 5120", "timestamp_epoch": "1533964555.984165000" } ], "is_private": false, "observable_id": "observable-92e6378e8c1f5f7286af7290", "last_seen_epoch": "1533964555.984165000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964555.984165000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "216.200.232.235", "evidence": [ { "udp_stream": 61, "frame_number": 5120, "display_filter": "frame.number == 5120", "timestamp_epoch": "1533964555.984165000" } ], "is_private": false, "observable_id": "observable-9e77721891f795d5e5b32114", "last_seen_epoch": "1533964555.984165000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964555.984165000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "216.52.31.73", "evidence": [ { "udp_stream": 276, "frame_number": 30803, "display_filter": "frame.number == 30803", "timestamp_epoch": "1533965099.278838000" } ], "is_private": false, "observable_id": "observable-588b5b87a59e2859fe2d7039", "last_seen_epoch": "1533965099.278838000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965099.278838000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "216.58.192.1", "evidence": [ { "udp_stream": 60, "frame_number": 4936, "display_filter": "frame.number == 4936", "timestamp_epoch": "1533964555.714019000" }, { "udp_stream": 347, "frame_number": 44193, "display_filter": "frame.number == 44193", "timestamp_epoch": "1533965784.401633000" } ], "is_private": false, "observable_id": "observable-087eaafca5f018163e9d5267", "last_seen_epoch": "1533965784.401633000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964555.714019000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "216.58.192.10", "evidence": [ { "udp_stream": 41, "frame_number": 2425, "display_filter": "frame.number == 2425", "timestamp_epoch": "1533964549.757857000" }, { "udp_stream": 140, "frame_number": 13400, "display_filter": "frame.number == 13400", "timestamp_epoch": "1533964903.310256000" }, { "udp_stream": 354, "frame_number": 44732, "display_filter": "frame.number == 44732", "timestamp_epoch": "1533965786.093172000" } ], "is_private": false, "observable_id": "observable-a5026c990fc57d42b9dadd45", "last_seen_epoch": "1533965786.093172000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964549.757857000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "216.58.192.14", "evidence": [ { "udp_stream": 48, "frame_number": 3327, "display_filter": "frame.number == 3327", "timestamp_epoch": "1533964552.700183000" }, { "udp_stream": 350, "frame_number": 44229, "display_filter": "frame.number == 44229", "timestamp_epoch": "1533965784.476926000" }, { "udp_stream": 351, "frame_number": 44230, "display_filter": "frame.number == 44230", "timestamp_epoch": "1533965784.477104000" }, { "udp_stream": 356, "frame_number": 45110, "display_filter": "frame.number == 45110", "timestamp_epoch": "1533965786.890742000" } ], "is_private": false, "observable_id": "observable-4fdf79b5f41033dc08c0b6e1", "last_seen_epoch": "1533965786.890742000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964552.700183000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "216.58.192.2", "evidence": [ { "udp_stream": 54, "frame_number": 3927, "display_filter": "frame.number == 3927", "timestamp_epoch": "1533964553.575840000" }, { "udp_stream": 126, "frame_number": 11931, "display_filter": "frame.number == 11931", "timestamp_epoch": "1533964901.698739000" }, { "udp_stream": 177, "frame_number": 16951, "display_filter": "frame.number == 16951", "timestamp_epoch": "1533964912.917076000" }, { "udp_stream": 183, "frame_number": 18111, "display_filter": "frame.number == 18111", "timestamp_epoch": "1533964958.070258000" }, { "udp_stream": 346, "frame_number": 44008, "display_filter": "frame.number == 44008", "timestamp_epoch": "1533965783.935554000" } ], "is_private": false, "observable_id": "observable-3ba9ffa3db30fc9ec2ec2df4", "last_seen_epoch": "1533965783.935554000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964553.575840000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "216.58.192.3", "evidence": [ { "udp_stream": 45, "frame_number": 3196, "display_filter": "frame.number == 3196", "timestamp_epoch": "1533964552.405445000" }, { "udp_stream": 357, "frame_number": 45116, "display_filter": "frame.number == 45116", "timestamp_epoch": "1533965786.910754000" } ], "is_private": false, "observable_id": "observable-501e31511bf9be9c26cdd3d4", "last_seen_epoch": "1533965786.910754000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964552.405445000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "216.58.192.4", "evidence": [ { "udp_stream": 58, "frame_number": 4750, "display_filter": "frame.number == 4750", "timestamp_epoch": "1533964555.307152000" }, { "udp_stream": 360, "frame_number": 45837, "display_filter": "frame.number == 45837", "timestamp_epoch": "1533965789.095261000" } ], "is_private": false, "observable_id": "observable-79f8f8d2bbd841b4c7808256", "last_seen_epoch": "1533965789.095261000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964555.307152000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "216.58.192.6", "evidence": [ { "udp_stream": 70, "frame_number": 5456, "display_filter": "frame.number == 5456", "timestamp_epoch": "1533964556.909758000" }, { "udp_stream": 116, "frame_number": 10721, "display_filter": "frame.number == 10721", "timestamp_epoch": "1533964900.718497000" } ], "is_private": false, "observable_id": "observable-834a319cb7d70fb18ca4b3d7", "last_seen_epoch": "1533964900.718497000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964556.909758000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "216.58.192.8", "evidence": [ { "udp_stream": 339, "frame_number": 43662, "display_filter": "frame.number == 43662", "timestamp_epoch": "1533965783.090968000" } ], "is_private": false, "observable_id": "observable-69192f7a4c1563cb96fb0b80", "last_seen_epoch": "1533965783.090968000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965783.090968000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "216.58.194.162", "evidence": [ { "udp_stream": 43, "frame_number": 3185, "display_filter": "frame.number == 3185", "timestamp_epoch": "1533964552.354010000" }, { "udp_stream": 53, "frame_number": 3925, "display_filter": "frame.number == 3925", "timestamp_epoch": "1533964553.575811000" }, { "udp_stream": 69, "frame_number": 5441, "display_filter": "frame.number == 5441", "timestamp_epoch": "1533964556.880955000" }, { "udp_stream": 106, "frame_number": 9637, "display_filter": "frame.number == 9637", "timestamp_epoch": "1533964899.569932000" }, { "udp_stream": 336, "frame_number": 43648, "display_filter": "frame.number == 43648", "timestamp_epoch": "1533965783.044158000" }, { "udp_stream": 345, "frame_number": 43840, "display_filter": "frame.number == 43840", "timestamp_epoch": "1533965783.630277000" }, { "udp_stream": 353, "frame_number": 44701, "display_filter": "frame.number == 44701", "timestamp_epoch": "1533965786.043701000" }, { "udp_stream": 359, "frame_number": 45830, "display_filter": "frame.number == 45830", "timestamp_epoch": "1533965789.081206000" } ], "is_private": false, "observable_id": "observable-f9320887d1145c2a8668ef2c", "last_seen_epoch": "1533965789.081206000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964552.354010000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "216.58.194.170", "evidence": [ { "udp_stream": 30, "frame_number": 611, "display_filter": "frame.number == 611", "timestamp_epoch": "1533964545.651017000" } ], "is_private": false, "observable_id": "observable-b8eecb18ecca00ee191d2437", "last_seen_epoch": "1533964545.651017000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964545.651017000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "216.58.194.174", "evidence": [ { "udp_stream": 46, "frame_number": 3212, "display_filter": "frame.number == 3212", "timestamp_epoch": "1533964552.430269000" }, { "udp_stream": 350, "frame_number": 44229, "display_filter": "frame.number == 44229", "timestamp_epoch": "1533965784.476926000" } ], "is_private": false, "observable_id": "observable-a4dd7efb7c9ebe25b9079aef", "last_seen_epoch": "1533965784.476926000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964552.430269000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "216.58.194.182", "evidence": [ { "udp_stream": 71, "frame_number": 5698, "display_filter": "frame.number == 5698", "timestamp_epoch": "1533964558.771373000" } ], "is_private": false, "observable_id": "observable-45ada13018f3c4109461baa5", "last_seen_epoch": "1533964558.771373000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964558.771373000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "216.58.194.202", "evidence": [ { "udp_stream": 30, "frame_number": 611, "display_filter": "frame.number == 611", "timestamp_epoch": "1533964545.651017000" } ], "is_private": false, "observable_id": "observable-680374a0875e411bcf2990fa", "last_seen_epoch": "1533964545.651017000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964545.651017000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "216.58.194.206", "evidence": [ { "udp_stream": 350, "frame_number": 44229, "display_filter": "frame.number == 44229", "timestamp_epoch": "1533965784.476926000" } ], "is_private": false, "observable_id": "observable-15d6908e9ac548ff6395deac", "last_seen_epoch": "1533965784.476926000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965784.476926000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "216.58.194.214", "evidence": [ { "udp_stream": 71, "frame_number": 5698, "display_filter": "frame.number == 5698", "timestamp_epoch": "1533964558.771373000" } ], "is_private": false, "observable_id": "observable-da00669c56cf49ecaa116393", "last_seen_epoch": "1533964558.771373000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964558.771373000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "216.58.195.74", "evidence": [ { "udp_stream": 30, "frame_number": 611, "display_filter": "frame.number == 611", "timestamp_epoch": "1533964545.651017000" } ], "is_private": false, "observable_id": "observable-5f5b2115e9ba8090c8cc4ed0", "last_seen_epoch": "1533964545.651017000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964545.651017000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "216.58.195.78", "evidence": [ { "udp_stream": 46, "frame_number": 3212, "display_filter": "frame.number == 3212", "timestamp_epoch": "1533964552.430269000" }, { "udp_stream": 350, "frame_number": 44229, "display_filter": "frame.number == 44229", "timestamp_epoch": "1533965784.476926000" } ], "is_private": false, "observable_id": "observable-6803328e2d52699b0ab534ab", "last_seen_epoch": "1533965784.476926000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964552.430269000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "216.58.195.86", "evidence": [ { "udp_stream": 71, "frame_number": 5698, "display_filter": "frame.number == 5698", "timestamp_epoch": "1533964558.771373000" } ], "is_private": false, "observable_id": "observable-aee57217c61a4cb0704e6e46", "last_seen_epoch": "1533964558.771373000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964558.771373000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "217.182.126.162", "evidence": [ { "udp_stream": 269, "frame_number": 27577, "display_filter": "frame.number == 27577", "timestamp_epoch": "1533965035.747708000" } ], "is_private": false, "observable_id": "observable-3e9a3a79932cbad5d80eb340", "last_seen_epoch": "1533965035.747708000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965035.747708000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "217.182.126.163", "evidence": [ { "udp_stream": 269, "frame_number": 27577, "display_filter": "frame.number == 27577", "timestamp_epoch": "1533965035.747708000" } ], "is_private": false, "observable_id": "observable-e769dd156852577a2b5fa450", "last_seen_epoch": "1533965035.747708000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965035.747708000" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "224.0.0.22", "evidence": [], "is_private": false, "observable_id": "observable-7737fb76f9db78643e32c73b", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "224.0.0.252", "evidence": [], "is_private": false, "observable_id": "observable-ec6d0755cdfb4300432fa147", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "23.108.108.218", "evidence": [ { "udp_stream": 223, "frame_number": 23086, "display_filter": "frame.number == 23086", "timestamp_epoch": "1533964996.618558000" }, { "udp_stream": 361, "frame_number": 46077, "display_filter": "frame.number == 46077", "timestamp_epoch": "1533965789.700898000" } ], "is_private": false, "observable_id": "observable-582286e9b243895553303f57", "last_seen_epoch": "1533965789.700898000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964996.618558000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "23.108.190.222", "evidence": [ { "udp_stream": 223, "frame_number": 23086, "display_filter": "frame.number == 23086", "timestamp_epoch": "1533964996.618558000" }, { "udp_stream": 361, "frame_number": 46077, "display_filter": "frame.number == 46077", "timestamp_epoch": "1533965789.700898000" } ], "is_private": false, "observable_id": "observable-3149718017233eb5f69636df", "last_seen_epoch": "1533965789.700898000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964996.618558000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "23.108.190.223", "evidence": [ { "udp_stream": 223, "frame_number": 23086, "display_filter": "frame.number == 23086", "timestamp_epoch": "1533964996.618558000" }, { "udp_stream": 361, "frame_number": 46077, "display_filter": "frame.number == 46077", "timestamp_epoch": "1533965789.700898000" } ], "is_private": false, "observable_id": "observable-ad3e87a0b43a3f5a47d57485", "last_seen_epoch": "1533965789.700898000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964996.618558000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "23.20.105.102", "evidence": [ { "udp_stream": 280, "frame_number": 31704, "display_filter": "frame.number == 31704", "timestamp_epoch": "1533965100.817951000" } ], "is_private": false, "observable_id": "observable-eee6428ac61b6b9f71e1afdf", "last_seen_epoch": "1533965100.817951000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965100.817951000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "23.20.36.175", "evidence": [ { "udp_stream": 306, "frame_number": 35556, "display_filter": "frame.number == 35556", "timestamp_epoch": "1533965160.381946000" } ], "is_private": false, "observable_id": "observable-f186b7a30cf188031694b2ce", "last_seen_epoch": "1533965160.381946000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965160.381946000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "23.213.38.151", "evidence": [ { "udp_stream": 149, "frame_number": 14601, "display_filter": "frame.number == 14601", "timestamp_epoch": "1533964904.629602000" } ], "is_private": false, "observable_id": "observable-2fa8d351ff66ba5af50be524", "last_seen_epoch": "1533964904.629602000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964904.629602000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "23.220.174.162", "evidence": [ { "udp_stream": 92, "frame_number": 8147, "display_filter": "frame.number == 8147", "timestamp_epoch": "1533964897.948811000" }, { "udp_stream": 110, "frame_number": 10626, "display_filter": "frame.number == 10626", "timestamp_epoch": "1533964900.625516000" } ], "is_private": false, "observable_id": "observable-bc3ade17457388cce13da436", "last_seen_epoch": "1533964900.625516000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964897.948811000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "23.220.187.187", "evidence": [ { "udp_stream": 136, "frame_number": 12842, "display_filter": "frame.number == 12842", "timestamp_epoch": "1533964902.809158000" }, { "udp_stream": 188, "frame_number": 18210, "display_filter": "frame.number == 18210", "timestamp_epoch": "1533964958.485955000" } ], "is_private": false, "observable_id": "observable-3ea582830ea8d63406aa69d5", "last_seen_epoch": "1533964958.485955000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964902.809158000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "23.23.98.214", "evidence": [ { "udp_stream": 82, "frame_number": 6148, "display_filter": "frame.number == 6148", "timestamp_epoch": "1533964559.906110000" } ], "is_private": false, "observable_id": "observable-fc6e2dc5360928bb233a832c", "last_seen_epoch": "1533964559.906110000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964559.906110000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "23.23.99.70", "evidence": [ { "udp_stream": 82, "frame_number": 6148, "display_filter": "frame.number == 6148", "timestamp_epoch": "1533964559.906110000" } ], "is_private": false, "observable_id": "observable-77d7dca3e61499cc6c45c859", "last_seen_epoch": "1533964559.906110000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964559.906110000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "23.35.180.245", "evidence": [ { "udp_stream": 132, "frame_number": 12260, "display_filter": "frame.number == 12260", "timestamp_epoch": "1533964902.009546000" } ], "is_private": false, "observable_id": "observable-e5585a04b58b30d53a981b24", "last_seen_epoch": "1533964902.009546000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964902.009546000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "23.35.182.113", "evidence": [ { "udp_stream": 147, "frame_number": 13794, "display_filter": "frame.number == 13794", "timestamp_epoch": "1533964903.730026000" } ], "is_private": false, "observable_id": "observable-b3c7a99710a7492fa18da457", "last_seen_epoch": "1533964903.730026000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964903.730026000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "23.43.176.205", "evidence": [ { "udp_stream": 68, "frame_number": 5371, "display_filter": "frame.number == 5371", "timestamp_epoch": "1533964556.454915000" }, { "udp_stream": 67, "frame_number": 5372, "display_filter": "frame.number == 5372", "timestamp_epoch": "1533964556.455020000" } ], "is_private": false, "observable_id": "observable-bb83a84dd868154fe61699c3", "last_seen_epoch": "1533964556.455020000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964556.454915000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "23.54.20.214", "evidence": [ { "udp_stream": 203, "frame_number": 19312, "display_filter": "frame.number == 19312", "timestamp_epoch": "1533964961.782585000" } ], "is_private": false, "observable_id": "observable-211be56b74ee30b8f8416f60", "last_seen_epoch": "1533964961.782585000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964961.782585000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "23.54.20.74", "evidence": [ { "udp_stream": 292, "frame_number": 32847, "display_filter": "frame.number == 32847", "timestamp_epoch": "1533965136.094373000" }, { "udp_stream": 294, "frame_number": 32947, "display_filter": "frame.number == 32947", "timestamp_epoch": "1533965136.618382000" } ], "is_private": false, "observable_id": "observable-158f297ea5924c7ec244ed46", "last_seen_epoch": "1533965136.618382000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965136.094373000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "23.54.21.179", "evidence": [ { "udp_stream": 232, "frame_number": 23638, "display_filter": "frame.number == 23638", "timestamp_epoch": "1533964997.826472000" } ], "is_private": false, "observable_id": "observable-a1b055cb5c4deb7816166334", "last_seen_epoch": "1533964997.826472000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964997.826472000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "23.54.21.180", "evidence": [ { "udp_stream": 164, "frame_number": 15826, "display_filter": "frame.number == 15826", "timestamp_epoch": "1533964907.702394000" } ], "is_private": false, "observable_id": "observable-87e07cf3725235da23ac596b", "last_seen_epoch": "1533964907.702394000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964907.702394000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "23.54.21.240", "evidence": [ { "udp_stream": 291, "frame_number": 32736, "display_filter": "frame.number == 32736", "timestamp_epoch": "1533965135.439362000" } ], "is_private": false, "observable_id": "observable-208a2c6e13a924da61190006", "last_seen_epoch": "1533965135.439362000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965135.439362000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "23.54.22.209", "evidence": [ { "udp_stream": 118, "frame_number": 11285, "display_filter": "frame.number == 11285", "timestamp_epoch": "1533964901.153957000" } ], "is_private": false, "observable_id": "observable-3cee285db96af4511daf173d", "last_seen_epoch": "1533964901.153957000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964901.153957000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "23.54.22.27", "evidence": [ { "udp_stream": 256, "frame_number": 27329, "display_filter": "frame.number == 27329", "timestamp_epoch": "1533965035.426932000" } ], "is_private": false, "observable_id": "observable-d5e7a38406e2a1a2ea95bfb6", "last_seen_epoch": "1533965035.426932000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965035.426932000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "23.54.23.55", "evidence": [ { "udp_stream": 125, "frame_number": 11930, "display_filter": "frame.number == 11930", "timestamp_epoch": "1533964901.698652000" }, { "udp_stream": 133, "frame_number": 12591, "display_filter": "frame.number == 12591", "timestamp_epoch": "1533964902.539371000" } ], "is_private": false, "observable_id": "observable-ac7791c29f543408d156fa2d", "last_seen_epoch": "1533964902.539371000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964901.698652000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "23.55.114.34", "evidence": [ { "udp_stream": 238, "frame_number": 24043, "display_filter": "frame.number == 24043", "timestamp_epoch": "1533964999.497119000" } ], "is_private": false, "observable_id": "observable-ae978053ec67a1e5f71b03ce", "last_seen_epoch": "1533964999.497119000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964999.497119000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "23.55.50.209", "evidence": [ { "udp_stream": 47, "frame_number": 3334, "display_filter": "frame.number == 3334", "timestamp_epoch": "1533964552.716941000" } ], "is_private": false, "observable_id": "observable-50df5609eb44df3b0625c2ae", "last_seen_epoch": "1533964552.716941000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964552.716941000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "23.73.225.194", "evidence": [ { "udp_stream": 108, "frame_number": 9752, "display_filter": "frame.number == 9752", "timestamp_epoch": "1533964899.625132000" } ], "is_private": false, "observable_id": "observable-a1f503b2c8038a6b08868043", "last_seen_epoch": "1533964899.625132000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964899.625132000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "23.73.231.65", "evidence": [ { "udp_stream": 243, "frame_number": 26414, "display_filter": "frame.number == 26414", "timestamp_epoch": "1533965032.677681000" } ], "is_private": false, "observable_id": "observable-243c45a75531b15a532a4334", "last_seen_epoch": "1533965032.677681000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965032.677681000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "23.73.239.75", "evidence": [ { "udp_stream": 114, "frame_number": 10640, "display_filter": "frame.number == 10640", "timestamp_epoch": "1533964900.661382000" }, { "udp_stream": 159, "frame_number": 15053, "display_filter": "frame.number == 15053", "timestamp_epoch": "1533964905.068551000" } ], "is_private": false, "observable_id": "observable-c0bdc0c1e10eb8fcf3bce013", "last_seen_epoch": "1533964905.068551000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964900.661382000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "23.8.170.84", "evidence": [ { "udp_stream": 152, "frame_number": 14656, "display_filter": "frame.number == 14656", "timestamp_epoch": "1533964904.683765000" } ], "is_private": false, "observable_id": "observable-013df11602e2be35975e4821", "last_seen_epoch": "1533964904.683765000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964904.683765000" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "255.255.255.255", "evidence": [], "is_private": true, "observable_id": "observable-b77fd0b8b2bc49363ef7d1ab", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.192.56.110", "evidence": [ { "udp_stream": 259, "frame_number": 27332, "display_filter": "frame.number == 27332", "timestamp_epoch": "1533965035.434545000" } ], "is_private": false, "observable_id": "observable-1741226040b4bc8a2e2d8b63", "last_seen_epoch": "1533965035.434545000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965035.434545000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.193.211.130", "evidence": [ { "udp_stream": 258, "frame_number": 27323, "display_filter": "frame.number == 27323", "timestamp_epoch": "1533965035.406624000" } ], "is_private": false, "observable_id": "observable-16e300586a954f0d55d8a741", "last_seen_epoch": "1533965035.406624000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965035.406624000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.193.227.152", "evidence": [ { "udp_stream": 240, "frame_number": 24040, "display_filter": "frame.number == 24040", "timestamp_epoch": "1533964999.467395000" } ], "is_private": false, "observable_id": "observable-5d176b047a8a673c7633bf16", "last_seen_epoch": "1533964999.467395000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964999.467395000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.193.232.33", "evidence": [ { "udp_stream": 190, "frame_number": 18568, "display_filter": "frame.number == 18568", "timestamp_epoch": "1533964959.365164000" } ], "is_private": false, "observable_id": "observable-cb3e79699a3484eb4824cd9d", "last_seen_epoch": "1533964959.365164000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964959.365164000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.194.151.202", "evidence": [ { "udp_stream": 258, "frame_number": 27323, "display_filter": "frame.number == 27323", "timestamp_epoch": "1533965035.406624000" } ], "is_private": false, "observable_id": "observable-7a059689fef519c6a6aa3e5b", "last_seen_epoch": "1533965035.406624000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965035.406624000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "34.194.201.62", "evidence": [ { "udp_stream": 148, "frame_number": 14376, "display_filter": "frame.number == 14376", "timestamp_epoch": "1533964904.333194000" } ], "is_private": false, "observable_id": "observable-2f956a2c12a37628b24ac5fe", "last_seen_epoch": "1533964904.333194000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964904.333194000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.194.88.13", "evidence": [ { "udp_stream": 259, "frame_number": 27332, "display_filter": "frame.number == 27332", "timestamp_epoch": "1533965035.434545000" } ], "is_private": false, "observable_id": "observable-acdc84e3da63ae5385dd3ef1", "last_seen_epoch": "1533965035.434545000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965035.434545000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.195.63.41", "evidence": [ { "udp_stream": 248, "frame_number": 26728, "display_filter": "frame.number == 26728", "timestamp_epoch": "1533965033.481510000" }, { "udp_stream": 254, "frame_number": 27021, "display_filter": "frame.number == 27021", "timestamp_epoch": "1533965034.135661000" } ], "is_private": false, "observable_id": "observable-105e2fa8dfb8274705bf3a9a", "last_seen_epoch": "1533965034.135661000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965033.481510000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.196.110.17", "evidence": [ { "udp_stream": 234, "frame_number": 23623, "display_filter": "frame.number == 23623", "timestamp_epoch": "1533964997.803829000" } ], "is_private": false, "observable_id": "observable-933118c6288ddd65ab778f24", "last_seen_epoch": "1533964997.803829000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964997.803829000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.196.181.242", "evidence": [ { "udp_stream": 266, "frame_number": 27558, "display_filter": "frame.number == 27558", "timestamp_epoch": "1533965035.720501000" } ], "is_private": false, "observable_id": "observable-f8cc7715823cc6636715a1ad", "last_seen_epoch": "1533965035.720501000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965035.720501000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.196.187.76", "evidence": [ { "udp_stream": 234, "frame_number": 23623, "display_filter": "frame.number == 23623", "timestamp_epoch": "1533964997.803829000" } ], "is_private": false, "observable_id": "observable-2046bfab9e1d8cec3c548cf2", "last_seen_epoch": "1533964997.803829000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964997.803829000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.197.131.250", "evidence": [ { "udp_stream": 205, "frame_number": 19619, "display_filter": "frame.number == 19619", "timestamp_epoch": "1533964962.605621000" } ], "is_private": false, "observable_id": "observable-64b5d4e850af2c302a5bf075", "last_seen_epoch": "1533964962.605621000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964962.605621000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "34.198.191.149", "evidence": [ { "udp_stream": 266, "frame_number": 27558, "display_filter": "frame.number == 27558", "timestamp_epoch": "1533965035.720501000" } ], "is_private": false, "observable_id": "observable-668c8f7f027f8719147d3bca", "last_seen_epoch": "1533965035.720501000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965035.720501000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.198.228.49", "evidence": [ { "udp_stream": 266, "frame_number": 27558, "display_filter": "frame.number == 27558", "timestamp_epoch": "1533965035.720501000" } ], "is_private": false, "observable_id": "observable-bab5a540c09849506cb83ac0", "last_seen_epoch": "1533965035.720501000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965035.720501000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.199.147.44", "evidence": [ { "udp_stream": 248, "frame_number": 26728, "display_filter": "frame.number == 26728", "timestamp_epoch": "1533965033.481510000" }, { "udp_stream": 254, "frame_number": 27021, "display_filter": "frame.number == 27021", "timestamp_epoch": "1533965034.135661000" } ], "is_private": false, "observable_id": "observable-94e3ffe36b839fac2ecdee8b", "last_seen_epoch": "1533965034.135661000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965033.481510000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.201.202.206", "evidence": [ { "udp_stream": 179, "frame_number": 17349, "display_filter": "frame.number == 17349", "timestamp_epoch": "1533964956.315471000" }, { "udp_stream": 182, "frame_number": 17855, "display_filter": "frame.number == 17855", "timestamp_epoch": "1533964957.358759000" } ], "is_private": false, "observable_id": "observable-31c789c5c8aaa86562493304", "last_seen_epoch": "1533964957.358759000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964956.315471000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.205.99.3", "evidence": [ { "udp_stream": 266, "frame_number": 27558, "display_filter": "frame.number == 27558", "timestamp_epoch": "1533965035.720501000" } ], "is_private": false, "observable_id": "observable-a43c150d4d4623e003e8a752", "last_seen_epoch": "1533965035.720501000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965035.720501000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.206.197.3", "evidence": [ { "udp_stream": 306, "frame_number": 35556, "display_filter": "frame.number == 35556", "timestamp_epoch": "1533965160.381946000" } ], "is_private": false, "observable_id": "observable-3066dbc8eb329299cbd4ca2c", "last_seen_epoch": "1533965160.381946000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965160.381946000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.206.215.186", "evidence": [ { "udp_stream": 234, "frame_number": 23623, "display_filter": "frame.number == 23623", "timestamp_epoch": "1533964997.803829000" } ], "is_private": false, "observable_id": "observable-f4ece3622c08a31a0d0d0964", "last_seen_epoch": "1533964997.803829000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964997.803829000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "34.207.5.71", "evidence": [ { "udp_stream": 190, "frame_number": 18568, "display_filter": "frame.number == 18568", "timestamp_epoch": "1533964959.365164000" } ], "is_private": false, "observable_id": "observable-6bddecb1968cc4f6c651eb28", "last_seen_epoch": "1533964959.365164000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964959.365164000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.208.13.206", "evidence": [ { "udp_stream": 65, "frame_number": 5141, "display_filter": "frame.number == 5141", "timestamp_epoch": "1533964556.025527000" } ], "is_private": false, "observable_id": "observable-e0c0f402d1c99fba08d2e5c1", "last_seen_epoch": "1533964556.025527000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964556.025527000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.208.25.6", "evidence": [ { "udp_stream": 290, "frame_number": 32701, "display_filter": "frame.number == 32701", "timestamp_epoch": "1533965134.862529000" } ], "is_private": false, "observable_id": "observable-924195c86da4f2d607d42b23", "last_seen_epoch": "1533965134.862529000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965134.862529000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.208.49.173", "evidence": [ { "udp_stream": 150, "frame_number": 14614, "display_filter": "frame.number == 14614", "timestamp_epoch": "1533964904.637907000" } ], "is_private": false, "observable_id": "observable-ac1edb1d279d97c47152884e", "last_seen_epoch": "1533964904.637907000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964904.637907000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.209.105.94", "evidence": [ { "udp_stream": 222, "frame_number": 23033, "display_filter": "frame.number == 23033", "timestamp_epoch": "1533964996.474799000" } ], "is_private": false, "observable_id": "observable-4c57383480dd0877f0efba56", "last_seen_epoch": "1533964996.474799000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964996.474799000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.210.171.204", "evidence": [ { "udp_stream": 181, "frame_number": 17890, "display_filter": "frame.number == 17890", "timestamp_epoch": "1533964957.470463000" } ], "is_private": false, "observable_id": "observable-3f0b2f5098a5effc04908b10", "last_seen_epoch": "1533964957.470463000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964957.470463000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.210.7.129", "evidence": [ { "udp_stream": 145, "frame_number": 13562, "display_filter": "frame.number == 13562", "timestamp_epoch": "1533964903.558314000" } ], "is_private": false, "observable_id": "observable-e087d1e00e1072416979dee7", "last_seen_epoch": "1533964903.558314000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964903.558314000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.211.210.144", "evidence": [ { "udp_stream": 98, "frame_number": 8958, "display_filter": "frame.number == 8958", "timestamp_epoch": "1533964898.930359000" }, { "udp_stream": 231, "frame_number": 23599, "display_filter": "frame.number == 23599", "timestamp_epoch": "1533964997.757167000" } ], "is_private": false, "observable_id": "observable-74e4414e299ddcb4d0100a39", "last_seen_epoch": "1533964997.757167000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964898.930359000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "34.211.69.152", "evidence": [ { "udp_stream": 145, "frame_number": 13562, "display_filter": "frame.number == 13562", "timestamp_epoch": "1533964903.558314000" }, { "udp_stream": 155, "frame_number": 14641, "display_filter": "frame.number == 14641", "timestamp_epoch": "1533964904.664048000" } ], "is_private": false, "observable_id": "observable-74bde356b3cdc36e3cdee3ed", "last_seen_epoch": "1533964904.664048000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964903.558314000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.212.197.102", "evidence": [ { "udp_stream": 199, "frame_number": 19231, "display_filter": "frame.number == 19231", "timestamp_epoch": "1533964961.387623000" } ], "is_private": false, "observable_id": "observable-ca399ab4e4cb1ed1f0e5ab2b", "last_seen_epoch": "1533964961.387623000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964961.387623000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.212.77.105", "evidence": [ { "udp_stream": 185, "frame_number": 18200, "display_filter": "frame.number == 18200", "timestamp_epoch": "1533964958.477773000" } ], "is_private": false, "observable_id": "observable-4a86dd187eb4fc8594ada98f", "last_seen_epoch": "1533964958.477773000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964958.477773000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "34.213.12.32", "evidence": [ { "udp_stream": 199, "frame_number": 19231, "display_filter": "frame.number == 19231", "timestamp_epoch": "1533964961.387623000" } ], "is_private": false, "observable_id": "observable-5e405cc774d9b65313d73c6a", "last_seen_epoch": "1533964961.387623000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964961.387623000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.213.2.162", "evidence": [ { "udp_stream": 156, "frame_number": 14613, "display_filter": "frame.number == 14613", "timestamp_epoch": "1533964904.637787000" } ], "is_private": false, "observable_id": "observable-bf4a5491d26cf3183390bf8b", "last_seen_epoch": "1533964904.637787000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964904.637787000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.213.219.1", "evidence": [ { "udp_stream": 199, "frame_number": 19231, "display_filter": "frame.number == 19231", "timestamp_epoch": "1533964961.387623000" } ], "is_private": false, "observable_id": "observable-c45c7917a2a1c350f082dbf0", "last_seen_epoch": "1533964961.387623000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964961.387623000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.213.95.197", "evidence": [ { "udp_stream": 145, "frame_number": 13562, "display_filter": "frame.number == 13562", "timestamp_epoch": "1533964903.558314000" }, { "udp_stream": 155, "frame_number": 14641, "display_filter": "frame.number == 14641", "timestamp_epoch": "1533964904.664048000" } ], "is_private": false, "observable_id": "observable-ce8988b21d0be84d92604081", "last_seen_epoch": "1533964904.664048000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964903.558314000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.214.108.62", "evidence": [ { "udp_stream": 199, "frame_number": 19231, "display_filter": "frame.number == 19231", "timestamp_epoch": "1533964961.387623000" } ], "is_private": false, "observable_id": "observable-fb6edd1a256f471751cfd10a", "last_seen_epoch": "1533964961.387623000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964961.387623000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.215.18.221", "evidence": [ { "udp_stream": 98, "frame_number": 8958, "display_filter": "frame.number == 8958", "timestamp_epoch": "1533964898.930359000" }, { "udp_stream": 231, "frame_number": 23599, "display_filter": "frame.number == 23599", "timestamp_epoch": "1533964997.757167000" } ], "is_private": false, "observable_id": "observable-ec23b353057e65c523fa7bde", "last_seen_epoch": "1533964997.757167000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964898.930359000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.216.116.50", "evidence": [ { "udp_stream": 199, "frame_number": 19231, "display_filter": "frame.number == 19231", "timestamp_epoch": "1533964961.387623000" } ], "is_private": false, "observable_id": "observable-44c02e8992a6e6a8da7cf08e", "last_seen_epoch": "1533964961.387623000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964961.387623000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.224.45.36", "evidence": [ { "udp_stream": 300, "frame_number": 33970, "display_filter": "frame.number == 33970", "timestamp_epoch": "1533965157.910445000" } ], "is_private": false, "observable_id": "observable-634801e7f3c65b135eaecb54", "last_seen_epoch": "1533965157.910445000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965157.910445000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.226.161.213", "evidence": [ { "udp_stream": 300, "frame_number": 33970, "display_filter": "frame.number == 33970", "timestamp_epoch": "1533965157.910445000" } ], "is_private": false, "observable_id": "observable-d715cc8dd48ff75ccf5315c6", "last_seen_epoch": "1533965157.910445000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965157.910445000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.226.179.16", "evidence": [ { "udp_stream": 179, "frame_number": 17349, "display_filter": "frame.number == 17349", "timestamp_epoch": "1533964956.315471000" }, { "udp_stream": 182, "frame_number": 17855, "display_filter": "frame.number == 17855", "timestamp_epoch": "1533964957.358759000" } ], "is_private": false, "observable_id": "observable-4aece5924689c6d1796e0535", "last_seen_epoch": "1533964957.358759000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964956.315471000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.226.50.209", "evidence": [ { "udp_stream": 300, "frame_number": 33970, "display_filter": "frame.number == 33970", "timestamp_epoch": "1533965157.910445000" } ], "is_private": false, "observable_id": "observable-416eb66db9b18c0866c52cc1", "last_seen_epoch": "1533965157.910445000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965157.910445000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.231.203.163", "evidence": [ { "udp_stream": 248, "frame_number": 26728, "display_filter": "frame.number == 26728", "timestamp_epoch": "1533965033.481510000" }, { "udp_stream": 254, "frame_number": 27021, "display_filter": "frame.number == 27021", "timestamp_epoch": "1533965034.135661000" } ], "is_private": false, "observable_id": "observable-b6841e1df1f13331988142cf", "last_seen_epoch": "1533965034.135661000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965033.481510000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.233.214.90", "evidence": [ { "udp_stream": 258, "frame_number": 27323, "display_filter": "frame.number == 27323", "timestamp_epoch": "1533965035.406624000" } ], "is_private": false, "observable_id": "observable-8c2a67b9372e637e1e79766b", "last_seen_epoch": "1533965035.406624000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965035.406624000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.233.6.212", "evidence": [ { "udp_stream": 190, "frame_number": 18568, "display_filter": "frame.number == 18568", "timestamp_epoch": "1533964959.365164000" } ], "is_private": false, "observable_id": "observable-667e9f86abee671bf0a3fc5f", "last_seen_epoch": "1533964959.365164000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964959.365164000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.234.134.91", "evidence": [ { "udp_stream": 273, "frame_number": 30652, "display_filter": "frame.number == 30652", "timestamp_epoch": "1533965099.045919000" } ], "is_private": false, "observable_id": "observable-087936c2a9d7dad867139713", "last_seen_epoch": "1533965099.045919000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965099.045919000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "34.234.149.11", "evidence": [ { "udp_stream": 273, "frame_number": 30652, "display_filter": "frame.number == 30652", "timestamp_epoch": "1533965099.045919000" } ], "is_private": false, "observable_id": "observable-97f4233851dc0e5d1c9eb795", "last_seen_epoch": "1533965099.045919000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965099.045919000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.235.5.53", "evidence": [ { "udp_stream": 300, "frame_number": 33970, "display_filter": "frame.number == 33970", "timestamp_epoch": "1533965157.910445000" } ], "is_private": false, "observable_id": "observable-335d1f62f4b9990605498358", "last_seen_epoch": "1533965157.910445000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965157.910445000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.235.70.251", "evidence": [ { "udp_stream": 280, "frame_number": 31704, "display_filter": "frame.number == 31704", "timestamp_epoch": "1533965100.817951000" } ], "is_private": false, "observable_id": "observable-19ccb2245a6b68c638ad3a65", "last_seen_epoch": "1533965100.817951000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965100.817951000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "34.236.123.105", "evidence": [ { "udp_stream": 258, "frame_number": 27323, "display_filter": "frame.number == 27323", "timestamp_epoch": "1533965035.406624000" } ], "is_private": false, "observable_id": "observable-fcf2a0e27cf43820bd2fb734", "last_seen_epoch": "1533965035.406624000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965035.406624000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "34.236.230.194", "evidence": [ { "udp_stream": 248, "frame_number": 26728, "display_filter": "frame.number == 26728", "timestamp_epoch": "1533965033.481510000" }, { "udp_stream": 254, "frame_number": 27021, "display_filter": "frame.number == 27021", "timestamp_epoch": "1533965034.135661000" } ], "is_private": false, "observable_id": "observable-438321f28f2a6b6f753c3eec", "last_seen_epoch": "1533965034.135661000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965033.481510000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.236.75.36", "evidence": [ { "udp_stream": 306, "frame_number": 35556, "display_filter": "frame.number == 35556", "timestamp_epoch": "1533965160.381946000" } ], "is_private": false, "observable_id": "observable-1d815dbf2b97ace4b839aab4", "last_seen_epoch": "1533965160.381946000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965160.381946000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.237.159.145", "evidence": [ { "udp_stream": 266, "frame_number": 27558, "display_filter": "frame.number == 27558", "timestamp_epoch": "1533965035.720501000" } ], "is_private": false, "observable_id": "observable-2b911f856af2ff50cba4bac2", "last_seen_epoch": "1533965035.720501000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965035.720501000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "34.237.234.13", "evidence": [ { "udp_stream": 205, "frame_number": 19619, "display_filter": "frame.number == 19619", "timestamp_epoch": "1533964962.605621000" } ], "is_private": false, "observable_id": "observable-71d496e51dc8f502bf8c8730", "last_seen_epoch": "1533964962.605621000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964962.605621000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.239.209.246", "evidence": [ { "udp_stream": 300, "frame_number": 33970, "display_filter": "frame.number == 33970", "timestamp_epoch": "1533965157.910445000" } ], "is_private": false, "observable_id": "observable-98c494718554b6b27ea8b4a4", "last_seen_epoch": "1533965157.910445000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965157.910445000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.239.239.138", "evidence": [ { "udp_stream": 280, "frame_number": 31704, "display_filter": "frame.number == 31704", "timestamp_epoch": "1533965100.817951000" } ], "is_private": false, "observable_id": "observable-cc00cda2fb396ab1294707c6", "last_seen_epoch": "1533965100.817951000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965100.817951000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.246.164.247", "evidence": [ { "udp_stream": 305, "frame_number": 35537, "display_filter": "frame.number == 35537", "timestamp_epoch": "1533965160.370309000" } ], "is_private": false, "observable_id": "observable-85f0ec52dfe58997632e49ff", "last_seen_epoch": "1533965160.370309000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965160.370309000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "34.246.244.104", "evidence": [ { "udp_stream": 73, "frame_number": 5860, "display_filter": "frame.number == 5860", "timestamp_epoch": "1533964559.445991000" } ], "is_private": false, "observable_id": "observable-00aa0ed8bca45ec6b0f8aa05", "last_seen_epoch": "1533964559.445991000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964559.445991000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.246.74.216", "evidence": [ { "udp_stream": 305, "frame_number": 35537, "display_filter": "frame.number == 35537", "timestamp_epoch": "1533965160.370309000" } ], "is_private": false, "observable_id": "observable-cdbc2513b250ba0e98c5331d", "last_seen_epoch": "1533965160.370309000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965160.370309000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.247.143.160", "evidence": [ { "udp_stream": 173, "frame_number": 16524, "display_filter": "frame.number == 16524", "timestamp_epoch": "1533964909.718959000" } ], "is_private": false, "observable_id": "observable-1cffd7318b77e6e5b7fd5eef", "last_seen_epoch": "1533964909.718959000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964909.718959000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.248.66.236", "evidence": [ { "udp_stream": 173, "frame_number": 16524, "display_filter": "frame.number == 16524", "timestamp_epoch": "1533964909.718959000" } ], "is_private": false, "observable_id": "observable-9b15f8e84bb6f5e5d5eb0b6e", "last_seen_epoch": "1533964909.718959000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964909.718959000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.251.231.74", "evidence": [ { "udp_stream": 173, "frame_number": 16524, "display_filter": "frame.number == 16524", "timestamp_epoch": "1533964909.718959000" } ], "is_private": false, "observable_id": "observable-f7280335e231793c80212a79", "last_seen_epoch": "1533964909.718959000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964909.718959000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "35.160.145.246", "evidence": [ { "udp_stream": 181, "frame_number": 17890, "display_filter": "frame.number == 17890", "timestamp_epoch": "1533964957.470463000" } ], "is_private": false, "observable_id": "observable-074c8941fdb17ee18915d315", "last_seen_epoch": "1533964957.470463000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964957.470463000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "35.160.44.27", "evidence": [ { "udp_stream": 199, "frame_number": 19231, "display_filter": "frame.number == 19231", "timestamp_epoch": "1533964961.387623000" } ], "is_private": false, "observable_id": "observable-e00e153bf1eeb0ba770eeed1", "last_seen_epoch": "1533964961.387623000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964961.387623000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "35.160.46.147", "evidence": [ { "udp_stream": 199, "frame_number": 19231, "display_filter": "frame.number == 19231", "timestamp_epoch": "1533964961.387623000" } ], "is_private": false, "observable_id": "observable-59489f42b5c98e126c038480", "last_seen_epoch": "1533964961.387623000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964961.387623000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "35.160.51.142", "evidence": [ { "udp_stream": 145, "frame_number": 13562, "display_filter": "frame.number == 13562", "timestamp_epoch": "1533964903.558314000" }, { "udp_stream": 155, "frame_number": 14641, "display_filter": "frame.number == 14641", "timestamp_epoch": "1533964904.664048000" } ], "is_private": false, "observable_id": "observable-a85016df8437ec33799649d9", "last_seen_epoch": "1533964904.664048000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964903.558314000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "35.161.139.221", "evidence": [ { "udp_stream": 199, "frame_number": 19231, "display_filter": "frame.number == 19231", "timestamp_epoch": "1533964961.387623000" } ], "is_private": false, "observable_id": "observable-b1464ca324230850fa0247b5", "last_seen_epoch": "1533964961.387623000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964961.387623000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "35.161.228.236", "evidence": [ { "udp_stream": 181, "frame_number": 17890, "display_filter": "frame.number == 17890", "timestamp_epoch": "1533964957.470463000" } ], "is_private": false, "observable_id": "observable-40677e12c292bbe3c2d73fc7", "last_seen_epoch": "1533964957.470463000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964957.470463000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "35.162.109.147", "evidence": [ { "udp_stream": 222, "frame_number": 23033, "display_filter": "frame.number == 23033", "timestamp_epoch": "1533964996.474799000" } ], "is_private": false, "observable_id": "observable-6e879c2fe0d1000a4182e330", "last_seen_epoch": "1533964996.474799000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964996.474799000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "35.162.194.159", "evidence": [ { "udp_stream": 150, "frame_number": 14614, "display_filter": "frame.number == 14614", "timestamp_epoch": "1533964904.637907000" } ], "is_private": false, "observable_id": "observable-cf1276deebd21a5ab25e7860", "last_seen_epoch": "1533964904.637907000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964904.637907000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "35.163.160.113", "evidence": [ { "udp_stream": 181, "frame_number": 17890, "display_filter": "frame.number == 17890", "timestamp_epoch": "1533964957.470463000" } ], "is_private": false, "observable_id": "observable-ba32264fce0ca768c69f8ccf", "last_seen_epoch": "1533964957.470463000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964957.470463000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "35.164.101.53", "evidence": [ { "udp_stream": 181, "frame_number": 17890, "display_filter": "frame.number == 17890", "timestamp_epoch": "1533964957.470463000" } ], "is_private": false, "observable_id": "observable-d864fe61a2c3adbe7efc90a5", "last_seen_epoch": "1533964957.470463000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964957.470463000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "35.164.209.30", "evidence": [ { "udp_stream": 145, "frame_number": 13562, "display_filter": "frame.number == 13562", "timestamp_epoch": "1533964903.558314000" }, { "udp_stream": 155, "frame_number": 14641, "display_filter": "frame.number == 14641", "timestamp_epoch": "1533964904.664048000" } ], "is_private": false, "observable_id": "observable-68610d9c9b7c67f355ff2b87", "last_seen_epoch": "1533964904.664048000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964903.558314000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "35.164.52.21", "evidence": [ { "udp_stream": 181, "frame_number": 17890, "display_filter": "frame.number == 17890", "timestamp_epoch": "1533964957.470463000" } ], "is_private": false, "observable_id": "observable-9456c528ae852398161ed5c0", "last_seen_epoch": "1533964957.470463000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964957.470463000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "35.165.34.205", "evidence": [ { "udp_stream": 145, "frame_number": 13562, "display_filter": "frame.number == 13562", "timestamp_epoch": "1533964903.558314000" }, { "udp_stream": 155, "frame_number": 14641, "display_filter": "frame.number == 14641", "timestamp_epoch": "1533964904.664048000" } ], "is_private": false, "observable_id": "observable-8d832c3ace1393b7d9a2e619", "last_seen_epoch": "1533964904.664048000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964903.558314000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "35.166.4.4", "evidence": [ { "udp_stream": 290, "frame_number": 32701, "display_filter": "frame.number == 32701", "timestamp_epoch": "1533965134.862529000" } ], "is_private": false, "observable_id": "observable-aee0223ec68332c194d14015", "last_seen_epoch": "1533965134.862529000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965134.862529000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "35.168.109.209", "evidence": [ { "udp_stream": 258, "frame_number": 27323, "display_filter": "frame.number == 27323", "timestamp_epoch": "1533965035.406624000" } ], "is_private": false, "observable_id": "observable-70e8b0651079c30048014568", "last_seen_epoch": "1533965035.406624000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965035.406624000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "35.169.19.220", "evidence": [ { "udp_stream": 190, "frame_number": 18568, "display_filter": "frame.number == 18568", "timestamp_epoch": "1533964959.365164000" } ], "is_private": false, "observable_id": "observable-252e8f41151ee9b9ca1a86fc", "last_seen_epoch": "1533964959.365164000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964959.365164000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "35.169.196.58", "evidence": [ { "udp_stream": 117, "frame_number": 11114, "display_filter": "frame.number == 11114", "timestamp_epoch": "1533964901.056360000" } ], "is_private": false, "observable_id": "observable-9e61a302989b39757a2fe5e6", "last_seen_epoch": "1533964901.056360000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964901.056360000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "35.169.72.130", "evidence": [ { "udp_stream": 300, "frame_number": 33970, "display_filter": "frame.number == 33970", "timestamp_epoch": "1533965157.910445000" } ], "is_private": false, "observable_id": "observable-34afb266f9a3013a70ae302f", "last_seen_epoch": "1533965157.910445000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965157.910445000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "35.171.120.51", "evidence": [ { "udp_stream": 259, "frame_number": 27332, "display_filter": "frame.number == 27332", "timestamp_epoch": "1533965035.434545000" } ], "is_private": false, "observable_id": "observable-34095736b5dfd674ce23436f", "last_seen_epoch": "1533965035.434545000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965035.434545000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "35.171.141.177", "evidence": [ { "udp_stream": 179, "frame_number": 17349, "display_filter": "frame.number == 17349", "timestamp_epoch": "1533964956.315471000" }, { "udp_stream": 182, "frame_number": 17855, "display_filter": "frame.number == 17855", "timestamp_epoch": "1533964957.358759000" } ], "is_private": false, "observable_id": "observable-39d7f9d835f3eb3078953db9", "last_seen_epoch": "1533964957.358759000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964956.315471000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "35.185.199.249", "evidence": [ { "udp_stream": 99, "frame_number": 8979, "display_filter": "frame.number == 8979", "timestamp_epoch": "1533964898.946941000" } ], "is_private": false, "observable_id": "observable-f53e5d9b7de8a706cdb9b803", "last_seen_epoch": "1533964898.946941000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964898.946941000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "35.185.211.128", "evidence": [ { "udp_stream": 99, "frame_number": 8979, "display_filter": "frame.number == 8979", "timestamp_epoch": "1533964898.946941000" } ], "is_private": false, "observable_id": "observable-76b3383e73ae96315a5b403d", "last_seen_epoch": "1533964898.946941000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964898.946941000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "35.185.219.146", "evidence": [ { "udp_stream": 99, "frame_number": 8979, "display_filter": "frame.number == 8979", "timestamp_epoch": "1533964898.946941000" } ], "is_private": false, "observable_id": "observable-07df4427156a4b9bec3a987b", "last_seen_epoch": "1533964898.946941000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964898.946941000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "35.185.232.105", "evidence": [ { "udp_stream": 99, "frame_number": 8979, "display_filter": "frame.number == 8979", "timestamp_epoch": "1533964898.946941000" } ], "is_private": false, "observable_id": "observable-1f9a89c96157cd66e41d64de", "last_seen_epoch": "1533964898.946941000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964898.946941000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "35.185.241.45", "evidence": [ { "udp_stream": 99, "frame_number": 8979, "display_filter": "frame.number == 8979", "timestamp_epoch": "1533964898.946941000" } ], "is_private": false, "observable_id": "observable-aae220ff0c13b18a77427581", "last_seen_epoch": "1533964898.946941000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964898.946941000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "35.185.244.37", "evidence": [ { "udp_stream": 99, "frame_number": 8979, "display_filter": "frame.number == 8979", "timestamp_epoch": "1533964898.946941000" } ], "is_private": false, "observable_id": "observable-1eb9063d31b45d713108ca1d", "last_seen_epoch": "1533964898.946941000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964898.946941000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "35.185.245.217", "evidence": [ { "udp_stream": 99, "frame_number": 8979, "display_filter": "frame.number == 8979", "timestamp_epoch": "1533964898.946941000" } ], "is_private": false, "observable_id": "observable-86cf2e9f3d9dbeb205105b37", "last_seen_epoch": "1533964898.946941000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964898.946941000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "35.185.250.254", "evidence": [ { "udp_stream": 99, "frame_number": 8979, "display_filter": "frame.number == 8979", "timestamp_epoch": "1533964898.946941000" } ], "is_private": false, "observable_id": "observable-76ab575c9b15c4b34d3bc0e9", "last_seen_epoch": "1533964898.946941000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964898.946941000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "35.185.251.80", "evidence": [ { "udp_stream": 99, "frame_number": 8979, "display_filter": "frame.number == 8979", "timestamp_epoch": "1533964898.946941000" } ], "is_private": false, "observable_id": "observable-19074ef722769ecb53676603", "last_seen_epoch": "1533964898.946941000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964898.946941000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "35.186.202.217", "evidence": [ { "udp_stream": 263, "frame_number": 27526, "display_filter": "frame.number == 27526", "timestamp_epoch": "1533965035.690931000" } ], "is_private": false, "observable_id": "observable-2e213667bf2722b4728a6de7", "last_seen_epoch": "1533965035.690931000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965035.690931000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "35.186.208.100", "evidence": [ { "udp_stream": 109, "frame_number": 10021, "display_filter": "frame.number == 10021", "timestamp_epoch": "1533964899.857368000" } ], "is_private": false, "observable_id": "observable-5ebba28d009fb48bc50441d9", "last_seen_epoch": "1533964899.857368000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964899.857368000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "35.186.239.238", "evidence": [ { "udp_stream": 299, "frame_number": 33923, "display_filter": "frame.number == 33923", "timestamp_epoch": "1533965157.846245000" } ], "is_private": false, "observable_id": "observable-8695223ef6b5a72b99890967", "last_seen_epoch": "1533965157.846245000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965157.846245000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "35.190.74.53", "evidence": [ { "udp_stream": 251, "frame_number": 26729, "display_filter": "frame.number == 26729", "timestamp_epoch": "1533965033.481704000" } ], "is_private": false, "observable_id": "observable-518b0bacfbcde3f15cddabff", "last_seen_epoch": "1533965033.481704000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965033.481704000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "35.190.91.160", "evidence": [ { "udp_stream": 220, "frame_number": 20725, "display_filter": "frame.number == 20725", "timestamp_epoch": "1533964966.306264000" } ], "is_private": false, "observable_id": "observable-5c4c15fc4aa9ffeb15b63583", "last_seen_epoch": "1533964966.306264000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964966.306264000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "35.201.123.46", "evidence": [ { "udp_stream": 302, "frame_number": 35521, "display_filter": "frame.number == 35521", "timestamp_epoch": "1533965160.354413000" } ], "is_private": false, "observable_id": "observable-496226d13929c138dedd6d6f", "last_seen_epoch": "1533965160.354413000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965160.354413000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "35.227.197.177", "evidence": [ { "udp_stream": 211, "frame_number": 20032, "display_filter": "frame.number == 20032", "timestamp_epoch": "1533964964.154372000" } ], "is_private": false, "observable_id": "observable-dda6da9158530dfa5d6000fd", "last_seen_epoch": "1533964964.154372000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964964.154372000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "37.157.2.234", "evidence": [ { "udp_stream": 235, "frame_number": 23649, "display_filter": "frame.number == 23649", "timestamp_epoch": "1533964997.831687000" } ], "is_private": false, "observable_id": "observable-7ed394a44425bfe35575b7f1", "last_seen_epoch": "1533964997.831687000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964997.831687000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "37.157.4.39", "evidence": [ { "udp_stream": 235, "frame_number": 23649, "display_filter": "frame.number == 23649", "timestamp_epoch": "1533964997.831687000" } ], "is_private": false, "observable_id": "observable-56739ebd4b99ee2484d600c8", "last_seen_epoch": "1533964997.831687000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964997.831687000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "37.157.4.40", "evidence": [ { "udp_stream": 235, "frame_number": 23649, "display_filter": "frame.number == 23649", "timestamp_epoch": "1533964997.831687000" } ], "is_private": false, "observable_id": "observable-01ba4b1dae3691498679407e", "last_seen_epoch": "1533964997.831687000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964997.831687000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "37.157.6.245", "evidence": [ { "udp_stream": 235, "frame_number": 23649, "display_filter": "frame.number == 23649", "timestamp_epoch": "1533964997.831687000" } ], "is_private": false, "observable_id": "observable-d9702c1b04d698dfe28062a2", "last_seen_epoch": "1533964997.831687000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964997.831687000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "37.157.6.251", "evidence": [ { "udp_stream": 235, "frame_number": 23649, "display_filter": "frame.number == 23649", "timestamp_epoch": "1533964997.831687000" } ], "is_private": false, "observable_id": "observable-be4ab9db58c2ee7ea06a2238", "last_seen_epoch": "1533964997.831687000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964997.831687000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "38.106.10.132", "evidence": [ { "udp_stream": 268, "frame_number": 27576, "display_filter": "frame.number == 27576", "timestamp_epoch": "1533965035.747687000" } ], "is_private": false, "observable_id": "observable-58799499cf5cd9711b558cfe", "last_seen_epoch": "1533965035.747687000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965035.747687000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "38.106.34.104", "evidence": [ { "udp_stream": 257, "frame_number": 27357, "display_filter": "frame.number == 27357", "timestamp_epoch": "1533965035.496495000" } ], "is_private": false, "observable_id": "observable-148f36b505180a8ff442f845", "last_seen_epoch": "1533965035.496495000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965035.496495000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "38.106.34.105", "evidence": [ { "udp_stream": 257, "frame_number": 27357, "display_filter": "frame.number == 27357", "timestamp_epoch": "1533965035.496495000" } ], "is_private": false, "observable_id": "observable-21365f259a05880c826f8ac6", "last_seen_epoch": "1533965035.496495000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965035.496495000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "38.106.34.125", "evidence": [ { "udp_stream": 257, "frame_number": 27357, "display_filter": "frame.number == 27357", "timestamp_epoch": "1533965035.496495000" } ], "is_private": false, "observable_id": "observable-2f7e0eb8495b5b5874bc8f8c", "last_seen_epoch": "1533965035.496495000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965035.496495000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "38.106.34.142", "evidence": [ { "udp_stream": 257, "frame_number": 27357, "display_filter": "frame.number == 27357", "timestamp_epoch": "1533965035.496495000" } ], "is_private": false, "observable_id": "observable-0f44f762586edde9e6326439", "last_seen_epoch": "1533965035.496495000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965035.496495000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "38.106.34.155", "evidence": [ { "udp_stream": 257, "frame_number": 27357, "display_filter": "frame.number == 27357", "timestamp_epoch": "1533965035.496495000" } ], "is_private": false, "observable_id": "observable-1672a1c90df4cccff1816bf5", "last_seen_epoch": "1533965035.496495000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965035.496495000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "38.106.34.160", "evidence": [ { "udp_stream": 257, "frame_number": 27357, "display_filter": "frame.number == 27357", "timestamp_epoch": "1533965035.496495000" } ], "is_private": false, "observable_id": "observable-d246300e6e08696888d5210d", "last_seen_epoch": "1533965035.496495000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965035.496495000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "38.106.34.163", "evidence": [ { "udp_stream": 257, "frame_number": 27357, "display_filter": "frame.number == 27357", "timestamp_epoch": "1533965035.496495000" } ], "is_private": false, "observable_id": "observable-2765506c51ffbdbbb0934b34", "last_seen_epoch": "1533965035.496495000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965035.496495000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "38.106.34.164", "evidence": [ { "udp_stream": 257, "frame_number": 27357, "display_filter": "frame.number == 27357", "timestamp_epoch": "1533965035.496495000" } ], "is_private": false, "observable_id": "observable-09135e634dbb79c69ca8c95d", "last_seen_epoch": "1533965035.496495000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965035.496495000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "4.78.226.232", "evidence": [ { "udp_stream": 153, "frame_number": 14611, "display_filter": "frame.number == 14611", "timestamp_epoch": "1533964904.637605000" } ], "is_private": false, "observable_id": "observable-2863319e50d31c2dbc4bef1c", "last_seen_epoch": "1533964904.637605000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964904.637605000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "4.78.226.233", "evidence": [ { "udp_stream": 224, "frame_number": 23034, "display_filter": "frame.number == 23034", "timestamp_epoch": "1533964996.474895000" } ], "is_private": false, "observable_id": "observable-e04236cc6da757bb076a887e", "last_seen_epoch": "1533964996.474895000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964996.474895000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "4.78.226.234", "evidence": [ { "udp_stream": 230, "frame_number": 23300, "display_filter": "frame.number == 23300", "timestamp_epoch": "1533964997.294014000" } ], "is_private": false, "observable_id": "observable-d25d9b257c34980d6bc80789", "last_seen_epoch": "1533964997.294014000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964997.294014000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "46.161.36.4", "evidence": [ { "udp_stream": 122, "frame_number": 11789, "display_filter": "frame.number == 11789", "timestamp_epoch": "1533964901.574246000" } ], "is_private": false, "observable_id": "observable-5e5fd9905743b4e064476266", "last_seen_epoch": "1533964901.574246000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964901.574246000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "46.161.36.6", "evidence": [ { "udp_stream": 122, "frame_number": 11789, "display_filter": "frame.number == 11789", "timestamp_epoch": "1533964901.574246000" } ], "is_private": false, "observable_id": "observable-ffda9ebf7cdbfaae8f408a33", "last_seen_epoch": "1533964901.574246000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964901.574246000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "46.161.36.8", "evidence": [ { "udp_stream": 122, "frame_number": 11789, "display_filter": "frame.number == 11789", "timestamp_epoch": "1533964901.574246000" } ], "is_private": false, "observable_id": "observable-54fd62277162d4dc1c99a816", "last_seen_epoch": "1533964901.574246000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964901.574246000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "46.51.169.56", "evidence": [ { "udp_stream": 285, "frame_number": 31674, "display_filter": "frame.number == 31674", "timestamp_epoch": "1533965100.796522000" } ], "is_private": false, "observable_id": "observable-cf846570f09c1f6699c5cfa8", "last_seen_epoch": "1533965100.796522000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965100.796522000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "46.51.174.75", "evidence": [ { "udp_stream": 285, "frame_number": 31674, "display_filter": "frame.number == 31674", "timestamp_epoch": "1533965100.796522000" } ], "is_private": false, "observable_id": "observable-e0d23477dba7154b43092e14", "last_seen_epoch": "1533965100.796522000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965100.796522000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "46.51.193.164", "evidence": [ { "udp_stream": 173, "frame_number": 16524, "display_filter": "frame.number == 16524", "timestamp_epoch": "1533964909.718959000" } ], "is_private": false, "observable_id": "observable-9cba802271afb88608af966c", "last_seen_epoch": "1533964909.718959000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964909.718959000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "5.39.44.194", "evidence": [ { "udp_stream": 269, "frame_number": 27577, "display_filter": "frame.number == 27577", "timestamp_epoch": "1533965035.747708000" } ], "is_private": false, "observable_id": "observable-452bb27f69878b4bce77025f", "last_seen_epoch": "1533965035.747708000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965035.747708000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "5.39.44.195", "evidence": [ { "udp_stream": 269, "frame_number": 27577, "display_filter": "frame.number == 27577", "timestamp_epoch": "1533965035.747708000" } ], "is_private": false, "observable_id": "observable-57024d05517a705d7d489d8f", "last_seen_epoch": "1533965035.747708000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965035.747708000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "50.16.185.226", "evidence": [ { "udp_stream": 82, "frame_number": 6148, "display_filter": "frame.number == 6148", "timestamp_epoch": "1533964559.906110000" } ], "is_private": false, "observable_id": "observable-ca372d506ba75028a8014c7c", "last_seen_epoch": "1533964559.906110000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964559.906110000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "50.16.201.198", "evidence": [ { "udp_stream": 82, "frame_number": 6148, "display_filter": "frame.number == 6148", "timestamp_epoch": "1533964559.906110000" } ], "is_private": false, "observable_id": "observable-34a77509307bf3fe735b61d4", "last_seen_epoch": "1533964559.906110000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964559.906110000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "50.16.204.65", "evidence": [ { "udp_stream": 82, "frame_number": 6148, "display_filter": "frame.number == 6148", "timestamp_epoch": "1533964559.906110000" } ], "is_private": false, "observable_id": "observable-fdaa97f7c8b79855e4385467", "last_seen_epoch": "1533964559.906110000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964559.906110000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "50.16.205.103", "evidence": [ { "udp_stream": 82, "frame_number": 6148, "display_filter": "frame.number == 6148", "timestamp_epoch": "1533964559.906110000" } ], "is_private": false, "observable_id": "observable-35f0e022b7b5c729b00bf6ca", "last_seen_epoch": "1533964559.906110000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964559.906110000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "50.16.223.11", "evidence": [ { "udp_stream": 82, "frame_number": 6148, "display_filter": "frame.number == 6148", "timestamp_epoch": "1533964559.906110000" } ], "is_private": false, "observable_id": "observable-39c148a915e3a2e9e1ff89d3", "last_seen_epoch": "1533964559.906110000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964559.906110000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "50.16.230.124", "evidence": [ { "udp_stream": 82, "frame_number": 6148, "display_filter": "frame.number == 6148", "timestamp_epoch": "1533964559.906110000" } ], "is_private": false, "observable_id": "observable-d9fb6035f9eb88e7e4ef9349", "last_seen_epoch": "1533964559.906110000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964559.906110000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "50.18.110.80", "evidence": [ { "udp_stream": 154, "frame_number": 14640, "display_filter": "frame.number == 14640", "timestamp_epoch": "1533964904.663956000" }, { "udp_stream": 364, "frame_number": 46080, "display_filter": "frame.number == 46080", "timestamp_epoch": "1533965789.714227000" } ], "is_private": false, "observable_id": "observable-f5eb2bea6b31017fa5b11654", "last_seen_epoch": "1533965789.714227000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964904.663956000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "50.18.173.83", "evidence": [ { "udp_stream": 260, "frame_number": 27324, "display_filter": "frame.number == 27324", "timestamp_epoch": "1533965035.406855000" } ], "is_private": false, "observable_id": "observable-3bfc2b66a542f9d481562910", "last_seen_epoch": "1533965035.406855000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965035.406855000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "50.18.61.120", "evidence": [ { "udp_stream": 260, "frame_number": 27324, "display_filter": "frame.number == 27324", "timestamp_epoch": "1533965035.406855000" } ], "is_private": false, "observable_id": "observable-7a1f66b92fdcd16c51e1d869", "last_seen_epoch": "1533965035.406855000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965035.406855000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "50.18.61.141", "evidence": [ { "udp_stream": 260, "frame_number": 27324, "display_filter": "frame.number == 27324", "timestamp_epoch": "1533965035.406855000" } ], "is_private": false, "observable_id": "observable-d238906899bd0969d7f2fac0", "last_seen_epoch": "1533965035.406855000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965035.406855000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "50.19.167.223", "evidence": [ { "udp_stream": 280, "frame_number": 31704, "display_filter": "frame.number == 31704", "timestamp_epoch": "1533965100.817951000" } ], "is_private": false, "observable_id": "observable-15644cc772f7ee4399f6cb14", "last_seen_epoch": "1533965100.817951000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965100.817951000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "50.19.205.30", "evidence": [ { "udp_stream": 117, "frame_number": 11114, "display_filter": "frame.number == 11114", "timestamp_epoch": "1533964901.056360000" } ], "is_private": false, "observable_id": "observable-99372f0001c98bdcf0d4b2b5", "last_seen_epoch": "1533964901.056360000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964901.056360000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "50.19.51.56", "evidence": [ { "udp_stream": 120, "frame_number": 23682, "display_filter": "frame.number == 23682", "timestamp_epoch": "1533964997.887170000" } ], "is_private": false, "observable_id": "observable-c52bdb7491d9facc2b665124", "last_seen_epoch": "1533964997.887170000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964997.887170000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.0.134.142", "evidence": [ { "udp_stream": 273, "frame_number": 30652, "display_filter": "frame.number == 30652", "timestamp_epoch": "1533965099.045919000" } ], "is_private": false, "observable_id": "observable-5749833c834315adde3a3bca", "last_seen_epoch": "1533965099.045919000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965099.045919000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.0.244.217", "evidence": [ { "udp_stream": 266, "frame_number": 27558, "display_filter": "frame.number == 27558", "timestamp_epoch": "1533965035.720501000" } ], "is_private": false, "observable_id": "observable-87f2f06f54fb8a96f16e13d0", "last_seen_epoch": "1533965035.720501000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965035.720501000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "52.11.229.48", "evidence": [ { "udp_stream": 252, "frame_number": 26736, "display_filter": "frame.number == 26736", "timestamp_epoch": "1533965033.496493000" } ], "is_private": false, "observable_id": "observable-f666b4ee856681468cb552c7", "last_seen_epoch": "1533965033.496493000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965033.496493000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.11.6.29", "evidence": [ { "udp_stream": 296, "frame_number": 32987, "display_filter": "frame.number == 32987", "timestamp_epoch": "1533965136.794310000" } ], "is_private": false, "observable_id": "observable-b70fcded377d7b36b3efdd06", "last_seen_epoch": "1533965136.794310000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965136.794310000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.11.73.127", "evidence": [ { "udp_stream": 290, "frame_number": 32701, "display_filter": "frame.number == 32701", "timestamp_epoch": "1533965134.862529000" } ], "is_private": false, "observable_id": "observable-06feb3d09e0040e1f887e184", "last_seen_epoch": "1533965134.862529000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965134.862529000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.11.94.156", "evidence": [ { "udp_stream": 222, "frame_number": 23033, "display_filter": "frame.number == 23033", "timestamp_epoch": "1533964996.474799000" } ], "is_private": false, "observable_id": "observable-bf9a068fc0ced0ee3a13cf5d", "last_seen_epoch": "1533964996.474799000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964996.474799000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.15.253.50", "evidence": [ { "udp_stream": 293, "frame_number": 32841, "display_filter": "frame.number == 32841", "timestamp_epoch": "1533965136.087192000" } ], "is_private": false, "observable_id": "observable-b81fe7c400aadae24d76085c", "last_seen_epoch": "1533965136.087192000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965136.087192000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.15.46.161", "evidence": [ { "udp_stream": 293, "frame_number": 32841, "display_filter": "frame.number == 32841", "timestamp_epoch": "1533965136.087192000" } ], "is_private": false, "observable_id": "observable-0c485aea30f16f0fd9298091", "last_seen_epoch": "1533965136.087192000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965136.087192000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.16.89.247", "evidence": [ { "udp_stream": 173, "frame_number": 16524, "display_filter": "frame.number == 16524", "timestamp_epoch": "1533964909.718959000" } ], "is_private": false, "observable_id": "observable-e91b2e6fc1ef86384c8d84fc", "last_seen_epoch": "1533964909.718959000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964909.718959000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.17.182.129", "evidence": [ { "udp_stream": 173, "frame_number": 16524, "display_filter": "frame.number == 16524", "timestamp_epoch": "1533964909.718959000" } ], "is_private": false, "observable_id": "observable-a9e08f33296634a8a6e64ca1", "last_seen_epoch": "1533964909.718959000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964909.718959000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.20.201.251", "evidence": [ { "udp_stream": 117, "frame_number": 11114, "display_filter": "frame.number == 11114", "timestamp_epoch": "1533964901.056360000" } ], "is_private": false, "observable_id": "observable-ac016ee126007731c9a4e7ca", "last_seen_epoch": "1533964901.056360000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964901.056360000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "52.20.63.23", "evidence": [ { "udp_stream": 234, "frame_number": 23623, "display_filter": "frame.number == 23623", "timestamp_epoch": "1533964997.803829000" } ], "is_private": false, "observable_id": "observable-e49ba89113912acdfed35acd", "last_seen_epoch": "1533964997.803829000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964997.803829000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.200.135.6", "evidence": [ { "udp_stream": 248, "frame_number": 26728, "display_filter": "frame.number == 26728", "timestamp_epoch": "1533965033.481510000" }, { "udp_stream": 254, "frame_number": 27021, "display_filter": "frame.number == 27021", "timestamp_epoch": "1533965034.135661000" } ], "is_private": false, "observable_id": "observable-ccf76845ef0b527d523b6628", "last_seen_epoch": "1533965034.135661000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965033.481510000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "52.201.177.113", "evidence": [ { "udp_stream": 280, "frame_number": 31704, "display_filter": "frame.number == 31704", "timestamp_epoch": "1533965100.817951000" } ], "is_private": false, "observable_id": "observable-a63b9d8c062c3d4c6071f372", "last_seen_epoch": "1533965100.817951000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965100.817951000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.202.121.146", "evidence": [ { "udp_stream": 117, "frame_number": 11114, "display_filter": "frame.number == 11114", "timestamp_epoch": "1533964901.056360000" } ], "is_private": false, "observable_id": "observable-cdd4f2c21e4aee07da20dc16", "last_seen_epoch": "1533964901.056360000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964901.056360000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.202.36.55", "evidence": [ { "udp_stream": 259, "frame_number": 27332, "display_filter": "frame.number == 27332", "timestamp_epoch": "1533965035.434545000" } ], "is_private": false, "observable_id": "observable-e6b51cdfa4e595121e3f1e56", "last_seen_epoch": "1533965035.434545000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965035.434545000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.202.74.78", "evidence": [ { "udp_stream": 280, "frame_number": 31704, "display_filter": "frame.number == 31704", "timestamp_epoch": "1533965100.817951000" } ], "is_private": false, "observable_id": "observable-0141b31e6eca4e5167110921", "last_seen_epoch": "1533965100.817951000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965100.817951000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.203.113.55", "evidence": [ { "udp_stream": 259, "frame_number": 27332, "display_filter": "frame.number == 27332", "timestamp_epoch": "1533965035.434545000" } ], "is_private": false, "observable_id": "observable-6941973e2a52833ae4a41e4e", "last_seen_epoch": "1533965035.434545000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965035.434545000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.203.152.20", "evidence": [ { "udp_stream": 273, "frame_number": 30652, "display_filter": "frame.number == 30652", "timestamp_epoch": "1533965099.045919000" } ], "is_private": false, "observable_id": "observable-de7c9b1993d626ea110b97d7", "last_seen_epoch": "1533965099.045919000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965099.045919000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "52.203.231.138", "evidence": [ { "udp_stream": 248, "frame_number": 26728, "display_filter": "frame.number == 26728", "timestamp_epoch": "1533965033.481510000" }, { "udp_stream": 254, "frame_number": 27021, "display_filter": "frame.number == 27021", "timestamp_epoch": "1533965034.135661000" } ], "is_private": false, "observable_id": "observable-d1d5de2b2a80f1e2cc2c1518", "last_seen_epoch": "1533965034.135661000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965033.481510000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.203.238.185", "evidence": [ { "udp_stream": 166, "frame_number": 16032, "display_filter": "frame.number == 16032", "timestamp_epoch": "1533964908.406611000" } ], "is_private": false, "observable_id": "observable-019eb35b5a70ff60d66bc5a9", "last_seen_epoch": "1533964908.406611000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964908.406611000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.204.11.61", "evidence": [ { "udp_stream": 227, "frame_number": 23293, "display_filter": "frame.number == 23293", "timestamp_epoch": "1533964997.291196000" } ], "is_private": false, "observable_id": "observable-e5ea9cd9eaa2be2ed713c3d4", "last_seen_epoch": "1533964997.291196000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964997.291196000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.204.188.86", "evidence": [ { "udp_stream": 227, "frame_number": 23293, "display_filter": "frame.number == 23293", "timestamp_epoch": "1533964997.291196000" } ], "is_private": false, "observable_id": "observable-c46e10656f9008597493e8b2", "last_seen_epoch": "1533964997.291196000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964997.291196000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.205.207.146", "evidence": [ { "udp_stream": 240, "frame_number": 24040, "display_filter": "frame.number == 24040", "timestamp_epoch": "1533964999.467395000" } ], "is_private": false, "observable_id": "observable-e3c14792694c4a86f71fde59", "last_seen_epoch": "1533964999.467395000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964999.467395000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.206.139.43", "evidence": [ { "udp_stream": 234, "frame_number": 23623, "display_filter": "frame.number == 23623", "timestamp_epoch": "1533964997.803829000" } ], "is_private": false, "observable_id": "observable-2bcc73771a1a14bd87080fe4", "last_seen_epoch": "1533964997.803829000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964997.803829000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "52.206.38.25", "evidence": [ { "udp_stream": 227, "frame_number": 23293, "display_filter": "frame.number == 23293", "timestamp_epoch": "1533964997.291196000" } ], "is_private": false, "observable_id": "observable-11d9807ab403353312975a16", "last_seen_epoch": "1533964997.291196000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964997.291196000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.206.55.46", "evidence": [ { "udp_stream": 166, "frame_number": 16032, "display_filter": "frame.number == 16032", "timestamp_epoch": "1533964908.406611000" } ], "is_private": false, "observable_id": "observable-e2861ad094fb4673f35c4348", "last_seen_epoch": "1533964908.406611000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964908.406611000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.207.120.98", "evidence": [ { "udp_stream": 148, "frame_number": 14376, "display_filter": "frame.number == 14376", "timestamp_epoch": "1533964904.333194000" } ], "is_private": false, "observable_id": "observable-d6c829335001d4d38186649f", "last_seen_epoch": "1533964904.333194000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964904.333194000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.207.61.182", "evidence": [ { "udp_stream": 190, "frame_number": 18568, "display_filter": "frame.number == 18568", "timestamp_epoch": "1533964959.365164000" } ], "is_private": false, "observable_id": "observable-47f74216c062b657c4b01753", "last_seen_epoch": "1533964959.365164000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964959.365164000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.209.191.106", "evidence": [ { "udp_stream": 73, "frame_number": 5860, "display_filter": "frame.number == 5860", "timestamp_epoch": "1533964559.445991000" } ], "is_private": false, "observable_id": "observable-995a8a36202622486ed18c03", "last_seen_epoch": "1533964559.445991000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964559.445991000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "52.21.201.75", "evidence": [ { "udp_stream": 120, "frame_number": 23682, "display_filter": "frame.number == 23682", "timestamp_epoch": "1533964997.887170000" } ], "is_private": false, "observable_id": "observable-43ee04eaa59f7cd391a2c505", "last_seen_epoch": "1533964997.887170000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964997.887170000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "52.211.165.177", "evidence": [ { "udp_stream": 305, "frame_number": 35537, "display_filter": "frame.number == 35537", "timestamp_epoch": "1533965160.370309000" } ], "is_private": false, "observable_id": "observable-28a6ad1919172eebc85666e3", "last_seen_epoch": "1533965160.370309000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965160.370309000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.212.134.173", "evidence": [ { "udp_stream": 305, "frame_number": 35537, "display_filter": "frame.number == 35537", "timestamp_epoch": "1533965160.370309000" } ], "is_private": false, "observable_id": "observable-27dea6e4b37d746050f95120", "last_seen_epoch": "1533965160.370309000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965160.370309000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.212.137.44", "evidence": [ { "udp_stream": 305, "frame_number": 35537, "display_filter": "frame.number == 35537", "timestamp_epoch": "1533965160.370309000" } ], "is_private": false, "observable_id": "observable-5f3b44042a7e1094936be9c6", "last_seen_epoch": "1533965160.370309000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965160.370309000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.22.107.11", "evidence": [ { "udp_stream": 166, "frame_number": 16032, "display_filter": "frame.number == 16032", "timestamp_epoch": "1533964908.406611000" } ], "is_private": false, "observable_id": "observable-f2681bbea8fd2d34dfb5300b", "last_seen_epoch": "1533964908.406611000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964908.406611000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "52.22.112.153", "evidence": [ { "udp_stream": 259, "frame_number": 27332, "display_filter": "frame.number == 27332", "timestamp_epoch": "1533965035.434545000" } ], "is_private": false, "observable_id": "observable-1f0e2e0a86bdec7383ba86c9", "last_seen_epoch": "1533965035.434545000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965035.434545000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.22.146.31", "evidence": [ { "udp_stream": 227, "frame_number": 23293, "display_filter": "frame.number == 23293", "timestamp_epoch": "1533964997.291196000" } ], "is_private": false, "observable_id": "observable-3a9afc527f5cfb37143147de", "last_seen_epoch": "1533964997.291196000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964997.291196000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.22.167.180", "evidence": [ { "udp_stream": 205, "frame_number": 19619, "display_filter": "frame.number == 19619", "timestamp_epoch": "1533964962.605621000" } ], "is_private": false, "observable_id": "observable-af6b10bb86e4097af11a1950", "last_seen_epoch": "1533964962.605621000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964962.605621000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.22.246.227", "evidence": [ { "udp_stream": 207, "frame_number": 19702, "display_filter": "frame.number == 19702", "timestamp_epoch": "1533964962.896098000" } ], "is_private": false, "observable_id": "observable-9f464c6941868146a9a01685", "last_seen_epoch": "1533964962.896098000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964962.896098000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.22.78.109", "evidence": [ { "udp_stream": 273, "frame_number": 30652, "display_filter": "frame.number == 30652", "timestamp_epoch": "1533965099.045919000" } ], "is_private": false, "observable_id": "observable-aca1db89651a19716ac639a0", "last_seen_epoch": "1533965099.045919000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965099.045919000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.221.28.32", "evidence": [ { "udp_stream": 225, "frame_number": 23149, "display_filter": "frame.number == 23149", "timestamp_epoch": "1533964996.948203000" } ], "is_private": false, "observable_id": "observable-c26001e2dec8854f0d0401be", "last_seen_epoch": "1533964996.948203000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964996.948203000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.221.38.91", "evidence": [ { "udp_stream": 225, "frame_number": 23149, "display_filter": "frame.number == 23149", "timestamp_epoch": "1533964996.948203000" } ], "is_private": false, "observable_id": "observable-9c53acbb21b043f94fb83545", "last_seen_epoch": "1533964996.948203000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964996.948203000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.23.112.47", "evidence": [ { "udp_stream": 166, "frame_number": 16032, "display_filter": "frame.number == 16032", "timestamp_epoch": "1533964908.406611000" } ], "is_private": false, "observable_id": "observable-71f472ca8a364f6e186753fc", "last_seen_epoch": "1533964908.406611000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964908.406611000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.24.120.129", "evidence": [ { "udp_stream": 252, "frame_number": 26736, "display_filter": "frame.number == 26736", "timestamp_epoch": "1533965033.496493000" } ], "is_private": false, "observable_id": "observable-2524d7e1f2efc0697b3a0036", "last_seen_epoch": "1533965033.496493000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965033.496493000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.24.137.134", "evidence": [ { "udp_stream": 156, "frame_number": 14613, "display_filter": "frame.number == 14613", "timestamp_epoch": "1533964904.637787000" } ], "is_private": false, "observable_id": "observable-594c61f84faea0890bbad123", "last_seen_epoch": "1533964904.637787000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964904.637787000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.24.57.89", "evidence": [ { "udp_stream": 150, "frame_number": 14614, "display_filter": "frame.number == 14614", "timestamp_epoch": "1533964904.637907000" } ], "is_private": false, "observable_id": "observable-22044c2f0e20ceba17750c23", "last_seen_epoch": "1533964904.637907000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964904.637907000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "52.24.61.237", "evidence": [ { "udp_stream": 290, "frame_number": 32701, "display_filter": "frame.number == 32701", "timestamp_epoch": "1533965134.862529000" } ], "is_private": false, "observable_id": "observable-d4cada7f939bdf03a6e6484d", "last_seen_epoch": "1533965134.862529000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965134.862529000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.25.151.172", "evidence": [ { "udp_stream": 156, "frame_number": 14613, "display_filter": "frame.number == 14613", "timestamp_epoch": "1533964904.637787000" } ], "is_private": false, "observable_id": "observable-f9b06c24b674531b42557ace", "last_seen_epoch": "1533964904.637787000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964904.637787000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.25.20.224", "evidence": [ { "udp_stream": 296, "frame_number": 32987, "display_filter": "frame.number == 32987", "timestamp_epoch": "1533965136.794310000" } ], "is_private": false, "observable_id": "observable-656a41eaeae867c87bccae47", "last_seen_epoch": "1533965136.794310000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965136.794310000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.25.205.181", "evidence": [ { "udp_stream": 180, "frame_number": 17691, "display_filter": "frame.number == 17691", "timestamp_epoch": "1533964957.010961000" } ], "is_private": false, "observable_id": "observable-882056bb1423e9ad376f2c1f", "last_seen_epoch": "1533964957.010961000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964957.010961000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.25.41.120", "evidence": [ { "udp_stream": 181, "frame_number": 17890, "display_filter": "frame.number == 17890", "timestamp_epoch": "1533964957.470463000" } ], "is_private": false, "observable_id": "observable-de686498b0de1e22e16391b7", "last_seen_epoch": "1533964957.470463000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964957.470463000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.25.46.76", "evidence": [ { "udp_stream": 180, "frame_number": 17691, "display_filter": "frame.number == 17691", "timestamp_epoch": "1533964957.010961000" } ], "is_private": false, "observable_id": "observable-a5ff037a719c83660fb06d54", "last_seen_epoch": "1533964957.010961000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964957.010961000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.25.98.6", "evidence": [ { "udp_stream": 296, "frame_number": 32987, "display_filter": "frame.number == 32987", "timestamp_epoch": "1533965136.794310000" } ], "is_private": false, "observable_id": "observable-805885c7fc341b553164189c", "last_seen_epoch": "1533965136.794310000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965136.794310000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.26.10.3", "evidence": [ { "udp_stream": 180, "frame_number": 17691, "display_filter": "frame.number == 17691", "timestamp_epoch": "1533964957.010961000" } ], "is_private": false, "observable_id": "observable-7c7707e87cb91bb422304b94", "last_seen_epoch": "1533964957.010961000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964957.010961000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.26.143.166", "evidence": [ { "udp_stream": 270, "frame_number": 27927, "display_filter": "frame.number == 27927", "timestamp_epoch": "1533965036.249006000" } ], "is_private": false, "observable_id": "observable-8fbe6f170fdff9abe11ae3f5", "last_seen_epoch": "1533965036.249006000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965036.249006000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.26.246.54", "evidence": [ { "udp_stream": 180, "frame_number": 17691, "display_filter": "frame.number == 17691", "timestamp_epoch": "1533964957.010961000" } ], "is_private": false, "observable_id": "observable-4275a0ccd0e75429a69749a3", "last_seen_epoch": "1533964957.010961000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964957.010961000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "52.26.87.58", "evidence": [ { "udp_stream": 185, "frame_number": 18200, "display_filter": "frame.number == 18200", "timestamp_epoch": "1533964958.477773000" } ], "is_private": false, "observable_id": "observable-731c74b88099cf6250dc64f1", "last_seen_epoch": "1533964958.477773000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964958.477773000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "52.27.237.90", "evidence": [ { "udp_stream": 180, "frame_number": 17691, "display_filter": "frame.number == 17691", "timestamp_epoch": "1533964957.010961000" } ], "is_private": false, "observable_id": "observable-f5c21071b5fd5fef0d0464cf", "last_seen_epoch": "1533964957.010961000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964957.010961000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.27.59.211", "evidence": [ { "udp_stream": 180, "frame_number": 17691, "display_filter": "frame.number == 17691", "timestamp_epoch": "1533964957.010961000" } ], "is_private": false, "observable_id": "observable-f12557d4106d173602d6c6da", "last_seen_epoch": "1533964957.010961000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964957.010961000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.27.97.168", "evidence": [ { "udp_stream": 98, "frame_number": 8958, "display_filter": "frame.number == 8958", "timestamp_epoch": "1533964898.930359000" }, { "udp_stream": 231, "frame_number": 23599, "display_filter": "frame.number == 23599", "timestamp_epoch": "1533964997.757167000" } ], "is_private": false, "observable_id": "observable-c5b97c94c44307ccd29a3821", "last_seen_epoch": "1533964997.757167000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964898.930359000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.29.182.113", "evidence": [ { "udp_stream": 261, "frame_number": 27339, "display_filter": "frame.number == 27339", "timestamp_epoch": "1533965035.445254000" } ], "is_private": false, "observable_id": "observable-e14d22076bd839feedcedd05", "last_seen_epoch": "1533965035.445254000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965035.445254000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.3.158.250", "evidence": [ { "udp_stream": 248, "frame_number": 26728, "display_filter": "frame.number == 26728", "timestamp_epoch": "1533965033.481510000" }, { "udp_stream": 254, "frame_number": 27021, "display_filter": "frame.number == 27021", "timestamp_epoch": "1533965034.135661000" } ], "is_private": false, "observable_id": "observable-e1f82b4ab452f069576e1124", "last_seen_epoch": "1533965034.135661000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965033.481510000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.3.167.150", "evidence": [ { "udp_stream": 258, "frame_number": 27323, "display_filter": "frame.number == 27323", "timestamp_epoch": "1533965035.406624000" } ], "is_private": false, "observable_id": "observable-cd3e2a5d6add88993e93392d", "last_seen_epoch": "1533965035.406624000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965035.406624000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.3.171.209", "evidence": [ { "udp_stream": 205, "frame_number": 19619, "display_filter": "frame.number == 19619", "timestamp_epoch": "1533964962.605621000" } ], "is_private": false, "observable_id": "observable-c524ccbee165d70cdaa4bf77", "last_seen_epoch": "1533964962.605621000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964962.605621000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.3.24.219", "evidence": [ { "udp_stream": 258, "frame_number": 27323, "display_filter": "frame.number == 27323", "timestamp_epoch": "1533965035.406624000" } ], "is_private": false, "observable_id": "observable-96cef92c0c7b434c5055aedc", "last_seen_epoch": "1533965035.406624000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965035.406624000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.3.56.159", "evidence": [ { "udp_stream": 207, "frame_number": 19702, "display_filter": "frame.number == 19702", "timestamp_epoch": "1533964962.896098000" } ], "is_private": false, "observable_id": "observable-a51fbebcaeeb52bbb3f0a33e", "last_seen_epoch": "1533964962.896098000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964962.896098000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.32.112.140", "evidence": [ { "udp_stream": 180, "frame_number": 17691, "display_filter": "frame.number == 17691", "timestamp_epoch": "1533964957.010961000" } ], "is_private": false, "observable_id": "observable-c32d650fc7727bc465ac4794", "last_seen_epoch": "1533964957.010961000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964957.010961000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.32.135.110", "evidence": [ { "udp_stream": 180, "frame_number": 17691, "display_filter": "frame.number == 17691", "timestamp_epoch": "1533964957.010961000" } ], "is_private": false, "observable_id": "observable-c599a1e0667d5bffbcc19081", "last_seen_epoch": "1533964957.010961000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964957.010961000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.32.152.21", "evidence": [ { "udp_stream": 150, "frame_number": 14614, "display_filter": "frame.number == 14614", "timestamp_epoch": "1533964904.637907000" } ], "is_private": false, "observable_id": "observable-f4b6da9a41641f2d6ee74b7d", "last_seen_epoch": "1533964904.637907000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964904.637907000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.33.181.135", "evidence": [ { "udp_stream": 155, "frame_number": 14641, "display_filter": "frame.number == 14641", "timestamp_epoch": "1533964904.664048000" } ], "is_private": false, "observable_id": "observable-6b191428766459266858c5b8", "last_seen_epoch": "1533964904.664048000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964904.664048000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "52.33.44.132", "evidence": [ { "udp_stream": 296, "frame_number": 32987, "display_filter": "frame.number == 32987", "timestamp_epoch": "1533965136.794310000" } ], "is_private": false, "observable_id": "observable-12e3fe34645eaee93470a71e", "last_seen_epoch": "1533965136.794310000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965136.794310000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.33.53.65", "evidence": [ { "udp_stream": 244, "frame_number": 26411, "display_filter": "frame.number == 26411", "timestamp_epoch": "1533965032.677118000" } ], "is_private": false, "observable_id": "observable-ef27e7d21198e70e74d6e4dc", "last_seen_epoch": "1533965032.677118000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965032.677118000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.34.250.5", "evidence": [ { "udp_stream": 215, "frame_number": 20229, "display_filter": "frame.number == 20229", "timestamp_epoch": "1533964965.012616000" } ], "is_private": false, "observable_id": "observable-20b29e26e7bd4c69c2f5b2d1", "last_seen_epoch": "1533964965.012616000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964965.012616000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.34.60.103", "evidence": [ { "udp_stream": 290, "frame_number": 32701, "display_filter": "frame.number == 32701", "timestamp_epoch": "1533965134.862529000" } ], "is_private": false, "observable_id": "observable-72515161ef2de953ab44f376", "last_seen_epoch": "1533965134.862529000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965134.862529000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.34.79.42", "evidence": [ { "udp_stream": 290, "frame_number": 32701, "display_filter": "frame.number == 32701", "timestamp_epoch": "1533965134.862529000" } ], "is_private": false, "observable_id": "observable-ddb77241b90276ce55542127", "last_seen_epoch": "1533965134.862529000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965134.862529000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.35.100.30", "evidence": [ { "udp_stream": 290, "frame_number": 32701, "display_filter": "frame.number == 32701", "timestamp_epoch": "1533965134.862529000" } ], "is_private": false, "observable_id": "observable-f1325efc6b985186252ac445", "last_seen_epoch": "1533965134.862529000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965134.862529000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.35.138.60", "evidence": [ { "udp_stream": 296, "frame_number": 32987, "display_filter": "frame.number == 32987", "timestamp_epoch": "1533965136.794310000" } ], "is_private": false, "observable_id": "observable-413a7b0137bc4651962f12b4", "last_seen_epoch": "1533965136.794310000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965136.794310000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.35.251.146", "evidence": [ { "udp_stream": 296, "frame_number": 32987, "display_filter": "frame.number == 32987", "timestamp_epoch": "1533965136.794310000" } ], "is_private": false, "observable_id": "observable-baf0db8fcaa5aa96982aa423", "last_seen_epoch": "1533965136.794310000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965136.794310000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.35.48.81", "evidence": [ { "udp_stream": 296, "frame_number": 32987, "display_filter": "frame.number == 32987", "timestamp_epoch": "1533965136.794310000" } ], "is_private": false, "observable_id": "observable-3027edf003fe6e1a681ad9cb", "last_seen_epoch": "1533965136.794310000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965136.794310000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.36.101.222", "evidence": [ { "udp_stream": 239, "frame_number": 24037, "display_filter": "frame.number == 24037", "timestamp_epoch": "1533964999.457617000" } ], "is_private": false, "observable_id": "observable-508575253f218ea74e9f40b3", "last_seen_epoch": "1533964999.457617000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964999.457617000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.36.116.231", "evidence": [ { "udp_stream": 239, "frame_number": 24037, "display_filter": "frame.number == 24037", "timestamp_epoch": "1533964999.457617000" } ], "is_private": false, "observable_id": "observable-db4594523558cfc58cf9b496", "last_seen_epoch": "1533964999.457617000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964999.457617000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.36.228.150", "evidence": [ { "udp_stream": 155, "frame_number": 14641, "display_filter": "frame.number == 14641", "timestamp_epoch": "1533964904.664048000" } ], "is_private": false, "observable_id": "observable-5c04f194c88914c3dab1a764", "last_seen_epoch": "1533964904.664048000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964904.664048000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.36.43.94", "evidence": [ { "udp_stream": 155, "frame_number": 14641, "display_filter": "frame.number == 14641", "timestamp_epoch": "1533964904.664048000" } ], "is_private": false, "observable_id": "observable-5e85af5b9a2fbc665243d20e", "last_seen_epoch": "1533964904.664048000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964904.664048000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.37.19.179", "evidence": [ { "udp_stream": 156, "frame_number": 14613, "display_filter": "frame.number == 14613", "timestamp_epoch": "1533964904.637787000" } ], "is_private": false, "observable_id": "observable-ce89d986266ef4b535d879a5", "last_seen_epoch": "1533964904.637787000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964904.637787000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.38.108.180", "evidence": [ { "udp_stream": 156, "frame_number": 14613, "display_filter": "frame.number == 14613", "timestamp_epoch": "1533964904.637787000" } ], "is_private": false, "observable_id": "observable-a40b5a3e674d64f5d44e92d9", "last_seen_epoch": "1533964904.637787000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964904.637787000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "52.39.151.69", "evidence": [ { "udp_stream": 222, "frame_number": 23033, "display_filter": "frame.number == 23033", "timestamp_epoch": "1533964996.474799000" } ], "is_private": false, "observable_id": "observable-0083b3d579d3ac15c6f63d20", "last_seen_epoch": "1533964996.474799000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964996.474799000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.4.123.24", "evidence": [ { "udp_stream": 258, "frame_number": 27323, "display_filter": "frame.number == 27323", "timestamp_epoch": "1533965035.406624000" } ], "is_private": false, "observable_id": "observable-3a0f2918475d56bc9f5c9074", "last_seen_epoch": "1533965035.406624000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965035.406624000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.4.138.39", "evidence": [ { "udp_stream": 227, "frame_number": 23293, "display_filter": "frame.number == 23293", "timestamp_epoch": "1533964997.291196000" } ], "is_private": false, "observable_id": "observable-b2d46b1530cdbc526406ced3", "last_seen_epoch": "1533964997.291196000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964997.291196000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "52.4.175.160", "evidence": [ { "udp_stream": 300, "frame_number": 33970, "display_filter": "frame.number == 33970", "timestamp_epoch": "1533965157.910445000" } ], "is_private": false, "observable_id": "observable-83b94f56ff507b3b80d214f7", "last_seen_epoch": "1533965157.910445000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965157.910445000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.4.188.134", "evidence": [ { "udp_stream": 207, "frame_number": 19702, "display_filter": "frame.number == 19702", "timestamp_epoch": "1533964962.896098000" } ], "is_private": false, "observable_id": "observable-489ac2a53f0d25851debfb66", "last_seen_epoch": "1533964962.896098000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964962.896098000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.4.234.47", "evidence": [ { "udp_stream": 273, "frame_number": 30652, "display_filter": "frame.number == 30652", "timestamp_epoch": "1533965099.045919000" } ], "is_private": false, "observable_id": "observable-b0a33c4537001bf625905f8f", "last_seen_epoch": "1533965099.045919000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965099.045919000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.4.92.244", "evidence": [ { "udp_stream": 227, "frame_number": 23293, "display_filter": "frame.number == 23293", "timestamp_epoch": "1533964997.291196000" } ], "is_private": false, "observable_id": "observable-8090b0e3fb932327df81ba93", "last_seen_epoch": "1533964997.291196000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964997.291196000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.40.188.201", "evidence": [ { "udp_stream": 98, "frame_number": 8958, "display_filter": "frame.number == 8958", "timestamp_epoch": "1533964898.930359000" }, { "udp_stream": 231, "frame_number": 23599, "display_filter": "frame.number == 23599", "timestamp_epoch": "1533964997.757167000" } ], "is_private": false, "observable_id": "observable-cc66c034c5bed8a686b15c56", "last_seen_epoch": "1533964997.757167000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964898.930359000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.40.243.130", "evidence": [ { "udp_stream": 156, "frame_number": 14613, "display_filter": "frame.number == 14613", "timestamp_epoch": "1533964904.637787000" } ], "is_private": false, "observable_id": "observable-1e364be4895796bb3d281234", "last_seen_epoch": "1533964904.637787000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964904.637787000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.41.250.17", "evidence": [ { "udp_stream": 150, "frame_number": 14614, "display_filter": "frame.number == 14614", "timestamp_epoch": "1533964904.637907000" } ], "is_private": false, "observable_id": "observable-97e7e8925d71e88a2c890b8f", "last_seen_epoch": "1533964904.637907000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964904.637907000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "52.42.116.214", "evidence": [ { "udp_stream": 244, "frame_number": 26411, "display_filter": "frame.number == 26411", "timestamp_epoch": "1533965032.677118000" } ], "is_private": false, "observable_id": "observable-6049d478f1da0b5130d952ff", "last_seen_epoch": "1533965032.677118000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965032.677118000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.42.185.39", "evidence": [ { "udp_stream": 290, "frame_number": 32701, "display_filter": "frame.number == 32701", "timestamp_epoch": "1533965134.862529000" } ], "is_private": false, "observable_id": "observable-5281c3137ea667a72014cb1f", "last_seen_epoch": "1533965134.862529000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965134.862529000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.43.107.250", "evidence": [ { "udp_stream": 156, "frame_number": 14613, "display_filter": "frame.number == 14613", "timestamp_epoch": "1533964904.637787000" } ], "is_private": false, "observable_id": "observable-ad61b3140230690ec1b2c3f5", "last_seen_epoch": "1533964904.637787000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964904.637787000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.43.21.121", "evidence": [ { "udp_stream": 239, "frame_number": 24037, "display_filter": "frame.number == 24037", "timestamp_epoch": "1533964999.457617000" } ], "is_private": false, "observable_id": "observable-c702b8ce0d6151888595ac89", "last_seen_epoch": "1533964999.457617000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964999.457617000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.43.30.37", "evidence": [ { "udp_stream": 65, "frame_number": 5141, "display_filter": "frame.number == 5141", "timestamp_epoch": "1533964556.025527000" } ], "is_private": false, "observable_id": "observable-f3867c0eb0a189c8ea145eec", "last_seen_epoch": "1533964556.025527000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964556.025527000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.43.42.188", "evidence": [ { "udp_stream": 296, "frame_number": 32987, "display_filter": "frame.number == 32987", "timestamp_epoch": "1533965136.794310000" } ], "is_private": false, "observable_id": "observable-5124d979bf719179c0af4444", "last_seen_epoch": "1533965136.794310000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965136.794310000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.44.153.144", "evidence": [ { "udp_stream": 227, "frame_number": 23293, "display_filter": "frame.number == 23293", "timestamp_epoch": "1533964997.291196000" } ], "is_private": false, "observable_id": "observable-e81e526ef6635997e6ac57b6", "last_seen_epoch": "1533964997.291196000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964997.291196000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "52.44.165.199", "evidence": [ { "udp_stream": 179, "frame_number": 17349, "display_filter": "frame.number == 17349", "timestamp_epoch": "1533964956.315471000" }, { "udp_stream": 182, "frame_number": 17855, "display_filter": "frame.number == 17855", "timestamp_epoch": "1533964957.358759000" } ], "is_private": false, "observable_id": "observable-d1ff3e00747cf018c8b2ef08", "last_seen_epoch": "1533964957.358759000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964956.315471000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.44.175.211", "evidence": [ { "udp_stream": 207, "frame_number": 19702, "display_filter": "frame.number == 19702", "timestamp_epoch": "1533964962.896098000" } ], "is_private": false, "observable_id": "observable-5bf72395b868b89509266d12", "last_seen_epoch": "1533964962.896098000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964962.896098000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.44.213.64", "evidence": [ { "udp_stream": 166, "frame_number": 16032, "display_filter": "frame.number == 16032", "timestamp_epoch": "1533964908.406611000" } ], "is_private": false, "observable_id": "observable-fc8ef82ac16a88bc142f1faa", "last_seen_epoch": "1533964908.406611000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964908.406611000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.44.246.171", "evidence": [ { "udp_stream": 306, "frame_number": 35556, "display_filter": "frame.number == 35556", "timestamp_epoch": "1533965160.381946000" } ], "is_private": false, "observable_id": "observable-8fa1f07d35a58afdf6ecd0ab", "last_seen_epoch": "1533965160.381946000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965160.381946000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "52.44.44.54", "evidence": [ { "udp_stream": 166, "frame_number": 16032, "display_filter": "frame.number == 16032", "timestamp_epoch": "1533964908.406611000" } ], "is_private": false, "observable_id": "observable-7995e2f7f7dfa19bb5951096", "last_seen_epoch": "1533964908.406611000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964908.406611000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.44.93.202", "evidence": [ { "udp_stream": 248, "frame_number": 26728, "display_filter": "frame.number == 26728", "timestamp_epoch": "1533965033.481510000" }, { "udp_stream": 254, "frame_number": 27021, "display_filter": "frame.number == 27021", "timestamp_epoch": "1533965034.135661000" } ], "is_private": false, "observable_id": "observable-36c9b4172842496193eace34", "last_seen_epoch": "1533965034.135661000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965033.481510000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.45.111.226", "evidence": [ { "udp_stream": 227, "frame_number": 23293, "display_filter": "frame.number == 23293", "timestamp_epoch": "1533964997.291196000" } ], "is_private": false, "observable_id": "observable-0e142ec94ce3b7662ace3ef4", "last_seen_epoch": "1533964997.291196000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964997.291196000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.45.217.171", "evidence": [ { "udp_stream": 120, "frame_number": 23682, "display_filter": "frame.number == 23682", "timestamp_epoch": "1533964997.887170000" } ], "is_private": false, "observable_id": "observable-9fc7074b75482d8320feeb79", "last_seen_epoch": "1533964997.887170000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964997.887170000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.45.218.154", "evidence": [ { "udp_stream": 259, "frame_number": 27332, "display_filter": "frame.number == 27332", "timestamp_epoch": "1533965035.434545000" } ], "is_private": false, "observable_id": "observable-1ec047c6abd6a072676d35e8", "last_seen_epoch": "1533965035.434545000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965035.434545000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.48.134.100", "evidence": [ { "udp_stream": 73, "frame_number": 5860, "display_filter": "frame.number == 5860", "timestamp_epoch": "1533964559.445991000" } ], "is_private": false, "observable_id": "observable-02fe9360a2e8a153f7861cce", "last_seen_epoch": "1533964559.445991000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964559.445991000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.48.186.5", "evidence": [ { "udp_stream": 305, "frame_number": 35537, "display_filter": "frame.number == 35537", "timestamp_epoch": "1533965160.370309000" } ], "is_private": false, "observable_id": "observable-d55f678f539a812abefa2e70", "last_seen_epoch": "1533965160.370309000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965160.370309000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.51.131.19", "evidence": [ { "udp_stream": 173, "frame_number": 16524, "display_filter": "frame.number == 16524", "timestamp_epoch": "1533964909.718959000" } ], "is_private": false, "observable_id": "observable-cf707ac028e5bd7bb99c0991", "last_seen_epoch": "1533964909.718959000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964909.718959000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.52.130.100", "evidence": [ { "udp_stream": 277, "frame_number": 30810, "display_filter": "frame.number == 30810", "timestamp_epoch": "1533965099.289135000" } ], "is_private": false, "observable_id": "observable-8369b321fa39477fdbe45092", "last_seen_epoch": "1533965099.289135000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965099.289135000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "52.52.136.196", "evidence": [ { "udp_stream": 212, "frame_number": 20071, "display_filter": "frame.number == 20071", "timestamp_epoch": "1533964964.450971000" }, { "udp_stream": 242, "frame_number": 24228, "display_filter": "frame.number == 24228", "timestamp_epoch": "1533965001.681775000" } ], "is_private": false, "observable_id": "observable-85d6acfd9c04def89e2be25d", "last_seen_epoch": "1533965001.681775000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964964.450971000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.52.14.142", "evidence": [ { "udp_stream": 154, "frame_number": 14640, "display_filter": "frame.number == 14640", "timestamp_epoch": "1533964904.663956000" }, { "udp_stream": 364, "frame_number": 46080, "display_filter": "frame.number == 46080", "timestamp_epoch": "1533965789.714227000" } ], "is_private": false, "observable_id": "observable-6a9c5e009a885bd7508fb82e", "last_seen_epoch": "1533965789.714227000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964904.663956000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.52.177.27", "evidence": [ { "udp_stream": 197, "frame_number": 19066, "display_filter": "frame.number == 19066", "timestamp_epoch": "1533964960.516077000" } ], "is_private": false, "observable_id": "observable-0c1ee1eb4be5f78d68a250c9", "last_seen_epoch": "1533964960.516077000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964960.516077000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.53.134.30", "evidence": [ { "udp_stream": 212, "frame_number": 20071, "display_filter": "frame.number == 20071", "timestamp_epoch": "1533964964.450971000" }, { "udp_stream": 242, "frame_number": 24228, "display_filter": "frame.number == 24228", "timestamp_epoch": "1533965001.681775000" } ], "is_private": false, "observable_id": "observable-f84c77d598da94018cf93632", "last_seen_epoch": "1533965001.681775000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964964.450971000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.54.127.128", "evidence": [ { "udp_stream": 166, "frame_number": 16032, "display_filter": "frame.number == 16032", "timestamp_epoch": "1533964908.406611000" } ], "is_private": false, "observable_id": "observable-ca5361e96c1efd2b349a8a05", "last_seen_epoch": "1533964908.406611000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964908.406611000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.54.208.77", "evidence": [ { "udp_stream": 166, "frame_number": 16032, "display_filter": "frame.number == 16032", "timestamp_epoch": "1533964908.406611000" } ], "is_private": false, "observable_id": "observable-ce6c3c55be719f72ba7ca601", "last_seen_epoch": "1533964908.406611000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964908.406611000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.55.152.195", "evidence": [ { "udp_stream": 120, "frame_number": 23682, "display_filter": "frame.number == 23682", "timestamp_epoch": "1533964997.887170000" } ], "is_private": false, "observable_id": "observable-77d4f2fc8036138da238effb", "last_seen_epoch": "1533964997.887170000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964997.887170000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.55.182.21", "evidence": [ { "udp_stream": 207, "frame_number": 19702, "display_filter": "frame.number == 19702", "timestamp_epoch": "1533964962.896098000" } ], "is_private": false, "observable_id": "observable-8467c1d2ff8d17b3fb14352a", "last_seen_epoch": "1533964962.896098000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964962.896098000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "52.58.174.155", "evidence": [ { "udp_stream": 261, "frame_number": 27339, "display_filter": "frame.number == 27339", "timestamp_epoch": "1533965035.445254000" } ], "is_private": false, "observable_id": "observable-b1d4da6c7420fe31e3de44e6", "last_seen_epoch": "1533965035.445254000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965035.445254000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.7.157.238", "evidence": [ { "udp_stream": 250, "frame_number": 26727, "display_filter": "frame.number == 26727", "timestamp_epoch": "1533965033.481280000" } ], "is_private": false, "observable_id": "observable-90f4966fb6e2a0d90eb07165", "last_seen_epoch": "1533965033.481280000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965033.481280000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.7.2.46", "evidence": [ { "udp_stream": 240, "frame_number": 24040, "display_filter": "frame.number == 24040", "timestamp_epoch": "1533964999.467395000" } ], "is_private": false, "observable_id": "observable-f70099dc04559d269d4e1f13", "last_seen_epoch": "1533964999.467395000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964999.467395000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.70.11.152", "evidence": [ { "udp_stream": 234, "frame_number": 23623, "display_filter": "frame.number == 23623", "timestamp_epoch": "1533964997.803829000" } ], "is_private": false, "observable_id": "observable-f847d56b684ec949f8ededa7", "last_seen_epoch": "1533964997.803829000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964997.803829000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.70.2.4", "evidence": [ { "udp_stream": 250, "frame_number": 26727, "display_filter": "frame.number == 26727", "timestamp_epoch": "1533965033.481280000" } ], "is_private": false, "observable_id": "observable-ad799f46b61475c6b76db4c8", "last_seen_epoch": "1533965033.481280000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965033.481280000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.71.116.75", "evidence": [ { "udp_stream": 273, "frame_number": 30652, "display_filter": "frame.number == 30652", "timestamp_epoch": "1533965099.045919000" } ], "is_private": false, "observable_id": "observable-4006c1e83c2216ff57df81f3", "last_seen_epoch": "1533965099.045919000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965099.045919000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.71.249.74", "evidence": [ { "udp_stream": 250, "frame_number": 26727, "display_filter": "frame.number == 26727", "timestamp_epoch": "1533965033.481280000" } ], "is_private": false, "observable_id": "observable-ad7ddcfb7afb3fab760a87aa", "last_seen_epoch": "1533965033.481280000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965033.481280000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.72.198.167", "evidence": [ { "udp_stream": 179, "frame_number": 17349, "display_filter": "frame.number == 17349", "timestamp_epoch": "1533964956.315471000" }, { "udp_stream": 182, "frame_number": 17855, "display_filter": "frame.number == 17855", "timestamp_epoch": "1533964957.358759000" } ], "is_private": false, "observable_id": "observable-6825abc9e0673670f46f8f0c", "last_seen_epoch": "1533964957.358759000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964956.315471000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.72.75.34", "evidence": [ { "udp_stream": 250, "frame_number": 26727, "display_filter": "frame.number == 26727", "timestamp_epoch": "1533965033.481280000" } ], "is_private": false, "observable_id": "observable-9a8600c0534e79c7d4cb889d", "last_seen_epoch": "1533965033.481280000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965033.481280000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.73.123.67", "evidence": [ { "udp_stream": 120, "frame_number": 23682, "display_filter": "frame.number == 23682", "timestamp_epoch": "1533964997.887170000" } ], "is_private": false, "observable_id": "observable-ad0271c2ae3178546f1f900c", "last_seen_epoch": "1533964997.887170000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964997.887170000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.73.148.73", "evidence": [ { "udp_stream": 179, "frame_number": 17349, "display_filter": "frame.number == 17349", "timestamp_epoch": "1533964956.315471000" }, { "udp_stream": 182, "frame_number": 17855, "display_filter": "frame.number == 17855", "timestamp_epoch": "1533964957.358759000" } ], "is_private": false, "observable_id": "observable-12d2b8e3bfc757f0ebf2c04f", "last_seen_epoch": "1533964957.358759000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964956.315471000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.73.178.249", "evidence": [ { "udp_stream": 120, "frame_number": 23682, "display_filter": "frame.number == 23682", "timestamp_epoch": "1533964997.887170000" } ], "is_private": false, "observable_id": "observable-45adaa7ffc9ba4809122db1e", "last_seen_epoch": "1533964997.887170000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964997.887170000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.73.182.32", "evidence": [ { "udp_stream": 120, "frame_number": 23682, "display_filter": "frame.number == 23682", "timestamp_epoch": "1533964997.887170000" } ], "is_private": false, "observable_id": "observable-03d0b5c174437987678f4c66", "last_seen_epoch": "1533964997.887170000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964997.887170000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "52.74.108.147", "evidence": [ { "udp_stream": 225, "frame_number": 23149, "display_filter": "frame.number == 23149", "timestamp_epoch": "1533964996.948203000" } ], "is_private": false, "observable_id": "observable-d47f632f4e6d6e7084b0a5d3", "last_seen_epoch": "1533964996.948203000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964996.948203000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.8.138.67", "evidence": [ { "udp_stream": 154, "frame_number": 14640, "display_filter": "frame.number == 14640", "timestamp_epoch": "1533964904.663956000" }, { "udp_stream": 364, "frame_number": 46080, "display_filter": "frame.number == 46080", "timestamp_epoch": "1533965789.714227000" } ], "is_private": false, "observable_id": "observable-16c743e1b3c8762adf5fc574", "last_seen_epoch": "1533965789.714227000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964904.663956000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.8.189.11", "evidence": [ { "udp_stream": 141, "frame_number": 13494, "display_filter": "frame.number == 13494", "timestamp_epoch": "1533964903.481649000" } ], "is_private": false, "observable_id": "observable-bc41c4aa9cd8292826c487eb", "last_seen_epoch": "1533964903.481649000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964903.481649000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.8.197.244", "evidence": [ { "udp_stream": 197, "frame_number": 19066, "display_filter": "frame.number == 19066", "timestamp_epoch": "1533964960.516077000" } ], "is_private": false, "observable_id": "observable-52a9e8273e01a15f4b6f5f3b", "last_seen_epoch": "1533964960.516077000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964960.516077000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "52.8.202.139", "evidence": [ { "udp_stream": 212, "frame_number": 20071, "display_filter": "frame.number == 20071", "timestamp_epoch": "1533964964.450971000" }, { "udp_stream": 242, "frame_number": 24228, "display_filter": "frame.number == 24228", "timestamp_epoch": "1533965001.681775000" } ], "is_private": false, "observable_id": "observable-0ed2101b590220797b2dfa0a", "last_seen_epoch": "1533965001.681775000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964964.450971000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "52.8.226.99", "evidence": [ { "udp_stream": 274, "frame_number": 30691, "display_filter": "frame.number == 30691", "timestamp_epoch": "1533965099.093757000" } ], "is_private": false, "observable_id": "observable-4a16a7f8e366cf7fcbfda235", "last_seen_epoch": "1533965099.093757000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965099.093757000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.8.251.186", "evidence": [ { "udp_stream": 212, "frame_number": 20071, "display_filter": "frame.number == 20071", "timestamp_epoch": "1533964964.450971000" }, { "udp_stream": 242, "frame_number": 24228, "display_filter": "frame.number == 24228", "timestamp_epoch": "1533965001.681775000" } ], "is_private": false, "observable_id": "observable-77a20e42bed45b0c4ccb4dda", "last_seen_epoch": "1533965001.681775000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964964.450971000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.8.70.179", "evidence": [ { "udp_stream": 197, "frame_number": 19066, "display_filter": "frame.number == 19066", "timestamp_epoch": "1533964960.516077000" } ], "is_private": false, "observable_id": "observable-c730c49e2116c225c1581f9d", "last_seen_epoch": "1533964960.516077000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964960.516077000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.86.196.91", "evidence": [ { "udp_stream": 205, "frame_number": 19619, "display_filter": "frame.number == 19619", "timestamp_epoch": "1533964962.605621000" } ], "is_private": false, "observable_id": "observable-4b26c87b8ef8c9a15e6fd1dc", "last_seen_epoch": "1533964962.605621000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964962.605621000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.87.104.142", "evidence": [ { "udp_stream": 205, "frame_number": 19619, "display_filter": "frame.number == 19619", "timestamp_epoch": "1533964962.605621000" } ], "is_private": false, "observable_id": "observable-9bf25433c2ade97205beb57f", "last_seen_epoch": "1533964962.605621000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964962.605621000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.88.205.160", "evidence": [ { "udp_stream": 222, "frame_number": 23033, "display_filter": "frame.number == 23033", "timestamp_epoch": "1533964996.474799000" } ], "is_private": false, "observable_id": "observable-eda040ad72613546b905ffb9", "last_seen_epoch": "1533964996.474799000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964996.474799000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.88.9.91", "evidence": [ { "udp_stream": 181, "frame_number": 17890, "display_filter": "frame.number == 17890", "timestamp_epoch": "1533964957.470463000" } ], "is_private": false, "observable_id": "observable-487312f6ddfab4ffebd89f67", "last_seen_epoch": "1533964957.470463000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964957.470463000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.89.134.163", "evidence": [ { "udp_stream": 222, "frame_number": 23033, "display_filter": "frame.number == 23033", "timestamp_epoch": "1533964996.474799000" } ], "is_private": false, "observable_id": "observable-5e23d0ac9437e8fe9aff5ed4", "last_seen_epoch": "1533964996.474799000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964996.474799000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "52.89.90.109", "evidence": [ { "udp_stream": 98, "frame_number": 8958, "display_filter": "frame.number == 8958", "timestamp_epoch": "1533964898.930359000" } ], "is_private": false, "observable_id": "observable-79e4f2b80091dbdf15515bb3", "last_seen_epoch": "1533964898.930359000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964898.930359000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.89.92.187", "evidence": [ { "udp_stream": 270, "frame_number": 27927, "display_filter": "frame.number == 27927", "timestamp_epoch": "1533965036.249006000" } ], "is_private": false, "observable_id": "observable-7ce647c0aaa8463cbe717a22", "last_seen_epoch": "1533965036.249006000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965036.249006000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.9.0.53", "evidence": [ { "udp_stream": 197, "frame_number": 19066, "display_filter": "frame.number == 19066", "timestamp_epoch": "1533964960.516077000" } ], "is_private": false, "observable_id": "observable-6902a05e5808d3a2ed0d4500", "last_seen_epoch": "1533964960.516077000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964960.516077000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.9.113.206", "evidence": [ { "udp_stream": 154, "frame_number": 14640, "display_filter": "frame.number == 14640", "timestamp_epoch": "1533964904.663956000" }, { "udp_stream": 364, "frame_number": 46080, "display_filter": "frame.number == 46080", "timestamp_epoch": "1533965789.714227000" } ], "is_private": false, "observable_id": "observable-8f52bf0d0416aa0c88333ce9", "last_seen_epoch": "1533965789.714227000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964904.663956000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.9.116.187", "evidence": [ { "udp_stream": 274, "frame_number": 30691, "display_filter": "frame.number == 30691", "timestamp_epoch": "1533965099.093757000" } ], "is_private": false, "observable_id": "observable-5381ef590d7c482a33b32bcf", "last_seen_epoch": "1533965099.093757000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965099.093757000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.9.158.123", "evidence": [ { "udp_stream": 217, "frame_number": 20227, "display_filter": "frame.number == 20227", "timestamp_epoch": "1533964965.012520000" } ], "is_private": false, "observable_id": "observable-1fe060e34cb25f84f1c0e957", "last_seen_epoch": "1533964965.012520000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964965.012520000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.9.185.0", "evidence": [ { "udp_stream": 212, "frame_number": 20071, "display_filter": "frame.number == 20071", "timestamp_epoch": "1533964964.450971000" }, { "udp_stream": 242, "frame_number": 24228, "display_filter": "frame.number == 24228", "timestamp_epoch": "1533965001.681775000" } ], "is_private": false, "observable_id": "observable-a0f5bdba320a71a6b5513d0e", "last_seen_epoch": "1533965001.681775000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964964.450971000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.9.204.110", "evidence": [ { "udp_stream": 197, "frame_number": 19066, "display_filter": "frame.number == 19066", "timestamp_epoch": "1533964960.516077000" } ], "is_private": false, "observable_id": "observable-0883636a62e5ee974b0aa8a3", "last_seen_epoch": "1533964960.516077000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964960.516077000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "52.9.59.235", "evidence": [ { "udp_stream": 277, "frame_number": 30810, "display_filter": "frame.number == 30810", "timestamp_epoch": "1533965099.289135000" } ], "is_private": false, "observable_id": "observable-ac063cd55bec8d3da0489802", "last_seen_epoch": "1533965099.289135000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965099.289135000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.9.74.88", "evidence": [ { "udp_stream": 197, "frame_number": 19066, "display_filter": "frame.number == 19066", "timestamp_epoch": "1533964960.516077000" } ], "is_private": false, "observable_id": "observable-2ed05feff070e888f13fafc0", "last_seen_epoch": "1533964960.516077000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964960.516077000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "52.9.78.114", "evidence": [ { "udp_stream": 154, "frame_number": 14640, "display_filter": "frame.number == 14640", "timestamp_epoch": "1533964904.663956000" }, { "udp_stream": 364, "frame_number": 46080, "display_filter": "frame.number == 46080", "timestamp_epoch": "1533965789.714227000" } ], "is_private": false, "observable_id": "observable-f9dd193e0860d59fb15f6449", "last_seen_epoch": "1533965789.714227000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964904.663956000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.9.96.194", "evidence": [ { "udp_stream": 154, "frame_number": 14640, "display_filter": "frame.number == 14640", "timestamp_epoch": "1533964904.663956000" }, { "udp_stream": 364, "frame_number": 46080, "display_filter": "frame.number == 46080", "timestamp_epoch": "1533965789.714227000" } ], "is_private": false, "observable_id": "observable-e022c14922369b9f683c4f97", "last_seen_epoch": "1533965789.714227000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964904.663956000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "52.94.232.32", "evidence": [ { "udp_stream": 101, "frame_number": 8957, "display_filter": "frame.number == 8957", "timestamp_epoch": "1533964898.930358000" } ], "is_private": false, "observable_id": "observable-6c6a66a6462d2c07a175e564", "last_seen_epoch": "1533964898.930358000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964898.930358000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.148.121.12", "evidence": [ { "udp_stream": 150, "frame_number": 14614, "display_filter": "frame.number == 14614", "timestamp_epoch": "1533964904.637907000" } ], "is_private": false, "observable_id": "observable-962d1d34b1f2f3215a934c85", "last_seen_epoch": "1533964904.637907000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964904.637907000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "54.148.146.218", "evidence": [ { "udp_stream": 239, "frame_number": 24037, "display_filter": "frame.number == 24037", "timestamp_epoch": "1533964999.457617000" }, { "udp_stream": 264, "frame_number": 27522, "display_filter": "frame.number == 27522", "timestamp_epoch": "1533965035.690340000" } ], "is_private": false, "observable_id": "observable-d6fdb704e5db078d62ad3ce8", "last_seen_epoch": "1533965035.690340000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964999.457617000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.149.127.255", "evidence": [ { "udp_stream": 264, "frame_number": 27522, "display_filter": "frame.number == 27522", "timestamp_epoch": "1533965035.690340000" } ], "is_private": false, "observable_id": "observable-31863a77fc0432ae7d260c98", "last_seen_epoch": "1533965035.690340000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965035.690340000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.149.176.112", "evidence": [ { "udp_stream": 222, "frame_number": 23033, "display_filter": "frame.number == 23033", "timestamp_epoch": "1533964996.474799000" } ], "is_private": false, "observable_id": "observable-15dfe1372a688b8399428ac4", "last_seen_epoch": "1533964996.474799000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964996.474799000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.149.221.157", "evidence": [ { "udp_stream": 270, "frame_number": 27927, "display_filter": "frame.number == 27927", "timestamp_epoch": "1533965036.249006000" } ], "is_private": false, "observable_id": "observable-b86dddff7e18fd7f1c827aab", "last_seen_epoch": "1533965036.249006000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965036.249006000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.149.32.18", "evidence": [ { "udp_stream": 65, "frame_number": 5141, "display_filter": "frame.number == 5141", "timestamp_epoch": "1533964556.025527000" } ], "is_private": false, "observable_id": "observable-9bc494675bc4337ed6f75366", "last_seen_epoch": "1533964556.025527000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964556.025527000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.164.252.1", "evidence": [ { "udp_stream": 234, "frame_number": 23623, "display_filter": "frame.number == 23623", "timestamp_epoch": "1533964997.803829000" } ], "is_private": false, "observable_id": "observable-3b2af74d1b12f1a8c62ca573", "last_seen_epoch": "1533964997.803829000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964997.803829000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.165.0.72", "evidence": [ { "udp_stream": 205, "frame_number": 19619, "display_filter": "frame.number == 19619", "timestamp_epoch": "1533964962.605621000" } ], "is_private": false, "observable_id": "observable-29866ce56f613352d0a89e9c", "last_seen_epoch": "1533964962.605621000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964962.605621000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.165.113.198", "evidence": [ { "udp_stream": 117, "frame_number": 11114, "display_filter": "frame.number == 11114", "timestamp_epoch": "1533964901.056360000" } ], "is_private": false, "observable_id": "observable-25e31c3c39639a3080801ec0", "last_seen_epoch": "1533964901.056360000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964901.056360000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.165.9.33", "evidence": [ { "udp_stream": 300, "frame_number": 33970, "display_filter": "frame.number == 33970", "timestamp_epoch": "1533965157.910445000" } ], "is_private": false, "observable_id": "observable-b4064bfc9be0fd4141bd2f5b", "last_seen_epoch": "1533965157.910445000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965157.910445000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.173.10.244", "evidence": [ { "udp_stream": 259, "frame_number": 27332, "display_filter": "frame.number == 27332", "timestamp_epoch": "1533965035.434545000" } ], "is_private": false, "observable_id": "observable-ab59f8d211f3c137d7f38f86", "last_seen_epoch": "1533965035.434545000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965035.434545000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.173.104.93", "evidence": [ { "udp_stream": 266, "frame_number": 27558, "display_filter": "frame.number == 27558", "timestamp_epoch": "1533965035.720501000" } ], "is_private": false, "observable_id": "observable-a20651b716d3ae849646f751", "last_seen_epoch": "1533965035.720501000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965035.720501000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "54.175.110.202", "evidence": [ { "udp_stream": 117, "frame_number": 11114, "display_filter": "frame.number == 11114", "timestamp_epoch": "1533964901.056360000" } ], "is_private": false, "observable_id": "observable-306348588e7088547999a648", "last_seen_epoch": "1533964901.056360000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964901.056360000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.175.140.118", "evidence": [ { "udp_stream": 179, "frame_number": 17349, "display_filter": "frame.number == 17349", "timestamp_epoch": "1533964956.315471000" }, { "udp_stream": 182, "frame_number": 17855, "display_filter": "frame.number == 17855", "timestamp_epoch": "1533964957.358759000" } ], "is_private": false, "observable_id": "observable-fa86216648ea6941656ca452", "last_seen_epoch": "1533964957.358759000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964956.315471000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.175.180.42", "evidence": [ { "udp_stream": 280, "frame_number": 31704, "display_filter": "frame.number == 31704", "timestamp_epoch": "1533965100.817951000" } ], "is_private": false, "observable_id": "observable-34e2ffc35f5dd8e531fe7111", "last_seen_epoch": "1533965100.817951000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965100.817951000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "54.176.157.57", "evidence": [ { "udp_stream": 129, "frame_number": 12104, "display_filter": "frame.number == 12104", "timestamp_epoch": "1533964901.906766000" } ], "is_private": false, "observable_id": "observable-a95d058df01cf746c4bef8cc", "last_seen_epoch": "1533964901.906766000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964901.906766000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.176.31.176", "evidence": [ { "udp_stream": 129, "frame_number": 12104, "display_filter": "frame.number == 12104", "timestamp_epoch": "1533964901.906766000" } ], "is_private": false, "observable_id": "observable-0ad9f9ee2503fdcc8f9b123c", "last_seen_epoch": "1533964901.906766000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964901.906766000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.177.34.72", "evidence": [ { "udp_stream": 217, "frame_number": 20227, "display_filter": "frame.number == 20227", "timestamp_epoch": "1533964965.012520000" } ], "is_private": false, "observable_id": "observable-c0c1e11f86192c40abf26583", "last_seen_epoch": "1533964965.012520000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964965.012520000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.183.102.11", "evidence": [ { "udp_stream": 217, "frame_number": 20227, "display_filter": "frame.number == 20227", "timestamp_epoch": "1533964965.012520000" } ], "is_private": false, "observable_id": "observable-57bf02508a34ddfebbbc2039", "last_seen_epoch": "1533964965.012520000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964965.012520000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.183.154.61", "evidence": [ { "udp_stream": 217, "frame_number": 20227, "display_filter": "frame.number == 20227", "timestamp_epoch": "1533964965.012520000" } ], "is_private": false, "observable_id": "observable-f3803fa853964e7ee69e8b42", "last_seen_epoch": "1533964965.012520000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964965.012520000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "54.183.210.45", "evidence": [ { "udp_stream": 197, "frame_number": 19066, "display_filter": "frame.number == 19066", "timestamp_epoch": "1533964960.516077000" } ], "is_private": false, "observable_id": "observable-8d467e0c251cffee161ab947", "last_seen_epoch": "1533964960.516077000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964960.516077000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "54.183.248.197", "evidence": [ { "udp_stream": 217, "frame_number": 20227, "display_filter": "frame.number == 20227", "timestamp_epoch": "1533964965.012520000" } ], "is_private": false, "observable_id": "observable-b42161c14dce378dedd88031", "last_seen_epoch": "1533964965.012520000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964965.012520000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "54.183.95.126", "evidence": [ { "udp_stream": 102, "frame_number": 8976, "display_filter": "frame.number == 8976", "timestamp_epoch": "1533964898.938935000" } ], "is_private": false, "observable_id": "observable-673a24154812fe5a92a0c479", "last_seen_epoch": "1533964898.938935000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964898.938935000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "54.186.116.83", "evidence": [ { "udp_stream": 65, "frame_number": 5141, "display_filter": "frame.number == 5141", "timestamp_epoch": "1533964556.025527000" } ], "is_private": false, "observable_id": "observable-0f177f23f5644e02f25d0322", "last_seen_epoch": "1533964556.025527000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964556.025527000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "54.186.237.130", "evidence": [ { "udp_stream": 156, "frame_number": 14613, "display_filter": "frame.number == 14613", "timestamp_epoch": "1533964904.637787000" } ], "is_private": false, "observable_id": "observable-1846c7d36cf4fd3d5ffcf397", "last_seen_epoch": "1533964904.637787000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964904.637787000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.187.102.150", "evidence": [ { "udp_stream": 150, "frame_number": 14614, "display_filter": "frame.number == 14614", "timestamp_epoch": "1533964904.637907000" } ], "is_private": false, "observable_id": "observable-6f8def799300ed5c9422aaf0", "last_seen_epoch": "1533964904.637907000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964904.637907000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "54.187.167.76", "evidence": [ { "udp_stream": 270, "frame_number": 27927, "display_filter": "frame.number == 27927", "timestamp_epoch": "1533965036.249006000" } ], "is_private": false, "observable_id": "observable-4225f6dfcb070aea3e9e8902", "last_seen_epoch": "1533965036.249006000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965036.249006000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.187.181.128", "evidence": [ { "udp_stream": 65, "frame_number": 5141, "display_filter": "frame.number == 5141", "timestamp_epoch": "1533964556.025527000" } ], "is_private": false, "observable_id": "observable-658dad5c2ca448ebe56e13f9", "last_seen_epoch": "1533964556.025527000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964556.025527000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.187.200.180", "evidence": [ { "udp_stream": 264, "frame_number": 27522, "display_filter": "frame.number == 27522", "timestamp_epoch": "1533965035.690340000" } ], "is_private": false, "observable_id": "observable-4a430282c79fff2129fcf5f8", "last_seen_epoch": "1533965035.690340000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965035.690340000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.187.213.9", "evidence": [ { "udp_stream": 264, "frame_number": 27522, "display_filter": "frame.number == 27522", "timestamp_epoch": "1533965035.690340000" } ], "is_private": false, "observable_id": "observable-b8c0640106033639aaff4ef9", "last_seen_epoch": "1533965035.690340000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965035.690340000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.187.42.255", "evidence": [ { "udp_stream": 264, "frame_number": 27522, "display_filter": "frame.number == 27522", "timestamp_epoch": "1533965035.690340000" } ], "is_private": false, "observable_id": "observable-588bc75bdfcf0961d9f9f9e1", "last_seen_epoch": "1533965035.690340000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965035.690340000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.191.120.89", "evidence": [ { "udp_stream": 252, "frame_number": 26736, "display_filter": "frame.number == 26736", "timestamp_epoch": "1533965033.496493000" } ], "is_private": false, "observable_id": "observable-39812596beceb9a26a2d4c94", "last_seen_epoch": "1533965033.496493000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965033.496493000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "54.191.20.146", "evidence": [ { "udp_stream": 215, "frame_number": 20229, "display_filter": "frame.number == 20229", "timestamp_epoch": "1533964965.012616000" } ], "is_private": false, "observable_id": "observable-7e07f4566979d055956317cf", "last_seen_epoch": "1533964965.012616000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964965.012616000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "54.191.223.36", "evidence": [ { "udp_stream": 239, "frame_number": 24037, "display_filter": "frame.number == 24037", "timestamp_epoch": "1533964999.457617000" }, { "udp_stream": 264, "frame_number": 27522, "display_filter": "frame.number == 27522", "timestamp_epoch": "1533965035.690340000" } ], "is_private": false, "observable_id": "observable-94fbfb4d70c535df5dc622ff", "last_seen_epoch": "1533965035.690340000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964999.457617000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.191.224.161", "evidence": [ { "udp_stream": 252, "frame_number": 26736, "display_filter": "frame.number == 26736", "timestamp_epoch": "1533965033.496493000" } ], "is_private": false, "observable_id": "observable-2e4bf9a1861b41196a61fecc", "last_seen_epoch": "1533965033.496493000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965033.496493000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "54.191.4.242", "evidence": [ { "udp_stream": 150, "frame_number": 14614, "display_filter": "frame.number == 14614", "timestamp_epoch": "1533964904.637907000" } ], "is_private": false, "observable_id": "observable-72d0da305d189bbaa1e9ae61", "last_seen_epoch": "1533964904.637907000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964904.637907000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "54.193.113.6", "evidence": [ { "udp_stream": 262, "frame_number": 27340, "display_filter": "frame.number == 27340", "timestamp_epoch": "1533965035.445360000" } ], "is_private": false, "observable_id": "observable-d87c85880e289b3efb5ee611", "last_seen_epoch": "1533965035.445360000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965035.445360000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.193.14.224", "evidence": [ { "udp_stream": 102, "frame_number": 8976, "display_filter": "frame.number == 8976", "timestamp_epoch": "1533964898.938935000" } ], "is_private": false, "observable_id": "observable-2aedebdf1b37bf03c2cdfdc0", "last_seen_epoch": "1533964898.938935000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964898.938935000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.193.27.242", "evidence": [ { "udp_stream": 102, "frame_number": 8976, "display_filter": "frame.number == 8976", "timestamp_epoch": "1533964898.938935000" } ], "is_private": false, "observable_id": "observable-4b916056fa3832bb4db10943", "last_seen_epoch": "1533964898.938935000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964898.938935000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.193.79.237", "evidence": [ { "udp_stream": 197, "frame_number": 19066, "display_filter": "frame.number == 19066", "timestamp_epoch": "1533964960.516077000" } ], "is_private": false, "observable_id": "observable-2177029723f55999a429709e", "last_seen_epoch": "1533964960.516077000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964960.516077000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.193.88.44", "evidence": [ { "udp_stream": 262, "frame_number": 27340, "display_filter": "frame.number == 27340", "timestamp_epoch": "1533965035.445360000" } ], "is_private": false, "observable_id": "observable-702dff3b73afae166dc2027c", "last_seen_epoch": "1533965035.445360000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965035.445360000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "54.196.242.147", "evidence": [ { "udp_stream": 233, "frame_number": 23633, "display_filter": "frame.number == 23633", "timestamp_epoch": "1533964997.811829000" } ], "is_private": false, "observable_id": "observable-0ca8c2c8b5498c76535b793e", "last_seen_epoch": "1533964997.811829000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964997.811829000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.200.173.146", "evidence": [ { "udp_stream": 244, "frame_number": 26411, "display_filter": "frame.number == 26411", "timestamp_epoch": "1533965032.677118000" } ], "is_private": false, "observable_id": "observable-26b3c98aae9f123888131e56", "last_seen_epoch": "1533965032.677118000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965032.677118000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.200.4.214", "evidence": [ { "udp_stream": 239, "frame_number": 24037, "display_filter": "frame.number == 24037", "timestamp_epoch": "1533964999.457617000" }, { "udp_stream": 264, "frame_number": 27522, "display_filter": "frame.number == 27522", "timestamp_epoch": "1533965035.690340000" } ], "is_private": false, "observable_id": "observable-3ba29849927cc86da42f867e", "last_seen_epoch": "1533965035.690340000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964999.457617000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.201.23.177", "evidence": [ { "udp_stream": 222, "frame_number": 23033, "display_filter": "frame.number == 23033", "timestamp_epoch": "1533964996.474799000" } ], "is_private": false, "observable_id": "observable-0ffcf54c08f7d0c796c4a86b", "last_seen_epoch": "1533964996.474799000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964996.474799000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.203.249.16", "evidence": [ { "udp_stream": 162, "frame_number": 15556, "display_filter": "frame.number == 15556", "timestamp_epoch": "1533964906.746311000" } ], "is_private": false, "observable_id": "observable-bfd22d9682a55f792ea7a826", "last_seen_epoch": "1533964906.746311000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964906.746311000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.209.142.208", "evidence": [ { "udp_stream": 207, "frame_number": 19702, "display_filter": "frame.number == 19702", "timestamp_epoch": "1533964962.896098000" } ], "is_private": false, "observable_id": "observable-dd6177e43cee8d02103bacd5", "last_seen_epoch": "1533964962.896098000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964962.896098000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.209.175.132", "evidence": [ { "udp_stream": 250, "frame_number": 26727, "display_filter": "frame.number == 26727", "timestamp_epoch": "1533965033.481280000" } ], "is_private": false, "observable_id": "observable-82decfe34a787d49c7f5c3d8", "last_seen_epoch": "1533965033.481280000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965033.481280000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.209.175.196", "evidence": [ { "udp_stream": 179, "frame_number": 17349, "display_filter": "frame.number == 17349", "timestamp_epoch": "1533964956.315471000" }, { "udp_stream": 182, "frame_number": 17855, "display_filter": "frame.number == 17855", "timestamp_epoch": "1533964957.358759000" } ], "is_private": false, "observable_id": "observable-481cb7b46c2e99ad7eae95d5", "last_seen_epoch": "1533964957.358759000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964956.315471000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "54.209.46.223", "evidence": [ { "udp_stream": 207, "frame_number": 19702, "display_filter": "frame.number == 19702", "timestamp_epoch": "1533964962.896098000" } ], "is_private": false, "observable_id": "observable-d9b30efc9a481859c50ac5f8", "last_seen_epoch": "1533964962.896098000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964962.896098000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "54.209.71.223", "evidence": [ { "udp_stream": 112, "frame_number": 10606, "display_filter": "frame.number == 10606", "timestamp_epoch": "1533964900.584234000" } ], "is_private": false, "observable_id": "observable-702aef77e04cd424e9e68c7e", "last_seen_epoch": "1533964900.584234000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964900.584234000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.210.242.59", "evidence": [ { "udp_stream": 207, "frame_number": 19702, "display_filter": "frame.number == 19702", "timestamp_epoch": "1533964962.896098000" } ], "is_private": false, "observable_id": "observable-c0e45c50fbc6d6b6c136578c", "last_seen_epoch": "1533964962.896098000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964962.896098000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.210.250.119", "evidence": [ { "udp_stream": 280, "frame_number": 31704, "display_filter": "frame.number == 31704", "timestamp_epoch": "1533965100.817951000" } ], "is_private": false, "observable_id": "observable-bc973b86063f9d97408fc03a", "last_seen_epoch": "1533965100.817951000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965100.817951000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.210.58.162", "evidence": [ { "udp_stream": 190, "frame_number": 18568, "display_filter": "frame.number == 18568", "timestamp_epoch": "1533964959.365164000" } ], "is_private": false, "observable_id": "observable-76988637353c474e7387b2bd", "last_seen_epoch": "1533964959.365164000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964959.365164000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "54.214.11.239", "evidence": [ { "udp_stream": 162, "frame_number": 15556, "display_filter": "frame.number == 15556", "timestamp_epoch": "1533964906.746311000" } ], "is_private": false, "observable_id": "observable-e44edde17c00b00fd906f19f", "last_seen_epoch": "1533964906.746311000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964906.746311000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.214.247.4", "evidence": [ { "udp_stream": 162, "frame_number": 15556, "display_filter": "frame.number == 15556", "timestamp_epoch": "1533964906.746311000" } ], "is_private": false, "observable_id": "observable-00a2aa2a9c4679140ddb26d9", "last_seen_epoch": "1533964906.746311000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964906.746311000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.214.30.198", "evidence": [ { "udp_stream": 162, "frame_number": 15556, "display_filter": "frame.number == 15556", "timestamp_epoch": "1533964906.746311000" } ], "is_private": false, "observable_id": "observable-3b88e9c369fbb6b96b9fcab6", "last_seen_epoch": "1533964906.746311000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964906.746311000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.215.177.163", "evidence": [ { "udp_stream": 102, "frame_number": 8976, "display_filter": "frame.number == 8976", "timestamp_epoch": "1533964898.938935000" } ], "is_private": false, "observable_id": "observable-ec32f74d0f46743769015cc3", "last_seen_epoch": "1533964898.938935000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964898.938935000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.215.190.205", "evidence": [ { "udp_stream": 102, "frame_number": 8976, "display_filter": "frame.number == 8976", "timestamp_epoch": "1533964898.938935000" } ], "is_private": false, "observable_id": "observable-e99e186af81eb062c86e3414", "last_seen_epoch": "1533964898.938935000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964898.938935000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.217.209.217", "evidence": [ { "udp_stream": 285, "frame_number": 31674, "display_filter": "frame.number == 31674", "timestamp_epoch": "1533965100.796522000" } ], "is_private": false, "observable_id": "observable-9cdadca08a9f3b20f4601eaf", "last_seen_epoch": "1533965100.796522000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965100.796522000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "54.217.217.143", "evidence": [ { "udp_stream": 285, "frame_number": 31674, "display_filter": "frame.number == 31674", "timestamp_epoch": "1533965100.796522000" } ], "is_private": false, "observable_id": "observable-3f2cdcb984f12b5566780801", "last_seen_epoch": "1533965100.796522000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965100.796522000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.217.228.98", "evidence": [ { "udp_stream": 285, "frame_number": 31674, "display_filter": "frame.number == 31674", "timestamp_epoch": "1533965100.796522000" } ], "is_private": false, "observable_id": "observable-35e40db894ac3706b8a4c133", "last_seen_epoch": "1533965100.796522000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965100.796522000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.217.236.197", "evidence": [ { "udp_stream": 285, "frame_number": 31674, "display_filter": "frame.number == 31674", "timestamp_epoch": "1533965100.796522000" } ], "is_private": false, "observable_id": "observable-efa14573be4441a47ee7b727", "last_seen_epoch": "1533965100.796522000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965100.796522000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.228.184.13", "evidence": [ { "udp_stream": 285, "frame_number": 31674, "display_filter": "frame.number == 31674", "timestamp_epoch": "1533965100.796522000" } ], "is_private": false, "observable_id": "observable-600dc3a1cce721f9c374b84c", "last_seen_epoch": "1533965100.796522000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965100.796522000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.228.212.156", "evidence": [ { "udp_stream": 285, "frame_number": 31674, "display_filter": "frame.number == 31674", "timestamp_epoch": "1533965100.796522000" } ], "is_private": false, "observable_id": "observable-0ef2937cbd07ece3edd64d28", "last_seen_epoch": "1533965100.796522000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965100.796522000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.236.143.74", "evidence": [ { "udp_stream": 240, "frame_number": 24040, "display_filter": "frame.number == 24040", "timestamp_epoch": "1533964999.467395000" } ], "is_private": false, "observable_id": "observable-e75b6f24cee18addd3227c06", "last_seen_epoch": "1533964999.467395000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964999.467395000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.236.168.144", "evidence": [ { "udp_stream": 205, "frame_number": 19619, "display_filter": "frame.number == 19619", "timestamp_epoch": "1533964962.605621000" } ], "is_private": false, "observable_id": "observable-74870aa007904c720c6826ac", "last_seen_epoch": "1533964962.605621000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964962.605621000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "54.236.177.89", "evidence": [ { "udp_stream": 250, "frame_number": 26727, "display_filter": "frame.number == 26727", "timestamp_epoch": "1533965033.481280000" } ], "is_private": false, "observable_id": "observable-811d336be6c56477bff29e18", "last_seen_epoch": "1533965033.481280000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965033.481280000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.236.222.119", "evidence": [ { "udp_stream": 266, "frame_number": 27558, "display_filter": "frame.number == 27558", "timestamp_epoch": "1533965035.720501000" } ], "is_private": false, "observable_id": "observable-7114b0821292e2887952dd73", "last_seen_epoch": "1533965035.720501000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965035.720501000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.241.143.220", "evidence": [ { "udp_stream": 102, "frame_number": 8976, "display_filter": "frame.number == 8976", "timestamp_epoch": "1533964898.938935000" } ], "is_private": false, "observable_id": "observable-1d62a34407800397a39cdf83", "last_seen_epoch": "1533964898.938935000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964898.938935000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.241.145.51", "evidence": [ { "udp_stream": 102, "frame_number": 8976, "display_filter": "frame.number == 8976", "timestamp_epoch": "1533964898.938935000" } ], "is_private": false, "observable_id": "observable-8d33d7204ac38bd8e38d2097", "last_seen_epoch": "1533964898.938935000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964898.938935000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.241.184.236", "evidence": [ { "udp_stream": 262, "frame_number": 27340, "display_filter": "frame.number == 27340", "timestamp_epoch": "1533965035.445360000" } ], "is_private": false, "observable_id": "observable-727d514e278bf2b815072736", "last_seen_epoch": "1533965035.445360000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965035.445360000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "54.241.31.242", "evidence": [ { "udp_stream": 260, "frame_number": 27324, "display_filter": "frame.number == 27324", "timestamp_epoch": "1533965035.406855000" } ], "is_private": false, "observable_id": "observable-11542b87bbadaaa0e07a7ab6", "last_seen_epoch": "1533965035.406855000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965035.406855000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.244.243.41", "evidence": [ { "udp_stream": 162, "frame_number": 15556, "display_filter": "frame.number == 15556", "timestamp_epoch": "1533964906.746311000" } ], "is_private": false, "observable_id": "observable-3707e64197e83c9452e2ff0e", "last_seen_epoch": "1533964906.746311000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964906.746311000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.244.245.107", "evidence": [ { "udp_stream": 162, "frame_number": 15556, "display_filter": "frame.number == 15556", "timestamp_epoch": "1533964906.746311000" } ], "is_private": false, "observable_id": "observable-0b4a4e0b808b6cb7bab0573a", "last_seen_epoch": "1533964906.746311000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964906.746311000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "54.246.133.167", "evidence": [ { "udp_stream": 173, "frame_number": 16524, "display_filter": "frame.number == 16524", "timestamp_epoch": "1533964909.718959000" } ], "is_private": false, "observable_id": "observable-f0b66162802a0121efe85a7e", "last_seen_epoch": "1533964909.718959000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964909.718959000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.64.58.164", "evidence": [ { "udp_stream": 304, "frame_number": 35517, "display_filter": "frame.number == 35517", "timestamp_epoch": "1533965160.353225000" } ], "is_private": false, "observable_id": "observable-98c8096a8f84e88d2c73e128", "last_seen_epoch": "1533965160.353225000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965160.353225000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.64.66.233", "evidence": [ { "udp_stream": 304, "frame_number": 35517, "display_filter": "frame.number == 35517", "timestamp_epoch": "1533965160.353225000" } ], "is_private": false, "observable_id": "observable-271ededa53b2794e47edaf27", "last_seen_epoch": "1533965160.353225000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965160.353225000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.65.114.208", "evidence": [ { "udp_stream": 304, "frame_number": 35517, "display_filter": "frame.number == 35517", "timestamp_epoch": "1533965160.353225000" } ], "is_private": false, "observable_id": "observable-36109b85b666b3549a53de30", "last_seen_epoch": "1533965160.353225000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965160.353225000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.67.106.41", "evidence": [ { "udp_stream": 277, "frame_number": 30810, "display_filter": "frame.number == 30810", "timestamp_epoch": "1533965099.289135000" } ], "is_private": false, "observable_id": "observable-d94d286b0dc0c8516459b37b", "last_seen_epoch": "1533965099.289135000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965099.289135000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.68.131.249", "evidence": [ { "udp_stream": 65, "frame_number": 5141, "display_filter": "frame.number == 5141", "timestamp_epoch": "1533964556.025527000" } ], "is_private": false, "observable_id": "observable-c1bdfc07ed284c17727b90f3", "last_seen_epoch": "1533964556.025527000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964556.025527000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.68.251.4", "evidence": [ { "udp_stream": 270, "frame_number": 27927, "display_filter": "frame.number == 27927", "timestamp_epoch": "1533965036.249006000" } ], "is_private": false, "observable_id": "observable-bf67beaa8651ac2d2f40783c", "last_seen_epoch": "1533965036.249006000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965036.249006000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.68.83.10", "evidence": [ { "udp_stream": 65, "frame_number": 5141, "display_filter": "frame.number == 5141", "timestamp_epoch": "1533964556.025527000" } ], "is_private": false, "observable_id": "observable-4f0079a4aeeb42d858c9e556", "last_seen_epoch": "1533964556.025527000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964556.025527000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.68.84.37", "evidence": [ { "udp_stream": 65, "frame_number": 5141, "display_filter": "frame.number == 5141", "timestamp_epoch": "1533964556.025527000" } ], "is_private": false, "observable_id": "observable-8cb25072bbba4051d6398dc6", "last_seen_epoch": "1533964556.025527000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964556.025527000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.68.91.165", "evidence": [ { "udp_stream": 145, "frame_number": 13562, "display_filter": "frame.number == 13562", "timestamp_epoch": "1533964903.558314000" } ], "is_private": false, "observable_id": "observable-52e47c41fda0d201e54ca92e", "last_seen_epoch": "1533964903.558314000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964903.558314000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.69.174.218", "evidence": [ { "udp_stream": 231, "frame_number": 23599, "display_filter": "frame.number == 23599", "timestamp_epoch": "1533964997.757167000" } ], "is_private": false, "observable_id": "observable-da64b37d3213bff2b68b5579", "last_seen_epoch": "1533964997.757167000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964997.757167000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.69.219.111", "evidence": [ { "udp_stream": 239, "frame_number": 24037, "display_filter": "frame.number == 24037", "timestamp_epoch": "1533964999.457617000" }, { "udp_stream": 264, "frame_number": 27522, "display_filter": "frame.number == 27522", "timestamp_epoch": "1533965035.690340000" } ], "is_private": false, "observable_id": "observable-f61857651693821df0111dda", "last_seen_epoch": "1533965035.690340000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964999.457617000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.69.22.79", "evidence": [ { "udp_stream": 239, "frame_number": 24037, "display_filter": "frame.number == 24037", "timestamp_epoch": "1533964999.457617000" } ], "is_private": false, "observable_id": "observable-752736fb55b883341c899a6b", "last_seen_epoch": "1533964999.457617000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964999.457617000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.69.25.207", "evidence": [ { "udp_stream": 270, "frame_number": 27927, "display_filter": "frame.number == 27927", "timestamp_epoch": "1533965036.249006000" } ], "is_private": false, "observable_id": "observable-ae15c8c0e383a590a2bd28e5", "last_seen_epoch": "1533965036.249006000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965036.249006000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "54.69.70.7", "evidence": [ { "udp_stream": 98, "frame_number": 8958, "display_filter": "frame.number == 8958", "timestamp_epoch": "1533964898.930359000" }, { "udp_stream": 231, "frame_number": 23599, "display_filter": "frame.number == 23599", "timestamp_epoch": "1533964997.757167000" } ], "is_private": false, "observable_id": "observable-fec070af895fe97c7370e6f1", "last_seen_epoch": "1533964997.757167000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964898.930359000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.69.93.253", "evidence": [ { "udp_stream": 98, "frame_number": 8958, "display_filter": "frame.number == 8958", "timestamp_epoch": "1533964898.930359000" }, { "udp_stream": 231, "frame_number": 23599, "display_filter": "frame.number == 23599", "timestamp_epoch": "1533964997.757167000" } ], "is_private": false, "observable_id": "observable-3a30d195a01588057c7446ec", "last_seen_epoch": "1533964997.757167000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964898.930359000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.70.199.124", "evidence": [ { "udp_stream": 145, "frame_number": 13562, "display_filter": "frame.number == 13562", "timestamp_epoch": "1533964903.558314000" } ], "is_private": false, "observable_id": "observable-3f5725cdf349251b4c962676", "last_seen_epoch": "1533964903.558314000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964903.558314000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.71.113.104", "evidence": [ { "udp_stream": 98, "frame_number": 8958, "display_filter": "frame.number == 8958", "timestamp_epoch": "1533964898.930359000" }, { "udp_stream": 231, "frame_number": 23599, "display_filter": "frame.number == 23599", "timestamp_epoch": "1533964997.757167000" } ], "is_private": false, "observable_id": "observable-18a39b8a1e8a5d78d39d5289", "last_seen_epoch": "1533964997.757167000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964898.930359000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.82.13.247", "evidence": [ { "udp_stream": 273, "frame_number": 30652, "display_filter": "frame.number == 30652", "timestamp_epoch": "1533965099.045919000" } ], "is_private": false, "observable_id": "observable-854d48a11e2f0fd192f48eca", "last_seen_epoch": "1533965099.045919000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965099.045919000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "54.84.105.44", "evidence": [ { "udp_stream": 240, "frame_number": 24040, "display_filter": "frame.number == 24040", "timestamp_epoch": "1533964999.467395000" } ], "is_private": false, "observable_id": "observable-1b76a1f0f40604c73d394033", "last_seen_epoch": "1533964999.467395000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964999.467395000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.84.37.167", "evidence": [ { "udp_stream": 190, "frame_number": 18568, "display_filter": "frame.number == 18568", "timestamp_epoch": "1533964959.365164000" } ], "is_private": false, "observable_id": "observable-cc7b81e9fc19ce348c097b8e", "last_seen_epoch": "1533964959.365164000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964959.365164000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "54.92.93.205", "evidence": [ { "udp_stream": 304, "frame_number": 35517, "display_filter": "frame.number == 35517", "timestamp_epoch": "1533965160.353225000" } ], "is_private": false, "observable_id": "observable-4cfa1172775acd1c34d66865", "last_seen_epoch": "1533965160.353225000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965160.353225000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "63.251.109.87", "evidence": [ { "udp_stream": 295, "frame_number": 32962, "display_filter": "frame.number == 32962", "timestamp_epoch": "1533965136.678702000" }, { "udp_stream": 297, "frame_number": 33093, "display_filter": "frame.number == 33093", "timestamp_epoch": "1533965137.114452000" }, { "udp_stream": 298, "frame_number": 33377, "display_filter": "frame.number == 33377", "timestamp_epoch": "1533965137.904526000" }, { "udp_stream": 307, "frame_number": 38809, "display_filter": "frame.number == 38809", "timestamp_epoch": "1533965240.205005000" } ], "is_private": false, "observable_id": "observable-3bcd568fe9b5ae7182a7cf78", "last_seen_epoch": "1533965240.205005000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965136.678702000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "63.251.252.12", "evidence": [ { "udp_stream": 216, "frame_number": 20234, "display_filter": "frame.number == 20234", "timestamp_epoch": "1533964965.013702000" } ], "is_private": false, "observable_id": "observable-0a099613f76588b890f09ff9", "last_seen_epoch": "1533964965.013702000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964965.013702000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "63.251.253.231", "evidence": [ { "udp_stream": 282, "frame_number": 31833, "display_filter": "frame.number == 31833", "timestamp_epoch": "1533965100.973117000" } ], "is_private": false, "observable_id": "observable-6fcd67125f3051f8a2b9a785", "last_seen_epoch": "1533965100.973117000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965100.973117000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "63.251.253.232", "evidence": [ { "udp_stream": 282, "frame_number": 31833, "display_filter": "frame.number == 31833", "timestamp_epoch": "1533965100.973117000" } ], "is_private": false, "observable_id": "observable-d8866312a684198ef76baa60", "last_seen_epoch": "1533965100.973117000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965100.973117000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "63.251.95.2", "evidence": [ { "udp_stream": 142, "frame_number": 13537, "display_filter": "frame.number == 13537", "timestamp_epoch": "1533964903.535108000" } ], "is_private": false, "observable_id": "observable-57abb6e8ec4642e39878b394", "last_seen_epoch": "1533964903.535108000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964903.535108000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "63.251.95.3", "evidence": [ { "udp_stream": 142, "frame_number": 13537, "display_filter": "frame.number == 13537", "timestamp_epoch": "1533964903.535108000" } ], "is_private": false, "observable_id": "observable-ccba202c16c5f14b2f1e5816", "last_seen_epoch": "1533964903.535108000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964903.535108000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "63.251.95.4", "evidence": [ { "udp_stream": 142, "frame_number": 13537, "display_filter": "frame.number == 13537", "timestamp_epoch": "1533964903.535108000" } ], "is_private": false, "observable_id": "observable-39350972ea69ce4d81fb8891", "last_seen_epoch": "1533964903.535108000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964903.535108000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "64.125.223.109", "evidence": [ { "udp_stream": 288, "frame_number": 32219, "display_filter": "frame.number == 32219", "timestamp_epoch": "1533965102.184319000" } ], "is_private": false, "observable_id": "observable-6b35643c27a83f5e670d00bc", "last_seen_epoch": "1533965102.184319000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965102.184319000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "64.233.161.120", "evidence": [ { "udp_stream": 151, "frame_number": 14626, "display_filter": "frame.number == 14626", "timestamp_epoch": "1533964904.641770000" } ], "is_private": false, "observable_id": "observable-5d8d21d22a05e9a0f15c8ff4", "last_seen_epoch": "1533964904.641770000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964904.641770000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "64.233.161.94", "evidence": [ { "udp_stream": 151, "frame_number": 14626, "display_filter": "frame.number == 14626", "timestamp_epoch": "1533964904.641770000" } ], "is_private": false, "observable_id": "observable-edae78360d2be19f029260f9", "last_seen_epoch": "1533964904.641770000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964904.641770000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "64.233.171.120", "evidence": [ { "udp_stream": 151, "frame_number": 14626, "display_filter": "frame.number == 14626", "timestamp_epoch": "1533964904.641770000" } ], "is_private": false, "observable_id": "observable-b2e2c1287bbbfb50bcf1e3b3", "last_seen_epoch": "1533964904.641770000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964904.641770000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "64.233.171.94", "evidence": [ { "udp_stream": 151, "frame_number": 14626, "display_filter": "frame.number == 14626", "timestamp_epoch": "1533964904.641770000" } ], "is_private": false, "observable_id": "observable-7e8b9352c862f7bcb123e460", "last_seen_epoch": "1533964904.641770000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964904.641770000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "64.233.184.120", "evidence": [ { "udp_stream": 151, "frame_number": 14626, "display_filter": "frame.number == 14626", "timestamp_epoch": "1533964904.641770000" } ], "is_private": false, "observable_id": "observable-b28e3c83bd87e207501c9b19", "last_seen_epoch": "1533964904.641770000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964904.641770000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "64.233.184.94", "evidence": [ { "udp_stream": 151, "frame_number": 14626, "display_filter": "frame.number == 14626", "timestamp_epoch": "1533964904.641770000" } ], "is_private": false, "observable_id": "observable-f1064ed1a69598839a2ca0df", "last_seen_epoch": "1533964904.641770000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964904.641770000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "64.38.119.27", "evidence": [ { "udp_stream": 275, "frame_number": 30649, "display_filter": "frame.number == 30649", "timestamp_epoch": "1533965099.045804000" } ], "is_private": false, "observable_id": "observable-c0d27db1a0877b9380b89947", "last_seen_epoch": "1533965099.045804000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965099.045804000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "64.41.197.55", "evidence": [ { "udp_stream": 135, "frame_number": 12799, "display_filter": "frame.number == 12799", "timestamp_epoch": "1533964902.763199000" } ], "is_private": false, "observable_id": "observable-6b11426fca27e8a67ddd5f41", "last_seen_epoch": "1533964902.763199000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964902.763199000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "64.41.197.60", "evidence": [ { "udp_stream": 135, "frame_number": 12799, "display_filter": "frame.number == 12799", "timestamp_epoch": "1533964902.763199000" } ], "is_private": false, "observable_id": "observable-470aee9fc573ff1fe369e140", "last_seen_epoch": "1533964902.763199000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964902.763199000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "64.7.200.2", "evidence": [ { "udp_stream": 142, "frame_number": 13537, "display_filter": "frame.number == 13537", "timestamp_epoch": "1533964903.535108000" } ], "is_private": false, "observable_id": "observable-49b77e0e18b015741218dd73", "last_seen_epoch": "1533964903.535108000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964903.535108000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "64.7.200.3", "evidence": [ { "udp_stream": 142, "frame_number": 13537, "display_filter": "frame.number == 13537", "timestamp_epoch": "1533964903.535108000" } ], "is_private": false, "observable_id": "observable-01efa668bd26c00640bbc8d9", "last_seen_epoch": "1533964903.535108000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964903.535108000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "64.7.200.4", "evidence": [ { "udp_stream": 142, "frame_number": 13537, "display_filter": "frame.number == 13537", "timestamp_epoch": "1533964903.535108000" } ], "is_private": false, "observable_id": "observable-9a0a5eb8264730f0ca59f104", "last_seen_epoch": "1533964903.535108000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964903.535108000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "64.7.200.5", "evidence": [ { "udp_stream": 142, "frame_number": 13537, "display_filter": "frame.number == 13537", "timestamp_epoch": "1533964903.535108000" } ], "is_private": false, "observable_id": "observable-3c9bcb03db1dbf2848bbe936", "last_seen_epoch": "1533964903.535108000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964903.535108000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "64.7.201.2", "evidence": [ { "udp_stream": 142, "frame_number": 13537, "display_filter": "frame.number == 13537", "timestamp_epoch": "1533964903.535108000" } ], "is_private": false, "observable_id": "observable-71e2ebbb332abcdf14bf148b", "last_seen_epoch": "1533964903.535108000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964903.535108000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "64.7.201.3", "evidence": [ { "udp_stream": 142, "frame_number": 13537, "display_filter": "frame.number == 13537", "timestamp_epoch": "1533964903.535108000" } ], "is_private": false, "observable_id": "observable-c2e84bfeaa8465437332ebc3", "last_seen_epoch": "1533964903.535108000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964903.535108000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "64.7.201.4", "evidence": [ { "udp_stream": 142, "frame_number": 13537, "display_filter": "frame.number == 13537", "timestamp_epoch": "1533964903.535108000" } ], "is_private": false, "observable_id": "observable-17bfaf935f64e5fbe665afa0", "last_seen_epoch": "1533964903.535108000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964903.535108000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "64.7.201.5", "evidence": [ { "udp_stream": 142, "frame_number": 13537, "display_filter": "frame.number == 13537", "timestamp_epoch": "1533964903.535108000" } ], "is_private": false, "observable_id": "observable-57070dfc7d2e629dca557f3f", "last_seen_epoch": "1533964903.535108000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964903.535108000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "64.7.205.2", "evidence": [ { "udp_stream": 142, "frame_number": 13537, "display_filter": "frame.number == 13537", "timestamp_epoch": "1533964903.535108000" } ], "is_private": false, "observable_id": "observable-775083b89577e0a4aa974e78", "last_seen_epoch": "1533964903.535108000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964903.535108000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "67.195.229.45", "evidence": [ { "udp_stream": 81, "frame_number": 6113, "display_filter": "frame.number == 6113", "timestamp_epoch": "1533964559.840586000" }, { "udp_stream": 85, "frame_number": 6273, "display_filter": "frame.number == 6273", "timestamp_epoch": "1533964560.304978000" } ], "is_private": false, "observable_id": "observable-cd2da6469743ebdeea4fa4dd", "last_seen_epoch": "1533964560.304978000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964559.840586000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "69.168.106.81", "evidence": [ { "udp_stream": 219, "frame_number": 20551, "display_filter": "frame.number == 20551", "timestamp_epoch": "1533964965.682355000" } ], "is_private": false, "observable_id": "observable-7068cfeb333bd65da1b22a0c", "last_seen_epoch": "1533964965.682355000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964965.682355000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "69.174.248.224", "evidence": [ { "udp_stream": 228, "frame_number": 23321, "display_filter": "frame.number == 23321", "timestamp_epoch": "1533964997.328339000" } ], "is_private": false, "observable_id": "observable-f4c102db0976aed41e44ef09", "last_seen_epoch": "1533964997.328339000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964997.328339000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "69.174.248.228", "evidence": [ { "udp_stream": 77, "frame_number": 5866, "display_filter": "frame.number == 5866", "timestamp_epoch": "1533964559.464580000" }, { "udp_stream": 80, "frame_number": 6137, "display_filter": "frame.number == 6137", "timestamp_epoch": "1533964559.872487000" } ], "is_private": false, "observable_id": "observable-f999d5bc317fa9b8c1f96ebb", "last_seen_epoch": "1533964559.872487000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964559.464580000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "69.194.244.11", "evidence": [ { "udp_stream": 62, "frame_number": 5145, "display_filter": "frame.number == 5145", "timestamp_epoch": "1533964556.026779000" } ], "is_private": false, "observable_id": "observable-74f879bff1c4d911a68379d0", "last_seen_epoch": "1533964556.026779000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964556.026779000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "70.42.132.5", "evidence": [ { "udp_stream": 281, "frame_number": 31703, "display_filter": "frame.number == 31703", "timestamp_epoch": "1533965100.814252000" } ], "is_private": false, "observable_id": "observable-2c670dcfc0aa8037853ad80c", "last_seen_epoch": "1533965100.814252000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965100.814252000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "72.21.81.200", "evidence": [ { "udp_stream": 86, "frame_number": 6513, "display_filter": "frame.number == 6513", "timestamp_epoch": "1533964574.365861000" }, { "udp_stream": 366, "frame_number": 46919, "display_filter": "frame.number == 46919", "timestamp_epoch": "1533965798.750795000" } ], "is_private": false, "observable_id": "observable-5f5a3f6ad056427a4962d51b", "last_seen_epoch": "1533965798.750795000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964574.365861000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "72.21.91.113", "evidence": [ { "udp_stream": 204, "frame_number": 19335, "display_filter": "frame.number == 19335", "timestamp_epoch": "1533964961.815071000" } ], "is_private": false, "observable_id": "observable-2015ff731618f98609ef5b64", "last_seen_epoch": "1533964961.815071000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964961.815071000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "72.5.64.63", "evidence": [ { "udp_stream": 253, "frame_number": 26821, "display_filter": "frame.number == 26821", "timestamp_epoch": "1533965033.693499000" } ], "is_private": false, "observable_id": "observable-f91ed4cef3562179f8f28f67", "last_seen_epoch": "1533965033.693499000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965033.693499000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "74.119.117.100", "evidence": [ { "udp_stream": 338, "frame_number": 43659, "display_filter": "frame.number == 43659", "timestamp_epoch": "1533965783.084459000" } ], "is_private": false, "observable_id": "observable-977962eadce3483aefb46cca", "last_seen_epoch": "1533965783.084459000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965783.084459000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "74.119.117.129", "evidence": [ { "udp_stream": 161, "frame_number": 15402, "display_filter": "frame.number == 15402", "timestamp_epoch": "1533964906.564513000" } ], "is_private": false, "observable_id": "observable-e90165ced29ebd8a28917130", "last_seen_epoch": "1533964906.564513000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964906.564513000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "74.119.117.70", "evidence": [ { "udp_stream": 143, "frame_number": 13517, "display_filter": "frame.number == 13517", "timestamp_epoch": "1533964903.515128000" } ], "is_private": false, "observable_id": "observable-503bc9b0064e5ec900b14608", "last_seen_epoch": "1533964903.515128000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964903.515128000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "74.119.117.94", "evidence": [ { "udp_stream": 167, "frame_number": 15991, "display_filter": "frame.number == 15991", "timestamp_epoch": "1533964908.383676000" } ], "is_private": false, "observable_id": "observable-2782a69ec685fa5e0f316f95", "last_seen_epoch": "1533964908.383676000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964908.383676000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "74.121.136.131", "evidence": [ { "udp_stream": 61, "frame_number": 5120, "display_filter": "frame.number == 5120", "timestamp_epoch": "1533964555.984165000" } ], "is_private": false, "observable_id": "observable-9fa1127a0b17628d20f8923f", "last_seen_epoch": "1533964555.984165000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964555.984165000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "74.125.126.120", "evidence": [ { "udp_stream": 151, "frame_number": 14626, "display_filter": "frame.number == 14626", "timestamp_epoch": "1533964904.641770000" } ], "is_private": false, "observable_id": "observable-63212db3891673008f57406b", "last_seen_epoch": "1533964904.641770000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964904.641770000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "74.125.126.94", "evidence": [ { "udp_stream": 151, "frame_number": 14626, "display_filter": "frame.number == 14626", "timestamp_epoch": "1533964904.641770000" } ], "is_private": false, "observable_id": "observable-013b786627fb3c5bfdb18a74", "last_seen_epoch": "1533964904.641770000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964904.641770000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "74.125.195.154", "evidence": [ { "udp_stream": 57, "frame_number": 4326, "display_filter": "frame.number == 4326", "timestamp_epoch": "1533964554.232211000" }, { "udp_stream": 289, "frame_number": 32653, "display_filter": "frame.number == 32653", "timestamp_epoch": "1533965134.234653000" }, { "udp_stream": 355, "frame_number": 45074, "display_filter": "frame.number == 45074", "timestamp_epoch": "1533965786.808030000" } ], "is_private": false, "observable_id": "observable-a9cac9058dcd5fed3c4fb945", "last_seen_epoch": "1533965786.808030000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964554.232211000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "74.125.195.155", "evidence": [ { "udp_stream": 57, "frame_number": 4326, "display_filter": "frame.number == 4326", "timestamp_epoch": "1533964554.232211000" }, { "udp_stream": 289, "frame_number": 32653, "display_filter": "frame.number == 32653", "timestamp_epoch": "1533965134.234653000" }, { "udp_stream": 355, "frame_number": 45074, "display_filter": "frame.number == 45074", "timestamp_epoch": "1533965786.808030000" } ], "is_private": false, "observable_id": "observable-73df03384a9a4780cd485eee", "last_seen_epoch": "1533965786.808030000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964554.232211000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "74.125.195.156", "evidence": [ { "udp_stream": 57, "frame_number": 4326, "display_filter": "frame.number == 4326", "timestamp_epoch": "1533964554.232211000" }, { "udp_stream": 289, "frame_number": 32653, "display_filter": "frame.number == 32653", "timestamp_epoch": "1533965134.234653000" }, { "udp_stream": 355, "frame_number": 45074, "display_filter": "frame.number == 45074", "timestamp_epoch": "1533965786.808030000" } ], "is_private": false, "observable_id": "observable-1fe148a3aa09bc651c8a666e", "last_seen_epoch": "1533965786.808030000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964554.232211000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "74.125.195.157", "evidence": [ { "udp_stream": 57, "frame_number": 4326, "display_filter": "frame.number == 4326", "timestamp_epoch": "1533964554.232211000" }, { "udp_stream": 289, "frame_number": 32653, "display_filter": "frame.number == 32653", "timestamp_epoch": "1533965134.234653000" }, { "udp_stream": 355, "frame_number": 45074, "display_filter": "frame.number == 45074", "timestamp_epoch": "1533965786.808030000" } ], "is_private": false, "observable_id": "observable-ec083a1bbc668d0296ab1a54", "last_seen_epoch": "1533965786.808030000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964554.232211000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "74.125.200.120", "evidence": [ { "udp_stream": 151, "frame_number": 14626, "display_filter": "frame.number == 14626", "timestamp_epoch": "1533964904.641770000" } ], "is_private": false, "observable_id": "observable-fa58b1db6b21751df6dec6f7", "last_seen_epoch": "1533964904.641770000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964904.641770000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "74.125.200.94", "evidence": [ { "udp_stream": 151, "frame_number": 14626, "display_filter": "frame.number == 14626", "timestamp_epoch": "1533964904.641770000" } ], "is_private": false, "observable_id": "observable-356f70f0ac544bf156dc62a8", "last_seen_epoch": "1533964904.641770000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964904.641770000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "74.125.23.120", "evidence": [ { "udp_stream": 151, "frame_number": 14626, "display_filter": "frame.number == 14626", "timestamp_epoch": "1533964904.641770000" } ], "is_private": false, "observable_id": "observable-cd9b749be1762153677779c4", "last_seen_epoch": "1533964904.641770000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964904.641770000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "74.125.23.94", "evidence": [ { "udp_stream": 151, "frame_number": 14626, "display_filter": "frame.number == 14626", "timestamp_epoch": "1533964904.641770000" } ], "is_private": false, "observable_id": "observable-fdb2408a3655a79d8eeece3f", "last_seen_epoch": "1533964904.641770000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964904.641770000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "74.125.28.120", "evidence": [ { "udp_stream": 151, "frame_number": 14626, "display_filter": "frame.number == 14626", "timestamp_epoch": "1533964904.641770000" } ], "is_private": false, "observable_id": "observable-60dda77a9eff23c4f2732415", "last_seen_epoch": "1533964904.641770000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964904.641770000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "74.125.28.94", "evidence": [ { "udp_stream": 151, "frame_number": 14626, "display_filter": "frame.number == 14626", "timestamp_epoch": "1533964904.641770000" } ], "is_private": false, "observable_id": "observable-1e9e131d8aab0cbd9cd804b1", "last_seen_epoch": "1533964904.641770000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964904.641770000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "74.214.196.133", "evidence": [ { "udp_stream": 144, "frame_number": 13593, "display_filter": "frame.number == 13593", "timestamp_epoch": "1533964903.573032000" } ], "is_private": false, "observable_id": "observable-f21f67b77af244feb066130d", "last_seen_epoch": "1533964903.573032000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964903.573032000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "74.214.196.134", "evidence": [ { "udp_stream": 144, "frame_number": 13593, "display_filter": "frame.number == 13593", "timestamp_epoch": "1533964903.573032000" } ], "is_private": false, "observable_id": "observable-4822415353743f64abee4b0b", "last_seen_epoch": "1533964903.573032000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964903.573032000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "74.217.250.126", "evidence": [ { "udp_stream": 278, "frame_number": 30782, "display_filter": "frame.number == 30782", "timestamp_epoch": "1533965099.269249000" } ], "is_private": false, "observable_id": "observable-cb9a7b5315595eee242f997e", "last_seen_epoch": "1533965099.269249000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965099.269249000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "74.6.34.27", "evidence": [ { "udp_stream": 64, "frame_number": 5121, "display_filter": "frame.number == 5121", "timestamp_epoch": "1533964555.984478000" }, { "udp_stream": 363, "frame_number": 46038, "display_filter": "frame.number == 46038", "timestamp_epoch": "1533965789.567878000" } ], "is_private": false, "observable_id": "observable-adb94aae525ba243831ca0e4", "last_seen_epoch": "1533965789.567878000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964555.984478000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "77.88.21.119", "evidence": [ { "udp_stream": 52, "frame_number": 3310, "display_filter": "frame.number == 3310", "timestamp_epoch": "1533964552.683616000" }, { "udp_stream": 344, "frame_number": 43729, "display_filter": "frame.number == 43729", "timestamp_epoch": "1533965783.276443000" } ], "is_private": false, "observable_id": "observable-baa1ac3d771d33f876e2c065", "last_seen_epoch": "1533965783.276443000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964552.683616000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "77.88.21.38", "evidence": [ { "udp_stream": 88, "frame_number": 7089, "display_filter": "frame.number == 7089", "timestamp_epoch": "1533964677.421170000" }, { "udp_stream": 319, "frame_number": 39904, "display_filter": "frame.number == 39904", "timestamp_epoch": "1533965605.965885000" } ], "is_private": false, "observable_id": "observable-128824625206f8b46095a377", "last_seen_epoch": "1533965605.965885000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964677.421170000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "77.88.21.90", "evidence": [ { "udp_stream": 44, "frame_number": 3197, "display_filter": "frame.number == 3197", "timestamp_epoch": "1533964552.405569000" }, { "udp_stream": 337, "frame_number": 43651, "display_filter": "frame.number == 43651", "timestamp_epoch": "1533965783.060399000" } ], "is_private": false, "observable_id": "observable-d9cfaf09ac939c262dd4f5ac", "last_seen_epoch": "1533965783.060399000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964552.405569000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "8.247.90.250", "evidence": [ { "udp_stream": 107, "frame_number": 9794, "display_filter": "frame.number == 9794", "timestamp_epoch": "1533964899.640925000" } ], "is_private": false, "observable_id": "observable-8b362f38418bb924b1ca6f55", "last_seen_epoch": "1533964899.640925000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964899.640925000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "8.39.36.142", "evidence": [ { "udp_stream": 175, "frame_number": 16602, "display_filter": "frame.number == 16602", "timestamp_epoch": "1533964910.201908000" } ], "is_private": false, "observable_id": "observable-61396f391c29efe596973a1b", "last_seen_epoch": "1533964910.201908000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964910.201908000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "8.39.36.143", "evidence": [ { "udp_stream": 175, "frame_number": 16602, "display_filter": "frame.number == 16602", "timestamp_epoch": "1533964910.201908000" } ], "is_private": false, "observable_id": "observable-1d032869ee18836dfa74749a", "last_seen_epoch": "1533964910.201908000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964910.201908000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "8.39.36.144", "evidence": [ { "udp_stream": 158, "frame_number": 14749, "display_filter": "frame.number == 14749", "timestamp_epoch": "1533964904.736366000" } ], "is_private": false, "observable_id": "observable-cf137e388fe78b75c56e873a", "last_seen_epoch": "1533964904.736366000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964904.736366000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "8.39.36.145", "evidence": [ { "udp_stream": 158, "frame_number": 14749, "display_filter": "frame.number == 14749", "timestamp_epoch": "1533964904.736366000" } ], "is_private": false, "observable_id": "observable-52782c45b52436b2f208ea77", "last_seen_epoch": "1533964904.736366000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964904.736366000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "8.39.36.172", "evidence": [ { "udp_stream": 174, "frame_number": 16558, "display_filter": "frame.number == 16558", "timestamp_epoch": "1533964910.093175000" } ], "is_private": false, "observable_id": "observable-3a01de346cb79cfe14cc28f1", "last_seen_epoch": "1533964910.093175000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964910.093175000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "8.39.36.173", "evidence": [ { "udp_stream": 174, "frame_number": 16558, "display_filter": "frame.number == 16558", "timestamp_epoch": "1533964910.093175000" } ], "is_private": false, "observable_id": "observable-60c4872b89e9b3f83c1eb6fd", "last_seen_epoch": "1533964910.093175000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964910.093175000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "8.41.222.241", "evidence": [ { "udp_stream": 186, "frame_number": 18183, "display_filter": "frame.number == 18183", "timestamp_epoch": "1533964958.434721000" } ], "is_private": false, "observable_id": "observable-79fae6b71a41dfce4bd8d228", "last_seen_epoch": "1533964958.434721000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964958.434721000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "85.114.159.118", "evidence": [ { "udp_stream": 301, "frame_number": 35520, "display_filter": "frame.number == 35520", "timestamp_epoch": "1533965160.354275000" } ], "is_private": false, "observable_id": "observable-c57fa17cde42bd21d4c76b73", "last_seen_epoch": "1533965160.354275000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965160.354275000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "85.114.159.93", "evidence": [ { "udp_stream": 301, "frame_number": 35520, "display_filter": "frame.number == 35520", "timestamp_epoch": "1533965160.354275000" } ], "is_private": false, "observable_id": "observable-6b096a4639118c048df4c3ae", "last_seen_epoch": "1533965160.354275000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965160.354275000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "87.240.129.133", "evidence": [ { "udp_stream": 34, "frame_number": 614, "display_filter": "frame.number == 614", "timestamp_epoch": "1533964545.653915000" }, { "udp_stream": 323, "frame_number": 40120, "display_filter": "frame.number == 40120", "timestamp_epoch": "1533965770.136548000" } ], "is_private": false, "observable_id": "observable-0ce6dbe582438056a0d3e7f2", "last_seen_epoch": "1533965770.136548000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964545.653915000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "87.240.129.71", "evidence": [ { "udp_stream": 34, "frame_number": 614, "display_filter": "frame.number == 614", "timestamp_epoch": "1533964545.653915000" }, { "udp_stream": 323, "frame_number": 40120, "display_filter": "frame.number == 40120", "timestamp_epoch": "1533965770.136548000" } ], "is_private": false, "observable_id": "observable-2dda969d1be000e22c2609a4", "last_seen_epoch": "1533965770.136548000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964545.653915000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "87.240.180.136", "evidence": [ { "udp_stream": 34, "frame_number": 614, "display_filter": "frame.number == 614", "timestamp_epoch": "1533964545.653915000" }, { "udp_stream": 323, "frame_number": 40120, "display_filter": "frame.number == 40120", "timestamp_epoch": "1533965770.136548000" } ], "is_private": false, "observable_id": "observable-9c1adb2b6e8bfea6b034bf90", "last_seen_epoch": "1533965770.136548000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964545.653915000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "87.240.182.224", "evidence": [ { "udp_stream": 34, "frame_number": 614, "display_filter": "frame.number == 614", "timestamp_epoch": "1533964545.653915000" }, { "udp_stream": 323, "frame_number": 40120, "display_filter": "frame.number == 40120", "timestamp_epoch": "1533965770.136548000" } ], "is_private": false, "observable_id": "observable-e25b7b968a3fd05e18e36539", "last_seen_epoch": "1533965770.136548000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964545.653915000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "87.250.250.119", "evidence": [ { "udp_stream": 52, "frame_number": 3310, "display_filter": "frame.number == 3310", "timestamp_epoch": "1533964552.683616000" }, { "udp_stream": 344, "frame_number": 43729, "display_filter": "frame.number == 43729", "timestamp_epoch": "1533965783.276443000" } ], "is_private": false, "observable_id": "observable-d77aa6a6d8ae8e8e96d1e559", "last_seen_epoch": "1533965783.276443000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964552.683616000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "87.250.250.38", "evidence": [ { "udp_stream": 88, "frame_number": 7089, "display_filter": "frame.number == 7089", "timestamp_epoch": "1533964677.421170000" }, { "udp_stream": 319, "frame_number": 39904, "display_filter": "frame.number == 39904", "timestamp_epoch": "1533965605.965885000" } ], "is_private": false, "observable_id": "observable-d7a49598f768fd5941026415", "last_seen_epoch": "1533965605.965885000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964677.421170000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "87.250.250.90", "evidence": [ { "udp_stream": 44, "frame_number": 3197, "display_filter": "frame.number == 3197", "timestamp_epoch": "1533964552.405569000" }, { "udp_stream": 337, "frame_number": 43651, "display_filter": "frame.number == 43651", "timestamp_epoch": "1533965783.060399000" } ], "is_private": false, "observable_id": "observable-806f32d1a7b2154f89077794", "last_seen_epoch": "1533965783.060399000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964552.405569000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "87.250.251.119", "evidence": [ { "udp_stream": 52, "frame_number": 3310, "display_filter": "frame.number == 3310", "timestamp_epoch": "1533964552.683616000" }, { "udp_stream": 344, "frame_number": 43729, "display_filter": "frame.number == 43729", "timestamp_epoch": "1533965783.276443000" } ], "is_private": false, "observable_id": "observable-cf01ddf0b26c905c02aaece3", "last_seen_epoch": "1533965783.276443000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964552.683616000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "87.250.251.37", "evidence": [ { "udp_stream": 87, "frame_number": 6567, "display_filter": "frame.number == 6567", "timestamp_epoch": "1533964577.203660000" }, { "udp_stream": 318, "frame_number": 39814, "display_filter": "frame.number == 39814", "timestamp_epoch": "1533965567.514714000" } ], "is_private": false, "observable_id": "observable-f6631ac4fca61ebaf4fec8f5", "last_seen_epoch": "1533965567.514714000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964577.203660000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "88.212.196.101", "evidence": [ { "udp_stream": 49, "frame_number": 3296, "display_filter": "frame.number == 3296", "timestamp_epoch": "1533964552.626454000" }, { "udp_stream": 340, "frame_number": 43654, "display_filter": "frame.number == 43654", "timestamp_epoch": "1533965783.076721000" } ], "is_private": false, "observable_id": "observable-ac96f854054632eb466b5fa9", "last_seen_epoch": "1533965783.076721000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964552.626454000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "88.212.196.102", "evidence": [ { "udp_stream": 49, "frame_number": 3296, "display_filter": "frame.number == 3296", "timestamp_epoch": "1533964552.626454000" }, { "udp_stream": 340, "frame_number": 43654, "display_filter": "frame.number == 43654", "timestamp_epoch": "1533965783.076721000" } ], "is_private": false, "observable_id": "observable-c003dc4dd1acb682267a3bb3", "last_seen_epoch": "1533965783.076721000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964552.626454000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "88.212.196.103", "evidence": [ { "udp_stream": 49, "frame_number": 3296, "display_filter": "frame.number == 3296", "timestamp_epoch": "1533964552.626454000" }, { "udp_stream": 340, "frame_number": 43654, "display_filter": "frame.number == 43654", "timestamp_epoch": "1533965783.076721000" } ], "is_private": false, "observable_id": "observable-bd65affb9030d5fbea630e4d", "last_seen_epoch": "1533965783.076721000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964552.626454000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "88.212.196.104", "evidence": [ { "udp_stream": 49, "frame_number": 3296, "display_filter": "frame.number == 3296", "timestamp_epoch": "1533964552.626454000" }, { "udp_stream": 340, "frame_number": 43654, "display_filter": "frame.number == 43654", "timestamp_epoch": "1533965783.076721000" } ], "is_private": false, "observable_id": "observable-9f687975633ba3d4774960e7", "last_seen_epoch": "1533965783.076721000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964552.626454000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "88.212.196.105", "evidence": [ { "udp_stream": 49, "frame_number": 3296, "display_filter": "frame.number == 3296", "timestamp_epoch": "1533964552.626454000" }, { "udp_stream": 340, "frame_number": 43654, "display_filter": "frame.number == 43654", "timestamp_epoch": "1533965783.076721000" } ], "is_private": false, "observable_id": "observable-73d9fca28c2dcd12d4724d07", "last_seen_epoch": "1533965783.076721000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964552.626454000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "88.212.196.122", "evidence": [ { "udp_stream": 49, "frame_number": 3296, "display_filter": "frame.number == 3296", "timestamp_epoch": "1533964552.626454000" }, { "udp_stream": 340, "frame_number": 43654, "display_filter": "frame.number == 43654", "timestamp_epoch": "1533965783.076721000" } ], "is_private": false, "observable_id": "observable-7681c5cc62a1b75c7ba6a8d8", "last_seen_epoch": "1533965783.076721000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964552.626454000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "88.212.196.123", "evidence": [ { "udp_stream": 49, "frame_number": 3296, "display_filter": "frame.number == 3296", "timestamp_epoch": "1533964552.626454000" }, { "udp_stream": 340, "frame_number": 43654, "display_filter": "frame.number == 43654", "timestamp_epoch": "1533965783.076721000" } ], "is_private": false, "observable_id": "observable-99cb4e6c8144c9bab6dc5f13", "last_seen_epoch": "1533965783.076721000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964552.626454000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "88.212.196.124", "evidence": [ { "udp_stream": 49, "frame_number": 3296, "display_filter": "frame.number == 3296", "timestamp_epoch": "1533964552.626454000" }, { "udp_stream": 340, "frame_number": 43654, "display_filter": "frame.number == 43654", "timestamp_epoch": "1533965783.076721000" } ], "is_private": false, "observable_id": "observable-43578ae382f42bf247aa4eb7", "last_seen_epoch": "1533965783.076721000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964552.626454000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "88.212.196.66", "evidence": [ { "udp_stream": 49, "frame_number": 3296, "display_filter": "frame.number == 3296", "timestamp_epoch": "1533964552.626454000" }, { "udp_stream": 340, "frame_number": 43654, "display_filter": "frame.number == 43654", "timestamp_epoch": "1533965783.076721000" } ], "is_private": false, "observable_id": "observable-4aae51b38312b6ec3daf541f", "last_seen_epoch": "1533965783.076721000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964552.626454000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "88.212.196.69", "evidence": [ { "udp_stream": 49, "frame_number": 3296, "display_filter": "frame.number == 3296", "timestamp_epoch": "1533964552.626454000" }, { "udp_stream": 340, "frame_number": 43654, "display_filter": "frame.number == 43654", "timestamp_epoch": "1533965783.076721000" } ], "is_private": false, "observable_id": "observable-136652b072d43f49012fba15", "last_seen_epoch": "1533965783.076721000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964552.626454000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "88.212.196.72", "evidence": [ { "udp_stream": 49, "frame_number": 3296, "display_filter": "frame.number == 3296", "timestamp_epoch": "1533964552.626454000" }, { "udp_stream": 340, "frame_number": 43654, "display_filter": "frame.number == 43654", "timestamp_epoch": "1533965783.076721000" } ], "is_private": false, "observable_id": "observable-0c5c73af7f0b2b67cad6f731", "last_seen_epoch": "1533965783.076721000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964552.626454000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "88.212.196.75", "evidence": [ { "udp_stream": 49, "frame_number": 3296, "display_filter": "frame.number == 3296", "timestamp_epoch": "1533964552.626454000" }, { "udp_stream": 340, "frame_number": 43654, "display_filter": "frame.number == 43654", "timestamp_epoch": "1533965783.076721000" } ], "is_private": false, "observable_id": "observable-0567c831d9fe032fb822ba36", "last_seen_epoch": "1533965783.076721000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964552.626454000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "88.212.196.77", "evidence": [ { "udp_stream": 49, "frame_number": 3296, "display_filter": "frame.number == 3296", "timestamp_epoch": "1533964552.626454000" }, { "udp_stream": 340, "frame_number": 43654, "display_filter": "frame.number == 43654", "timestamp_epoch": "1533965783.076721000" } ], "is_private": false, "observable_id": "observable-af88ead8553c1ae19150e86f", "last_seen_epoch": "1533965783.076721000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964552.626454000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "88.212.201.193", "evidence": [ { "udp_stream": 49, "frame_number": 3296, "display_filter": "frame.number == 3296", "timestamp_epoch": "1533964552.626454000" }, { "udp_stream": 340, "frame_number": 43654, "display_filter": "frame.number == 43654", "timestamp_epoch": "1533965783.076721000" } ], "is_private": false, "observable_id": "observable-df8f406cfe44a0267c8b02b6", "last_seen_epoch": "1533965783.076721000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964552.626454000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "88.212.201.194", "evidence": [ { "udp_stream": 49, "frame_number": 3296, "display_filter": "frame.number == 3296", "timestamp_epoch": "1533964552.626454000" }, { "udp_stream": 340, "frame_number": 43654, "display_filter": "frame.number == 43654", "timestamp_epoch": "1533965783.076721000" } ], "is_private": false, "observable_id": "observable-31d357366cea0426cb5cec8b", "last_seen_epoch": "1533965783.076721000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964552.626454000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "88.212.201.195", "evidence": [ { "udp_stream": 49, "frame_number": 3296, "display_filter": "frame.number == 3296", "timestamp_epoch": "1533964552.626454000" }, { "udp_stream": 340, "frame_number": 43654, "display_filter": "frame.number == 43654", "timestamp_epoch": "1533965783.076721000" } ], "is_private": false, "observable_id": "observable-abdbebf3dea87840b30976ec", "last_seen_epoch": "1533965783.076721000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964552.626454000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "88.212.201.196", "evidence": [ { "udp_stream": 49, "frame_number": 3296, "display_filter": "frame.number == 3296", "timestamp_epoch": "1533964552.626454000" }, { "udp_stream": 340, "frame_number": 43654, "display_filter": "frame.number == 43654", "timestamp_epoch": "1533965783.076721000" } ], "is_private": false, "observable_id": "observable-1e8f133e1212322df98e5715", "last_seen_epoch": "1533965783.076721000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964552.626454000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "88.212.201.197", "evidence": [ { "udp_stream": 49, "frame_number": 3296, "display_filter": "frame.number == 3296", "timestamp_epoch": "1533964552.626454000" }, { "udp_stream": 340, "frame_number": 43654, "display_filter": "frame.number == 43654", "timestamp_epoch": "1533965783.076721000" } ], "is_private": false, "observable_id": "observable-2086181ab66706cad5c306e9", "last_seen_epoch": "1533965783.076721000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964552.626454000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "88.212.201.199", "evidence": [ { "udp_stream": 49, "frame_number": 3296, "display_filter": "frame.number == 3296", "timestamp_epoch": "1533964552.626454000" }, { "udp_stream": 340, "frame_number": 43654, "display_filter": "frame.number == 43654", "timestamp_epoch": "1533965783.076721000" } ], "is_private": false, "observable_id": "observable-d2fe92dbed966b147efea5a8", "last_seen_epoch": "1533965783.076721000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964552.626454000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "88.212.201.205", "evidence": [ { "udp_stream": 49, "frame_number": 3296, "display_filter": "frame.number == 3296", "timestamp_epoch": "1533964552.626454000" }, { "udp_stream": 340, "frame_number": 43654, "display_filter": "frame.number == 43654", "timestamp_epoch": "1533965783.076721000" } ], "is_private": false, "observable_id": "observable-cb448c3a75b1a53e78ca2997", "last_seen_epoch": "1533965783.076721000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964552.626454000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "88.212.201.207", "evidence": [ { "udp_stream": 49, "frame_number": 3296, "display_filter": "frame.number == 3296", "timestamp_epoch": "1533964552.626454000" }, { "udp_stream": 340, "frame_number": 43654, "display_filter": "frame.number == 43654", "timestamp_epoch": "1533965783.076721000" } ], "is_private": false, "observable_id": "observable-4be9f05da879a53c58b11890", "last_seen_epoch": "1533965783.076721000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964552.626454000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "88.212.201.208", "evidence": [ { "udp_stream": 49, "frame_number": 3296, "display_filter": "frame.number == 3296", "timestamp_epoch": "1533964552.626454000" }, { "udp_stream": 340, "frame_number": 43654, "display_filter": "frame.number == 43654", "timestamp_epoch": "1533965783.076721000" } ], "is_private": false, "observable_id": "observable-2b759bf8abf168f1588d2538", "last_seen_epoch": "1533965783.076721000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964552.626454000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "88.212.252.69", "evidence": [ { "udp_stream": 122, "frame_number": 11789, "display_filter": "frame.number == 11789", "timestamp_epoch": "1533964901.574246000" } ], "is_private": false, "observable_id": "observable-b323beeeb202c42dd4dec554", "last_seen_epoch": "1533964901.574246000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964901.574246000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "88.212.252.70", "evidence": [ { "udp_stream": 122, "frame_number": 11789, "display_filter": "frame.number == 11789", "timestamp_epoch": "1533964901.574246000" } ], "is_private": false, "observable_id": "observable-43a27b88853edc7622d439ff", "last_seen_epoch": "1533964901.574246000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964901.574246000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "88.212.252.78", "evidence": [ { "udp_stream": 122, "frame_number": 11789, "display_filter": "frame.number == 11789", "timestamp_epoch": "1533964901.574246000" } ], "is_private": false, "observable_id": "observable-db8ddc94ac99a686a33baf2c", "last_seen_epoch": "1533964901.574246000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964901.574246000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "88.99.210.183", "evidence": [ { "udp_stream": 105, "frame_number": 9340, "display_filter": "frame.number == 9340", "timestamp_epoch": "1533964899.269568000" } ], "is_private": false, "observable_id": "observable-cbc54f6dfc5b0b9f057681a0", "last_seen_epoch": "1533964899.269568000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964899.269568000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "88.99.232.10", "evidence": [ { "udp_stream": 105, "frame_number": 9340, "display_filter": "frame.number == 9340", "timestamp_epoch": "1533964899.269568000" } ], "is_private": false, "observable_id": "observable-7dbf89bd69d6b3e94d8300e5", "last_seen_epoch": "1533964899.269568000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964899.269568000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "88.99.5.37", "evidence": [ { "udp_stream": 358, "frame_number": 45340, "display_filter": "frame.number == 45340", "timestamp_epoch": "1533965787.454378000" } ], "is_private": false, "observable_id": "observable-91ad5f832dc8e7ac5aa00851", "last_seen_epoch": "1533965787.454378000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965787.454378000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "88.99.56.120", "evidence": [ { "udp_stream": 122, "frame_number": 11789, "display_filter": "frame.number == 11789", "timestamp_epoch": "1533964901.574246000" } ], "is_private": false, "observable_id": "observable-ee70debf204f955a93268bb2", "last_seen_epoch": "1533964901.574246000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964901.574246000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "88.99.95.120", "evidence": [ { "udp_stream": 105, "frame_number": 9340, "display_filter": "frame.number == 9340", "timestamp_epoch": "1533964899.269568000" } ], "is_private": false, "observable_id": "observable-d24a59a81e3f431f4bb0b644", "last_seen_epoch": "1533964899.269568000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964899.269568000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "88.99.95.121", "evidence": [ { "udp_stream": 105, "frame_number": 9340, "display_filter": "frame.number == 9340", "timestamp_epoch": "1533964899.269568000" } ], "is_private": false, "observable_id": "observable-adfdd305a8424d11080c9350", "last_seen_epoch": "1533964899.269568000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964899.269568000" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "89.223.92.202", "evidence": [], "is_private": false, "observable_id": "observable-710e764d08c6926e11147cfa", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "91.216.130.21", "evidence": [ { "udp_stream": 325, "frame_number": 40223, "display_filter": "frame.number == 40223", "timestamp_epoch": "1533965770.569360000" } ], "is_private": false, "observable_id": "observable-02cc2e4a6842cf5218b530ec", "last_seen_epoch": "1533965770.569360000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965770.569360000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "91.216.130.22", "evidence": [ { "udp_stream": 327, "frame_number": 40215, "display_filter": "frame.number == 40215", "timestamp_epoch": "1533965770.562042000" } ], "is_private": false, "observable_id": "observable-cf54b032607a10d120d9e193", "last_seen_epoch": "1533965770.562042000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965770.562042000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "93.158.134.119", "evidence": [ { "udp_stream": 52, "frame_number": 3310, "display_filter": "frame.number == 3310", "timestamp_epoch": "1533964552.683616000" }, { "udp_stream": 344, "frame_number": 43729, "display_filter": "frame.number == 43729", "timestamp_epoch": "1533965783.276443000" } ], "is_private": false, "observable_id": "observable-737980035506723ee67811f4", "last_seen_epoch": "1533965783.276443000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964552.683616000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "93.158.134.37", "evidence": [ { "udp_stream": 87, "frame_number": 6567, "display_filter": "frame.number == 6567", "timestamp_epoch": "1533964577.203660000" }, { "udp_stream": 318, "frame_number": 39814, "display_filter": "frame.number == 39814", "timestamp_epoch": "1533965567.514714000" } ], "is_private": false, "observable_id": "observable-4b31d34a848774b74f08ac41", "last_seen_epoch": "1533965567.514714000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964577.203660000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "93.158.134.38", "evidence": [ { "udp_stream": 88, "frame_number": 7089, "display_filter": "frame.number == 7089", "timestamp_epoch": "1533964677.421170000" }, { "udp_stream": 319, "frame_number": 39904, "display_filter": "frame.number == 39904", "timestamp_epoch": "1533965605.965885000" } ], "is_private": false, "observable_id": "observable-8be49e4ac0e7df28b90b01c5", "last_seen_epoch": "1533965605.965885000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964677.421170000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "93.158.134.90", "evidence": [ { "udp_stream": 44, "frame_number": 3197, "display_filter": "frame.number == 3197", "timestamp_epoch": "1533964552.405569000" }, { "udp_stream": 337, "frame_number": 43651, "display_filter": "frame.number == 43651", "timestamp_epoch": "1533965783.060399000" } ], "is_private": false, "observable_id": "observable-5821db4f7c96b9b8728f06d5", "last_seen_epoch": "1533965783.060399000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964552.405569000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "94.31.29.138", "evidence": [ { "udp_stream": 178, "frame_number": 17309, "display_filter": "frame.number == 17309", "timestamp_epoch": "1533964955.900897000" } ], "is_private": false, "observable_id": "observable-7692164ed165458536062483", "last_seen_epoch": "1533964955.900897000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964955.900897000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "94.31.29.250", "evidence": [ { "udp_stream": 189, "frame_number": 18270, "display_filter": "frame.number == 18270", "timestamp_epoch": "1533964958.600112000" } ], "is_private": false, "observable_id": "observable-f46bcfe3edfdc068bcde9176", "last_seen_epoch": "1533964958.600112000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964958.600112000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "95.142.20.17", "evidence": [ { "udp_stream": 96, "frame_number": 8628, "display_filter": "frame.number == 8628", "timestamp_epoch": "1533964898.548203000" } ], "is_private": false, "observable_id": "observable-c35613eea8bfd327dc7af273", "last_seen_epoch": "1533964898.548203000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964898.548203000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "95.142.20.29", "evidence": [ { "udp_stream": 115, "frame_number": 10632, "display_filter": "frame.number == 10632", "timestamp_epoch": "1533964900.643556000" } ], "is_private": false, "observable_id": "observable-ea7a441b70f8874e5b9df293", "last_seen_epoch": "1533964900.643556000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964900.643556000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "95.213.222.11", "evidence": [ { "udp_stream": 122, "frame_number": 11789, "display_filter": "frame.number == 11789", "timestamp_epoch": "1533964901.574246000" } ], "is_private": false, "observable_id": "observable-f35f8f27a06bab48555515e1", "last_seen_epoch": "1533964901.574246000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964901.574246000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "95.213.222.13", "evidence": [ { "udp_stream": 122, "frame_number": 11789, "display_filter": "frame.number == 11789", "timestamp_epoch": "1533964901.574246000" } ], "is_private": false, "observable_id": "observable-6d46486541a1cce7b75b2dbf", "last_seen_epoch": "1533964901.574246000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964901.574246000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "95.213.222.17", "evidence": [ { "udp_stream": 122, "frame_number": 11789, "display_filter": "frame.number == 11789", "timestamp_epoch": "1533964901.574246000" } ], "is_private": false, "observable_id": "observable-567b3c67e7a45d4e735e073d", "last_seen_epoch": "1533964901.574246000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964901.574246000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "95.213.222.27", "evidence": [ { "udp_stream": 122, "frame_number": 11789, "display_filter": "frame.number == 11789", "timestamp_epoch": "1533964901.574246000" } ], "is_private": false, "observable_id": "observable-2b239530509173dda09eb1c0", "last_seen_epoch": "1533964901.574246000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964901.574246000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "95.213.222.29", "evidence": [ { "udp_stream": 122, "frame_number": 11789, "display_filter": "frame.number == 11789", "timestamp_epoch": "1533964901.574246000" } ], "is_private": false, "observable_id": "observable-d029e37042f7fe5e6c2d216d", "last_seen_epoch": "1533964901.574246000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964901.574246000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "95.213.222.9", "evidence": [ { "udp_stream": 122, "frame_number": 11789, "display_filter": "frame.number == 11789", "timestamp_epoch": "1533964901.574246000" } ], "is_private": false, "observable_id": "observable-5cc7e4e2d671eb720d19faf5", "last_seen_epoch": "1533964901.574246000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964901.574246000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "95.216.24.148", "evidence": [ { "udp_stream": 358, "frame_number": 45340, "display_filter": "frame.number == 45340", "timestamp_epoch": "1533965787.454378000" } ], "is_private": false, "observable_id": "observable-f9c235eba1265c5b01796853", "last_seen_epoch": "1533965787.454378000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965787.454378000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "95.216.24.149", "evidence": [ { "udp_stream": 358, "frame_number": 45340, "display_filter": "frame.number == 45340", "timestamp_epoch": "1533965787.454378000" } ], "is_private": false, "observable_id": "observable-00973c38f4f86204a789f912", "last_seen_epoch": "1533965787.454378000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965787.454378000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "95.216.24.150", "evidence": [ { "udp_stream": 358, "frame_number": 45340, "display_filter": "frame.number == 45340", "timestamp_epoch": "1533965787.454378000" } ], "is_private": false, "observable_id": "observable-89d4c37435f131bacd4d3313", "last_seen_epoch": "1533965787.454378000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965787.454378000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "98.136.101.121", "evidence": [ { "udp_stream": 81, "frame_number": 6113, "display_filter": "frame.number == 6113", "timestamp_epoch": "1533964559.840586000" }, { "udp_stream": 85, "frame_number": 6273, "display_filter": "frame.number == 6273", "timestamp_epoch": "1533964560.304978000" } ], "is_private": false, "observable_id": "observable-605d2eedec6f24502096ded3", "last_seen_epoch": "1533964560.304978000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964559.840586000" }, { "type": "ja3", "roles": [ "tls-client-fingerprint" ], "value": "1d095e68489d3c535297cd8dffb06cb9", "evidence": [ { "tcp_stream": 166, "frame_number": 6571, "display_filter": "frame.number == 6571", "timestamp_epoch": "1533964577.639943000" }, { "tcp_stream": 172, "frame_number": 7093, "display_filter": "frame.number == 7093", "timestamp_epoch": "1533964677.699779000" }, { "tcp_stream": 177, "frame_number": 7200, "display_filter": "frame.number == 7200", "timestamp_epoch": "1533964761.191924000" }, { "tcp_stream": 1056, "frame_number": 39818, "display_filter": "frame.number == 39818", "timestamp_epoch": "1533965567.875578000" }, { "tcp_stream": 1059, "frame_number": 39908, "display_filter": "frame.number == 39908", "timestamp_epoch": "1533965606.395386000" } ], "is_private": null, "observable_id": "observable-a9d5b3a9324fdee38c26d0b2", "last_seen_epoch": "1533965606.395386000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964577.639943000" }, { "type": "ja3", "roles": [ "tls-client-fingerprint" ], "value": "4d7a28d6f2263ed61de88ca66eb011e3", "evidence": [ { "tcp_stream": 37, "frame_number": 550, "display_filter": "frame.number == 550", "timestamp_epoch": "1533964544.926326000" }, { "tcp_stream": 38, "frame_number": 552, "display_filter": "frame.number == 552", "timestamp_epoch": "1533964544.926457000" }, { "tcp_stream": 48, "frame_number": 624, "display_filter": "frame.number == 624", "timestamp_epoch": "1533964545.709230000" }, { "tcp_stream": 47, "frame_number": 626, "display_filter": "frame.number == 626", "timestamp_epoch": "1533964545.709442000" }, { "tcp_stream": 42, "frame_number": 636, "display_filter": "frame.number == 636", "timestamp_epoch": "1533964545.733784000" }, { "tcp_stream": 39, "frame_number": 638, "display_filter": "frame.number == 638", "timestamp_epoch": "1533964545.733803000" }, { "tcp_stream": 41, "frame_number": 642, "display_filter": "frame.number == 642", "timestamp_epoch": "1533964545.736658000" }, { "tcp_stream": 40, "frame_number": 646, "display_filter": "frame.number == 646", "timestamp_epoch": "1533964545.736960000" }, { "tcp_stream": 51, "frame_number": 651, "display_filter": "frame.number == 651", "timestamp_epoch": "1533964545.746485000" }, { "tcp_stream": 52, "frame_number": 659, "display_filter": "frame.number == 659", "timestamp_epoch": "1533964545.748147000" }, { "tcp_stream": 53, "frame_number": 692, "display_filter": "frame.number == 692", "timestamp_epoch": "1533964545.823140000" }, { "tcp_stream": 54, "frame_number": 696, "display_filter": "frame.number == 696", "timestamp_epoch": "1533964545.823802000" }, { "tcp_stream": 56, "frame_number": 698, "display_filter": "frame.number == 698", "timestamp_epoch": "1533964545.824007000" }, { "tcp_stream": 55, "frame_number": 699, "display_filter": "frame.number == 699", "timestamp_epoch": "1533964545.824041000" }, { "tcp_stream": 57, "frame_number": 702, "display_filter": "frame.number == 702", "timestamp_epoch": "1533964545.824352000" }, { "tcp_stream": 58, "frame_number": 704, "display_filter": "frame.number == 704", "timestamp_epoch": "1533964545.824437000" }, { "tcp_stream": 43, "frame_number": 712, "display_filter": "frame.number == 712", "timestamp_epoch": "1533964545.855496000" }, { "tcp_stream": 44, "frame_number": 730, "display_filter": "frame.number == 730", "timestamp_epoch": "1533964545.873598000" }, { "tcp_stream": 46, "frame_number": 741, "display_filter": "frame.number == 741", "timestamp_epoch": "1533964545.878035000" }, { "tcp_stream": 49, "frame_number": 747, "display_filter": "frame.number == 747", "timestamp_epoch": "1533964545.885142000" } ], "is_private": null, "observable_id": "observable-ec4ea129395a6f925c54146c", "last_seen_epoch": "1533965798.889852000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964544.926326000" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "025bb8d092d17ec94d16f6a602b61447faf64f3260c93a4650e9b77b9003a3f9", "evidence": [], "is_private": null, "observable_id": "observable-e4008e17fc072754e50cc6ee", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "03a8abd21deffa815518744425ed7da2e391745f22d80ecd2a98ece7e42644e3", "evidence": [], "is_private": null, "observable_id": "observable-2e3aa27302953e738285e815", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "044e4bccabac4f77e55d287724125fd5e1df18597c7e1d38cf690aefdae255b4", "evidence": [], "is_private": null, "observable_id": "observable-ca55531c3c295405a64d7819", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "05879b64ff801a2c6fbc4e43a1872c6a0ab6a67d3839d1eb3ed8e4852d4d58bd", "evidence": [], "is_private": null, "observable_id": "observable-dd51c01f3d936446223ccb02", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "09c4d94ef1b017b75ff5e2b9e68bcab620ec852cde6b08b21fb46f6d3ce8c904", "evidence": [], "is_private": null, "observable_id": "observable-142ca96e39fa5d99a587d8ae", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "110c07b1c1d0b56bb1755a621024babe4a7f60cacd8ffe605ef41826d3fe6784", "evidence": [], "is_private": null, "observable_id": "observable-ca486dec2e8d45dcfb05728e", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "1434636c458ad8cda52b2e1cb38178b63d9af59579d7259a36a436c9c6a11a72", "evidence": [], "is_private": null, "observable_id": "observable-8fba68d3b27fd8f0f325fc4c", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "154c433c491929c5ef686e838e323664a00e6a0d822ccc958fb4dab03e49a08f", "evidence": [], "is_private": null, "observable_id": "observable-9450a805c8ceceb6cf5c9f43", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "17f91f2405171b6857a93cb8c9b306144951f1e272a039a61a7753ba04eb0b52", "evidence": [], "is_private": null, "observable_id": "observable-3af0e1c36df3611b0688960a", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "1b416e5dd993831d9e9f5073f76034d5d1485b7eeec0be5c57c3c408b9ca8f14", "evidence": [], "is_private": null, "observable_id": "observable-6d2c6f59a9919ac79daab160", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "1b78a08c32d00ced18d679a004b133df54370f1f1d359f29b64c44256aaf8302", "evidence": [], "is_private": null, "observable_id": "observable-7e46f20f6fb270311c1f736f", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "1baf84b9f47c61803a5ea556eb3541f6ba74fc6e3c5261aac798aa19773e5cf1", "evidence": [], "is_private": null, "observable_id": "observable-88a4da4c048e903108a23007", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "1d762c3dcf8ec1d7cf68b813aed274886103a60b67c11ff9f166398e96fdedaf", "evidence": [], "is_private": null, "observable_id": "observable-1c8cbc8a2feb26e33dbc1e23", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "1dc9f4fe16b9590b8044c7389d2d1c37fb18ef5dad0ef801a6071f4df7c7a9d5", "evidence": [], "is_private": null, "observable_id": "observable-335f7f0cc0d92ba2f01fc09f", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "1ed6dac934e53a42db49242075dee716837fe4115d998e45f5c52d4ae96923a2", "evidence": [], "is_private": null, "observable_id": "observable-0d3185fd8be331ba5ef55056", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "1fc3656d141db778f4636a6beb9eb0623e7b2a072ddce6013ed96f44988b78b5", "evidence": [], "is_private": null, "observable_id": "observable-80406c6b9140c62404c98004", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "225bd232b88e6072f4601058ebf7a0db0fa5cb3bf7537350c7de0bf5f2f5c54a", "evidence": [], "is_private": null, "observable_id": "observable-469955a2e09f0ab1c8be025d", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "2361c69cc160246a46ecca25b6b50d825c2d950c39328c29aa1a168018640b11", "evidence": [], "is_private": null, "observable_id": "observable-ffee51b917a1f938a892bb05", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "25af58ca16a2bfb18ae772716df14b4c656b39ccdcb4b9fae9bca1634e505007", "evidence": [], "is_private": null, "observable_id": "observable-f2b73ec9d7a804f92c2e7c85", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "2a44910e028b6d330cacd3462a0252019ce6c016805a1b16c1c9c52b5c1caa46", "evidence": [], "is_private": null, "observable_id": "observable-2a0ff939b4f20ad7c76bf74b", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363", "evidence": [], "is_private": null, "observable_id": "observable-0bb8d53dfe184ba6ae8108d0", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "2ea3ff820ddb55c4c951ff1c0fbfe8590ebff986b806fb351f2f32aded2fefc4", "evidence": [], "is_private": null, "observable_id": "observable-56f6716c634f1279e47d4b00", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "2ffb9c700e123b950ec5913c37c94fdd8fbb16d072458bfd5a99b57a43233417", "evidence": [], "is_private": null, "observable_id": "observable-7b7db46a83a24f9105d5ceb8", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "3715612c143dd7fbcd9db512e0cbd31334fe349c77f5ac4921d0646ca8bb6fdf", "evidence": [], "is_private": null, "observable_id": "observable-3b057cf9fa83bdba8b75c308", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "3836255ada8bd1d6a0ac85b332623efd56c48a84e44be7cdf39482e5e1fa9e3c", "evidence": [], "is_private": null, "observable_id": "observable-a80d7d06bb404ba5b3c25157", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "387ad007219e458d5db35423310dcbc61b583b2611fde57a36879e31b3fb1d99", "evidence": [], "is_private": null, "observable_id": "observable-0f6fb3dc9e59d1b06e9c8173", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "38a2d4f024e57004e2d2324eead0ae08341ea9490151a439d6531132a5d2c2d5", "evidence": [], "is_private": null, "observable_id": "observable-4c93b5488955934f5fdd020f", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "38b9ae4c8fe738059ad5faf084677b448bd9333fc6286e3440cfc09be2bb18d5", "evidence": [], "is_private": null, "observable_id": "observable-0710bcddfd4b32a7c4a044d0", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "39f55c0059bfa765dbc67836a3c694c4257e3880c5323e14a2874d78f4de5582", "evidence": [], "is_private": null, "observable_id": "observable-9aab18b66031d5a2ce83ec2d", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "3ab30e780c8b0bcc4998b838a5b30c3bfe28edead312906dc3c12271fae0699a", "evidence": [], "is_private": null, "observable_id": "observable-85f4b68cae4e29d2ef0c83fa", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "3cdffc1fdda52774a1ee46fcd7244b0ee88b11df0f7ddce7dc725609bd1f2a90", "evidence": [], "is_private": null, "observable_id": "observable-6e120facaedf35968ce80baf", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "3f7411e6cfd233d77fd01564a545084b986ae36e1c385c5999df93f5f430d65b", "evidence": [], "is_private": null, "observable_id": "observable-8ad6605715da3e8e9817585e", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "403f055d841332e37c429d5a4f0699e95a960529853388d36e4ef51e4309ebd0", "evidence": [], "is_private": null, "observable_id": "observable-934a2bd9d1e1588a2971ed34", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "44509da8c1e070e58d174497add5449046af4bd1a1b62aa38152d73c9372a394", "evidence": [], "is_private": null, "observable_id": "observable-75e36dd9a8256de514ea7c08", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "468e579fe1210fa55525b1c470ed2d1958404512a2dd4fb972cac5ce0ff00b1f", "evidence": [], "is_private": null, "observable_id": "observable-4b7b861fbee2dc4ba68f36ae", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "4e4d1d22150544836181502bf5004097fe8d90b3cb647455a4d601153b39eeb7", "evidence": [], "is_private": null, "observable_id": "observable-23b52a6af952fcf00881d190", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "4efb8677134ae61413bf441d88c2e912ca065a68bb4566b30f935cae34f5a98e", "evidence": [], "is_private": null, "observable_id": "observable-47e791baf38c0939b86ca09b", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "4f32d5dc00f715250abcc486511e37f501a899deb3bf7ea8adbbd3aef1c412da", "evidence": [], "is_private": null, "observable_id": "observable-7a57d24b3bbf89dc4d3078c9", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "5aa35acedcb1d276b3b3a71371eb51bc910b970deb8a3c6111fa99959fe6c9c7", "evidence": [], "is_private": null, "observable_id": "observable-1942d7ea1efd279a4ef4a81c", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012", "evidence": [], "is_private": null, "observable_id": "observable-51a19ccbe0b138a1439a45f8", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "61c6caebd23921741fb5ffe6603f16634fca9840c2bf56ac8201e9264d6daccf", "evidence": [], "is_private": null, "observable_id": "observable-a64617d67e90408902bc3591", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "6281b1e2ea6a5d13e0fd8766295444b52867bc3298d5c2b6b55b1b22420f230c", "evidence": [], "is_private": null, "observable_id": "observable-c3245c8b331595f55678a81b", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "67dcf7446d48b5a0cb944a63bd3b69470cc6a48c024223aeff0252cc5b4f11b5", "evidence": [], "is_private": null, "observable_id": "observable-3739a3bb238636c0558767cd", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "6865cb6b98a7a93856092e5a4f0d44d6564e74513f685a1eef824a2f7ea77438", "evidence": [], "is_private": null, "observable_id": "observable-5b5aff26126691b2170ba2c1", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "6db9e00a697b239f66e81bff6d475a80c885dd2e533c93ddeed3e5883a79b8e1", "evidence": [], "is_private": null, "observable_id": "observable-bf1decf2e0fcced6917ce915", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "7a44293f37ed3ab18757c89dc76b673aa3ff923e31933ba1bdae740fb0e7ddd4", "evidence": [], "is_private": null, "observable_id": "observable-d660e86ab6fc2b0c533200c4", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "7a788d144a48f85a8f0ffd046f90c7ae89208a52463f9e5ba27833ab2085a291", "evidence": [], "is_private": null, "observable_id": "observable-a7e7bb261232af490440aec6", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "7d856e9985a83e2e6fa80ea41c6e67c8db9e19d9f30ce8d0a8d87ad942a00a31", "evidence": [], "is_private": null, "observable_id": "observable-1b8b17a9019b172091fef03e", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "826da83425629535790ab944e227e02a597999af91f0a662bcfb4351c950d274", "evidence": [], "is_private": null, "observable_id": "observable-29526c90ec493804d73efe38", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "8380f10fcacb3780a860531c45384ab3bfdc2ab6a9b8ada7b38551448f69d889", "evidence": [], "is_private": null, "observable_id": "observable-eaead8b72c55ed59f71b1c7c", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "8500d605a74853787e140b8e1fcc945de816b28bda06093a3a9d3a9fe00b9b6e", "evidence": [], "is_private": null, "observable_id": "observable-aad0f48bea60a169e80d9275", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "87da7fce38fb944279568a460f952df3009b4398083bbe5dedb489fde5f46814", "evidence": [], "is_private": null, "observable_id": "observable-7f59b34c1404b2804edcb2f2", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "8bf7a76576baee734a750ad21b0a8a583de9ef4312e41f7043594910e6649eed", "evidence": [], "is_private": null, "observable_id": "observable-dff181f262a287c73de16caf", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "8ed18faec0943d33882e94cf8e4f01b732ff4e7c84294a9852dbed7cbb07afd7", "evidence": [], "is_private": null, "observable_id": "observable-f78e0b44df436f2789a18ec2", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "8ed22d97053651c1bf38b50de0630657e03c9dc1b82f2c80241d72dd68c34fc8", "evidence": [], "is_private": null, "observable_id": "observable-f391393ca52867bcf147fef4", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "8f34acb688aeae2e39704c35a59767aa10f9b6b99d81f681b8398b23c2d56f22", "evidence": [], "is_private": null, "observable_id": "observable-444dd11e3d378730ebaec1ce", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "9346b79af539d6aa4f72a0499ca1459c42e1a6e2becf0d015ba2f4237f0a9eab", "evidence": [], "is_private": null, "observable_id": "observable-fa5082585fa4beb433f75448", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "96bc02edb88af74dfe132e8341ef9a8694400d86bf0deb6fd93d06591bc5fa8d", "evidence": [], "is_private": null, "observable_id": "observable-541713d83e37fa75ff6398eb", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "99fb918a282d39d585d3d759f7903f7508925d0f78ae80e427cec27378c5b71b", "evidence": [], "is_private": null, "observable_id": "observable-d92d0bb43acb97336b07910e", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "9a3425a07bbde19cc69878e803f30c78d60b61f49049265a20a01841a1028350", "evidence": [], "is_private": null, "observable_id": "observable-9240ed6286fa2c23ad6ba950", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "9d0bbca6eb531759098a56914524f615a1d5a75a1b2c429d7b238973c2610c7a", "evidence": [], "is_private": null, "observable_id": "observable-687ad259fb50956e1995cb4c", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "a002c9d3c0bfd9a9ff3c9ff2b1dbd79beb6bf0af5b45933ccad66337bc6864eb", "evidence": [], "is_private": null, "observable_id": "observable-48caf17309371c5fa2fd15ee", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "a131c2b10883bc8647bffa08b4a6b27f04b376bbddb267a4d0c9d3e8ea851aa0", "evidence": [], "is_private": null, "observable_id": "observable-6ccea4ba3fff84a57c808595", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "a1dbd5350e586eab4363644e8a82826a3032bc4f83694543d50fb6498ea6e82e", "evidence": [], "is_private": null, "observable_id": "observable-814a595ba31f4b8953fc9d9f", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "a2ce3a0fa7d2a833d1801e01ec48e35b70d84f3467cc9f8fab370386e13879c7", "evidence": [], "is_private": null, "observable_id": "observable-9bdda0aa0508bc21616c1677", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "a6dd05c22e36e46f367bb82192f989ccf6b9f5407e61addeaab44b7c53e30a00", "evidence": [], "is_private": null, "observable_id": "observable-b594505c2b5f5055a2cd3b61", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "aa81dc4dfa58c4040d0e5c08813a963dd3e8a8a16fd1c76ed758e703b62761f2", "evidence": [], "is_private": null, "observable_id": "observable-641671af1bb36f8886479078", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "ad927cfd47a633c08193fec7881a927102c04802a42fa9d880c34dcba5d473ed", "evidence": [], "is_private": null, "observable_id": "observable-47b43a8c68843fe4df4ee680", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "ad984172bbde72d905cb477edf2775b567580976ef1327612313d7490a3d30ae", "evidence": [], "is_private": null, "observable_id": "observable-c8248b770d4c98bf8daa857b", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "ae4f99d83e633923748305e0dd6434264babf605d56deb7d05345710796038fa", "evidence": [], "is_private": null, "observable_id": "observable-b1c78ac699f5236954202662", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "af5e4f327b79424352a42bf43df71e6a2f52d6f8948b82d6a42b4c2e97f7bfea", "evidence": [], "is_private": null, "observable_id": "observable-216499ede0f639ca64308445", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "b3719e3eda456a7457adfe13e6eed36fcef0901b0c31c22cc8ff48629ce8dcee", "evidence": [], "is_private": null, "observable_id": "observable-3c51fa0db7a1560105868f65", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "b824ce476646a4ea83e2e7b3ccff9864cb702bf597c05656a470ec609954f9db", "evidence": [], "is_private": null, "observable_id": "observable-73a745c2efd2e6b4a103536c", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "b84161c9fbf7520cd14e7019f92120bd87a928a074156e91a992eba9fc9436e8", "evidence": [], "is_private": null, "observable_id": "observable-b5c07290196fcd67e84edaad", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "b908d9b1001d0a39ba92501c086b1c25b05b171eeda035ae9f3e129d2776a314", "evidence": [], "is_private": null, "observable_id": "observable-adb255911d18e7d3b23f4927", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "bc1fc69f9747dc034ece7d9bb795c5e596d9be6ca71efe75c6c0fd18f3cbfbf5", "evidence": [], "is_private": null, "observable_id": "observable-bf135081606734b07b12c7f8", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "beff9a913c0887163fd4a17d037f2188ed9e93f6c57f770448c2f7046ca7d141", "evidence": [], "is_private": null, "observable_id": "observable-a1e63b6f998929d2c2bbdfb8", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "c0d599b80025a70004d813d62b587af4f8ae8abd64f514f280b6e4899436623f", "evidence": [], "is_private": null, "observable_id": "observable-51124e568e4eea087652aafc", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "c0f37380971fb93ecb0cfa3c2bd6d91cc77f254f0a6ca41edeff47fda0e409cc", "evidence": [], "is_private": null, "observable_id": "observable-634077ba73808b24c345a9f4", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "c6e69e2ac48274e5650b25984db96e9b8c85f8c92941900207abb3d41b423cf7", "evidence": [], "is_private": null, "observable_id": "observable-b4bf7cf5daa4adaa7fb705a5", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "c735ac343470ff44195d0167c35e9cb3e0bc43a7c749b67f50fb662300f73d9f", "evidence": [], "is_private": null, "observable_id": "observable-80e4bc93f577cbd8c0ab98a4", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "c87f78fc36289e69a164914c940e5cecd31024d0a06089c2fab4dcd23e507ae6", "evidence": [], "is_private": null, "observable_id": "observable-4bee935118d7c5c57eb94087", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f", "evidence": [], "is_private": null, "observable_id": "observable-b65c464f4f2c8b413600e5f0", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b", "evidence": [], "is_private": null, "observable_id": "observable-98db67d28bca873eb1f1b27a", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "cc59dfc0669d00ad2b72411ff19cf555e4d0f1b940f0c674904004c73a3edb07", "evidence": [], "is_private": null, "observable_id": "observable-96c79fa78eb9e19f47873623", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "cd649c61b13497605100760e8bf986b569254a716cc2b21612b8b4f09051a732", "evidence": [], "is_private": null, "observable_id": "observable-b71b1081e78d55f5f7f2fb81", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "ced5c873136c4fab4584c0c6d26dcd530c748303d7ed9b7a7966b2fe1d6f5915", "evidence": [], "is_private": null, "observable_id": "observable-38d8d966a57eff253b88617b", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda", "evidence": [], "is_private": null, "observable_id": "observable-0e37fda133d6e4a20b568c70", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "d1b728e19d551b8bc4f3f2d0c12541e7d8950358f95ae31e610b6ab46cb6ec96", "evidence": [], "is_private": null, "observable_id": "observable-044828bfa4ce69e3039fe105", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "d4735e3a265e16eee03f59718b9b5d03019c07d8b6c51f90da3a666eec13ab35", "evidence": [], "is_private": null, "observable_id": "observable-d7d1e4e9a32f1db50a192903", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb", "evidence": [], "is_private": null, "observable_id": "observable-15300bb69453b961e51687f1", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "d84fb0e64ee9f712fb6a808e9caa959903068ae7d7805bd0ce5f4782a37422f4", "evidence": [], "is_private": null, "observable_id": "observable-d66b66ebcdb2dfab90657bd1", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "d9e7bfb8aeed3257872096e5f7f09eb683adb4541c0fca3446823bea4a7c2168", "evidence": [], "is_private": null, "observable_id": "observable-d3ea8098ef2a4ba9cbd9a825", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "e2b232bd93d4faa6bd4156d3e31b542a24ac3afe877c6f7faf23c1f474eaf52a", "evidence": [], "is_private": null, "observable_id": "observable-fdd8eb18f5c8b53b11698d28", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "e49188fece61523b27d736f94bccb9b04d8a3f018fe0a770fc5cf9b6c734fd0a", "evidence": [], "is_private": null, "observable_id": "observable-5054b7d15d9ed7f55bd3cbe1", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "e4c763b60274fbb4f5ebfb43603452f0c592aedf39647951ce87182fdb702955", "evidence": [], "is_private": null, "observable_id": "observable-b249292f69108bddf849eec8", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "e56be3ba3f85b78893bce2432a38aad1afda3d3032ee8667589dd44ee9ed0cc1", "evidence": [], "is_private": null, "observable_id": "observable-323e688c3089cd1fa7e19be1", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "e6145cbc4aac4c3d685d04d508cee083e4e4a8a727af838ed46de8f0384b6119", "evidence": [], "is_private": null, "observable_id": "observable-7d7efdfcf61d068f12b299ad", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "e9d0f873040fb0ee7b073debbc6dfbfdbc80c0c17518d38b04b277a54e5fb275", "evidence": [], "is_private": null, "observable_id": "observable-6c8d1f7fa83903de1ce7849a", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "ea843998fbbcd38dd92e228250a9bf15521391a26c88cb25a16b162d7f35d0e1", "evidence": [], "is_private": null, "observable_id": "observable-5e88a803b009d55b0b9dab9c", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "ebdab894f319fe12a1b14f3dc8c883d45caf4c15e389fb9d6568145f926f4126", "evidence": [], "is_private": null, "observable_id": "observable-2a927173c7ddf7102c156f35", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "f1c1b50ae5a20dd8030ec9f6bc24823dd367b5255759b4e71b61fce9f7375d73", "evidence": [], "is_private": null, "observable_id": "observable-386d4396306cea488de6c4a1", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "f2addf74a79c54d648ed7d227042c992f8d500dd95f072528f9e55c168cf97ad", "evidence": [], "is_private": null, "observable_id": "observable-8145f780af2c2e5e007d7e97", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "f33c27745f2bd87344be790465ef984a972fd539dc83bd4f61d4242c607ef1ee", "evidence": [], "is_private": null, "observable_id": "observable-46c1348259ea7666f727756d", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "f379ea3023b93c6e5d2fe2945774dcf7c85a116326d9eb8f3274de541403811b", "evidence": [], "is_private": null, "observable_id": "observable-227b8be72f3cf5241facdb74", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "f59b3fd3d4f882d5c2154e3b8aa5e535416a696f482996ec2a134e7a6978c333", "evidence": [], "is_private": null, "observable_id": "observable-e80d00594dc530ff2cf8336e", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "f8e7288c0e055bff074b4d2f64cf687fa49de2e08955cd2cdb00d55eaacb3a61", "evidence": [], "is_private": null, "observable_id": "observable-ed1d367c9da4a9b8ed426245", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "f9496faf384dba29602fe3072688892f2dcf7738eecb77208c51de0eaa12562a", "evidence": [], "is_private": null, "observable_id": "observable-212cc599b4b994cdee685cf1", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "fa523f248a332cb89ae3ad8cf51d840153e0f96bcc2a4c8db736e02a340dab48", "evidence": [], "is_private": null, "observable_id": "observable-7e6d602b3913ec1c58cf28c0", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "fb03a6b96e7aa8dc5c4e079289c84f446a7374d65f7bb79a734c34c9fb8e7703", "evidence": [], "is_private": null, "observable_id": "observable-01688be6d59bc3dec4f7faf1", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "url", "roles": [ "http-request" ], "value": "http://185.68.93.18/dot.php", "evidence": [ { "tcp_stream": 1036, "frame_number": 39557, "display_filter": "frame.number == 39557", "timestamp_epoch": "1533965406.977212000" }, { "tcp_stream": 1046, "frame_number": 39676, "display_filter": "frame.number == 39676", "timestamp_epoch": "1533965418.580357000" }, { "tcp_stream": 1046, "frame_number": 39681, "display_filter": "frame.number == 39681", "timestamp_epoch": "1533965419.412338000" }, { "tcp_stream": 1047, "frame_number": 39699, "display_filter": "frame.number == 39699", "timestamp_epoch": "1533965435.576793000" }, { "tcp_stream": 1048, "frame_number": 39712, "display_filter": "frame.number == 39712", "timestamp_epoch": "1533965451.757604000" }, { "tcp_stream": 1049, "frame_number": 39725, "display_filter": "frame.number == 39725", "timestamp_epoch": "1533965467.936416000" }, { "tcp_stream": 1050, "frame_number": 39741, "display_filter": "frame.number == 39741", "timestamp_epoch": "1533965484.293094000" }, { "tcp_stream": 1051, "frame_number": 39754, "display_filter": "frame.number == 39754", "timestamp_epoch": "1533965500.471438000" }, { "tcp_stream": 1052, "frame_number": 39767, "display_filter": "frame.number == 39767", "timestamp_epoch": "1533965516.649335000" }, { "tcp_stream": 1053, "frame_number": 39781, "display_filter": "frame.number == 39781", "timestamp_epoch": "1533965532.902740000" }, { "tcp_stream": 1054, "frame_number": 39796, "display_filter": "frame.number == 39796", "timestamp_epoch": "1533965549.287287000" }, { "tcp_stream": 1055, "frame_number": 39809, "display_filter": "frame.number == 39809", "timestamp_epoch": "1533965565.437819000" }, { "tcp_stream": 1057, "frame_number": 39879, "display_filter": "frame.number == 39879", "timestamp_epoch": "1533965581.646796000" }, { "tcp_stream": 1058, "frame_number": 39895, "display_filter": "frame.number == 39895", "timestamp_epoch": "1533965597.772796000" }, { "tcp_stream": 1060, "frame_number": 39951, "display_filter": "frame.number == 39951", "timestamp_epoch": "1533965613.953658000" }, { "tcp_stream": 1061, "frame_number": 39970, "display_filter": "frame.number == 39970", "timestamp_epoch": "1533965630.124714000" }, { "tcp_stream": 1062, "frame_number": 39983, "display_filter": "frame.number == 39983", "timestamp_epoch": "1533965646.289888000" }, { "tcp_stream": 1063, "frame_number": 39996, "display_filter": "frame.number == 39996", "timestamp_epoch": "1533965662.463461000" }, { "tcp_stream": 1064, "frame_number": 40009, "display_filter": "frame.number == 40009", "timestamp_epoch": "1533965678.767587000" }, { "tcp_stream": 1065, "frame_number": 40022, "display_filter": "frame.number == 40022", "timestamp_epoch": "1533965694.815438000" } ], "is_private": null, "observable_id": "observable-153c6ce86ff09322f8ea1b7f", "last_seen_epoch": "1533965906.527374000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965406.977212000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://apps.identrust.com/roots/dstrootcax3.p7c", "evidence": [ { "tcp_stream": 218, "frame_number": 8633, "display_filter": "frame.number == 8633", "timestamp_epoch": "1533964898.552621000" }, { "tcp_stream": 217, "frame_number": 8637, "display_filter": "frame.number == 8637", "timestamp_epoch": "1533964898.553823000" } ], "is_private": null, "observable_id": "observable-07ea1702cd804b1aba2afb7c", "last_seen_epoch": "1533964898.553823000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964898.552621000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://cacerts.digicert.com/DigiCertSHA2SecureServerCA.crt", "evidence": [ { "tcp_stream": 665, "frame_number": 23982, "display_filter": "frame.number == 23982", "timestamp_epoch": "1533964998.555480000" }, { "tcp_stream": 664, "frame_number": 23985, "display_filter": "frame.number == 23985", "timestamp_epoch": "1533964998.555964000" } ], "is_private": null, "observable_id": "observable-f55dbbe451be3ba89fb01e7d", "last_seen_epoch": "1533964998.555964000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964998.555480000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://comet.tass.ru:8080/poll?channels=en_section_politics,en_section_world,en_section_economy,en_section_defense,en_section_science,en_section_society,en_section_sport,en_section_pressreview,en_section_emergencies&cometsid=--b28c704f1435e1a5ac1a753810d40a57", "evidence": [ { "tcp_stream": 1186, "frame_number": 44900, "display_filter": "frame.number == 44900", "timestamp_epoch": "1533965786.473054000" } ], "is_private": null, "observable_id": "observable-c96af3ef186ebf5ef614fd41", "last_seen_epoch": "1533965786.473054000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965786.473054000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://connect.facebook.net/en_US/sdk.js", "evidence": [ { "tcp_stream": 1151, "frame_number": 43690, "display_filter": "frame.number == 43690", "timestamp_epoch": "1533965783.175343000" } ], "is_private": null, "observable_id": "observable-be3cb1b5e58683afba7d1ce2", "last_seen_epoch": "1533965783.175343000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965783.175343000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://counter.yadro.ru/hit;TASS_total?r;s1280*768*24;uhttp%3A//tass.com/;0.30934944172652073", "evidence": [ { "tcp_stream": 1143, "frame_number": 43744, "display_filter": "frame.number == 43744", "timestamp_epoch": "1533965783.328334000" } ], "is_private": null, "observable_id": "observable-b9527ce2a86f4cf8ec7e0296", "last_seen_epoch": "1533965783.328334000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965783.328334000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://counter.yadro.ru/logo;tass.com?44.6", "evidence": [ { "tcp_stream": 1144, "frame_number": 43748, "display_filter": "frame.number == 43748", "timestamp_epoch": "1533965783.334711000" } ], "is_private": null, "observable_id": "observable-1c0044cb8eb0bc6b17abefd6", "last_seen_epoch": "1533965783.334711000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965783.334711000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://crt.comodoca.com/COMODORSAAddTrustCA.crt", "evidence": [ { "tcp_stream": 296, "frame_number": 11487, "display_filter": "frame.number == 11487", "timestamp_epoch": "1533964901.324527000" }, { "tcp_stream": 297, "frame_number": 11488, "display_filter": "frame.number == 11488", "timestamp_epoch": "1533964901.324607000" } ], "is_private": null, "observable_id": "observable-1e3ae10f3b7dda3dfa9b15df", "last_seen_epoch": "1533964901.324607000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964901.324527000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://fonts.googleapis.com/css?family=Roboto:300", "evidence": [ { "tcp_stream": 1190, "frame_number": 44836, "display_filter": "frame.number == 44836", "timestamp_epoch": "1533965786.409477000" } ], "is_private": null, "observable_id": "observable-4d27990f51a1412de57f88a7", "last_seen_epoch": "1533965786.409477000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965786.409477000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://fonts.googleapis.com/css?family=Roboto:700", "evidence": [ { "tcp_stream": 1191, "frame_number": 44840, "display_filter": "frame.number == 44840", "timestamp_epoch": "1533965786.410078000" } ], "is_private": null, "observable_id": "observable-c409456d67d2313bbf07d568", "last_seen_epoch": "1533965786.410078000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965786.410078000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmSU5fBBc-.woff", "evidence": [ { "tcp_stream": 1197, "frame_number": 45321, "display_filter": "frame.number == 45321", "timestamp_epoch": "1533965787.350307000" } ], "is_private": null, "observable_id": "observable-51099a0fd44444e1301a6589", "last_seen_epoch": "1533965787.350307000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965787.350307000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmWUlfBBc-.woff", "evidence": [ { "tcp_stream": 1198, "frame_number": 45320, "display_filter": "frame.number == 45320", "timestamp_epoch": "1533965787.350306000" } ], "is_private": null, "observable_id": "observable-129a95806d2c4009bb8ed9fb", "last_seen_epoch": "1533965787.350306000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965787.350306000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://pagead2.googlesyndication.com/pagead/osd.js", "evidence": [ { "tcp_stream": 1187, "frame_number": 44800, "display_filter": "frame.number == 44800", "timestamp_epoch": "1533965786.356599000" } ], "is_private": null, "observable_id": "observable-985e31f17ec9a6696b27159b", "last_seen_epoch": "1533965786.356599000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965786.356599000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://platform.twitter.com/widgets.js", "evidence": [ { "tcp_stream": 1150, "frame_number": 43698, "display_filter": "frame.number == 43698", "timestamp_epoch": "1533965783.176462000" } ], "is_private": null, "observable_id": "observable-09cb824109800ac25a8ef476", "last_seen_epoch": "1533965783.176462000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965783.176462000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://r53x.com/1.rar", "evidence": [ { "tcp_stream": 178, "frame_number": 7263, "display_filter": "frame.number == 7263", "timestamp_epoch": "1533964850.464296000" } ], "is_private": null, "observable_id": "observable-7da36578320f74fc5b11171a", "last_seen_epoch": "1533964850.464296000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964850.464296000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://r53x.com/1.zip", "evidence": [ { "tcp_stream": 179, "frame_number": 7277, "display_filter": "frame.number == 7277", "timestamp_epoch": "1533964857.855860000" } ], "is_private": null, "observable_id": "observable-ec977cdae9f3ca563dc17c13", "last_seen_epoch": "1533964857.855860000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964857.855860000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://r53x.com/a3.dat", "evidence": [ { "tcp_stream": 179, "frame_number": 7280, "display_filter": "frame.number == 7280", "timestamp_epoch": "1533964858.738093000" } ], "is_private": null, "observable_id": "observable-680ece11f0aaeb527cea500f", "last_seen_epoch": "1533964858.738093000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964858.738093000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://rtax.criteo.com/delivery/rta/rta.js?netId=5895&cookieName=crtg_rta&rnd=74932308510&varName=crtg_content", "evidence": [ { "tcp_stream": 1146, "frame_number": 43682, "display_filter": "frame.number == 43682", "timestamp_epoch": "1533965783.173153000" } ], "is_private": null, "observable_id": "observable-ee48164997f95dea1251a1f8", "last_seen_epoch": "1533965783.173153000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965783.173153000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://ssl.trustwave.com/issuers/STCA.crt", "evidence": [ { "tcp_stream": 127, "frame_number": 5383, "display_filter": "frame.number == 5383", "timestamp_epoch": "1533964556.494073000" }, { "tcp_stream": 128, "frame_number": 5387, "display_filter": "frame.number == 5387", "timestamp_epoch": "1533964556.515882000" } ], "is_private": null, "observable_id": "observable-1bb9352127fc1cdc7a9f1654", "last_seen_epoch": "1533964556.515882000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964556.494073000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tass.com/", "evidence": [ { "tcp_stream": 1071, "frame_number": 40100, "display_filter": "frame.number == 40100", "timestamp_epoch": "1533965768.745327000" } ], "is_private": null, "observable_id": "observable-3356a036f0410a3489a5661d", "last_seen_epoch": "1533965768.745327000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965768.745327000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tass.com/api/news/lenta?limit=50", "evidence": [ { "tcp_stream": 1073, "frame_number": 44285, "display_filter": "frame.number == 44285", "timestamp_epoch": "1533965784.710245000" } ], "is_private": null, "observable_id": "observable-3c1caf176f48cee1da790926", "last_seen_epoch": "1533965784.710245000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965784.710245000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tass.com/assets/14df3cc8/layout.min.css?v=1533913284", "evidence": [ { "tcp_stream": 1073, "frame_number": 40173, "display_filter": "frame.number == 40173", "timestamp_epoch": "1533965770.466368000" } ], "is_private": null, "observable_id": "observable-941ec3773375f31c17cf64ee", "last_seen_epoch": "1533965770.466368000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965770.466368000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tass.com/assets/1d1a4a07/socials.min.css?v=1533913284", "evidence": [ { "tcp_stream": 1071, "frame_number": 46347, "display_filter": "frame.number == 46347", "timestamp_epoch": "1533965790.969108000" } ], "is_private": null, "observable_id": "observable-1461f8c49a3438fded8ed3bf", "last_seen_epoch": "1533965790.969108000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965790.969108000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tass.com/assets/287c4a4b/itar.min.js?v=1533913284", "evidence": [ { "tcp_stream": 1072, "frame_number": 42696, "display_filter": "frame.number == 42696", "timestamp_epoch": "1533965776.932397000" } ], "is_private": null, "observable_id": "observable-8979e32d49c83b54fc020dde", "last_seen_epoch": "1533965776.932397000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965776.932397000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tass.com/assets/43ffdc60/angular.rangeSlider.min.css?v=1533913284", "evidence": [ { "tcp_stream": 1071, "frame_number": 40361, "display_filter": "frame.number == 40361", "timestamp_epoch": "1533965770.816258000" } ], "is_private": null, "observable_id": "observable-3c54828bc11334504e59ad1a", "last_seen_epoch": "1533965770.816258000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965770.816258000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tass.com/assets/666a6de7/lenta.min.css?v=1533913284", "evidence": [ { "tcp_stream": 1130, "frame_number": 41322, "display_filter": "frame.number == 41322", "timestamp_epoch": "1533965772.824858000" } ], "is_private": null, "observable_id": "observable-2ca5eddfcb080e03fa4e6cf2", "last_seen_epoch": "1533965772.824858000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965772.824858000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tass.com/assets/6f5f919/flags.min.css?v=1533913284", "evidence": [ { "tcp_stream": 1075, "frame_number": 40177, "display_filter": "frame.number == 40177", "timestamp_epoch": "1533965770.467225000" } ], "is_private": null, "observable_id": "observable-d440e1243fc0c510c3008f2d", "last_seen_epoch": "1533965770.467225000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965770.467225000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tass.com/assets/735f4b6e/media-widget.min.css?v=1533913284", "evidence": [ { "tcp_stream": 1071, "frame_number": 40737, "display_filter": "frame.number == 40737", "timestamp_epoch": "1533965771.477596000" }, { "tcp_stream": 1070, "frame_number": 46361, "display_filter": "frame.number == 46361", "timestamp_epoch": "1533965790.990826000" } ], "is_private": null, "observable_id": "observable-969a2831201f811a9d118246", "last_seen_epoch": "1533965790.990826000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965771.477596000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tass.com/assets/7ce9e0a9/videoWidget.min.css?v=1533913284", "evidence": [ { "tcp_stream": 1072, "frame_number": 46345, "display_filter": "frame.number == 46345", "timestamp_epoch": "1533965790.968776000" } ], "is_private": null, "observable_id": "observable-de6812634ccb070383bb7d4f", "last_seen_epoch": "1533965790.968776000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965790.968776000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tass.com/assets/842758d5/mainTopSlider.css?v=1533913284", "evidence": [ { "tcp_stream": 1071, "frame_number": 40213, "display_filter": "frame.number == 40213", "timestamp_epoch": "1533965770.489095000" } ], "is_private": null, "observable_id": "observable-c8a10d4c04b5076205dff79a", "last_seen_epoch": "1533965770.489095000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965770.489095000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tass.com/assets/8665a252/css.css?v=1533913284", "evidence": [ { "tcp_stream": 1075, "frame_number": 40562, "display_filter": "frame.number == 40562", "timestamp_epoch": "1533965771.132264000" } ], "is_private": null, "observable_id": "observable-b42f96a855d36cc9e5a3353b", "last_seen_epoch": "1533965771.132264000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965771.132264000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tass.com/assets/88a00814/material.min.css?v=1533913284", "evidence": [ { "tcp_stream": 1133, "frame_number": 46355, "display_filter": "frame.number == 46355", "timestamp_epoch": "1533965790.976473000" } ], "is_private": null, "observable_id": "observable-ffdb273ac62336f7a5219f0f", "last_seen_epoch": "1533965790.976473000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965790.976473000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tass.com/assets/8b982e6a/infographics-widget.min.css?v=1533913284", "evidence": [ { "tcp_stream": 1073, "frame_number": 46420, "display_filter": "frame.number == 46420", "timestamp_epoch": "1533965791.270108000" } ], "is_private": null, "observable_id": "observable-2de83178bc465f0666200526", "last_seen_epoch": "1533965791.270108000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965791.270108000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tass.com/assets/916e0df6/footer.min.css?v=1533913284", "evidence": [ { "tcp_stream": 1131, "frame_number": 41324, "display_filter": "frame.number == 41324", "timestamp_epoch": "1533965772.824982000" } ], "is_private": null, "observable_id": "observable-7b805850e9f49db331986e04", "last_seen_epoch": "1533965772.824982000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965772.824982000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tass.com/assets/a6d7cd43/cards.min.css?v=1533913284", "evidence": [ { "tcp_stream": 1072, "frame_number": 40518, "display_filter": "frame.number == 40518", "timestamp_epoch": "1533965771.072573000" } ], "is_private": null, "observable_id": "observable-abd69486b4ba0467eb1751c2", "last_seen_epoch": "1533965771.072573000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965771.072573000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tass.com/assets/bfcd510f/libs.min.js?v=1533913284", "evidence": [ { "tcp_stream": 1130, "frame_number": 42524, "display_filter": "frame.number == 42524", "timestamp_epoch": "1533965776.483672000" } ], "is_private": null, "observable_id": "observable-ae20d4f91fdde243a96d1b76", "last_seen_epoch": "1533965776.483672000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965776.483672000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tass.com/assets/cb2c53b3/audioWidget.min.css?v=1533913284", "evidence": [ { "tcp_stream": 1130, "frame_number": 46343, "display_filter": "frame.number == 46343", "timestamp_epoch": "1533965790.968379000" } ], "is_private": null, "observable_id": "observable-07a829369fd17b176c7b538e", "last_seen_epoch": "1533965790.968379000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965790.968379000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tass.com/assets/d45d2990/photoModeCss.css?v=1533913284", "evidence": [ { "tcp_stream": 1074, "frame_number": 40165, "display_filter": "frame.number == 40165", "timestamp_epoch": "1533965770.465535000" } ], "is_private": null, "observable_id": "observable-436e424872c95ec181583784", "last_seen_epoch": "1533965770.465535000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965770.465535000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tass.com/assets/e2a326a5/main-slider-widget.min.css?v=1533913284", "evidence": [ { "tcp_stream": 1072, "frame_number": 40171, "display_filter": "frame.number == 40171", "timestamp_epoch": "1533965770.466207000" } ], "is_private": null, "observable_id": "observable-e3a4d7f5918ccb963de9cbfe", "last_seen_epoch": "1533965770.466207000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965770.466207000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tass.com/assets/f64f6e6a/zoom.min.css?v=1533913284", "evidence": [ { "tcp_stream": 1074, "frame_number": 40510, "display_filter": "frame.number == 40510", "timestamp_epoch": "1533965771.062766000" } ], "is_private": null, "observable_id": "observable-74f128caedc9b99748c6a281", "last_seen_epoch": "1533965771.062766000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965771.062766000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tass.com/css/before-widescreen.css", "evidence": [ { "tcp_stream": 1072, "frame_number": 41034, "display_filter": "frame.number == 41034", "timestamp_epoch": "1533965774.016397000" } ], "is_private": null, "observable_id": "observable-cc4d80fdb79ba7435af0b0b1", "last_seen_epoch": "1533965774.016397000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965774.016397000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tass.com/css/doublephoto/css.css?v=1533913284", "evidence": [ { "tcp_stream": 1073, "frame_number": 46341, "display_filter": "frame.number == 46341", "timestamp_epoch": "1533965790.968196000" } ], "is_private": null, "observable_id": "observable-e76d5c83341f52a526f4ebbf", "last_seen_epoch": "1533965790.968196000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965790.968196000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tass.com/css/media-queries.css?_=3", "evidence": [ { "tcp_stream": 1070, "frame_number": 41026, "display_filter": "frame.number == 41026", "timestamp_epoch": "1533965774.002334000" } ], "is_private": null, "observable_id": "observable-fd6f64d5c2f2f306bcd0892c", "last_seen_epoch": "1533965774.002334000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965774.002334000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tass.com/css/mobile.css?_=1", "evidence": [ { "tcp_stream": 1073, "frame_number": 41022, "display_filter": "frame.number == 41022", "timestamp_epoch": "1533965773.993678000" } ], "is_private": null, "observable_id": "observable-b7fb4d19d1d2c3203daee9ec", "last_seen_epoch": "1533965773.993678000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965773.993678000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tass.com/css/print.css?v=1", "evidence": [ { "tcp_stream": 1075, "frame_number": 41060, "display_filter": "frame.number == 41060", "timestamp_epoch": "1533965774.048915000" } ], "is_private": null, "observable_id": "observable-8e3f8f23db54008de5fb3226", "last_seen_epoch": "1533965774.048915000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965774.048915000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tass.com/css/widescreen.css", "evidence": [ { "tcp_stream": 1074, "frame_number": 41036, "display_filter": "frame.number == 41036", "timestamp_epoch": "1533965774.016484000" } ], "is_private": null, "observable_id": "observable-967478206cb4ec834dc36f56", "last_seen_epoch": "1533965774.016484000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965774.016484000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tass.com/economy/1016847", "evidence": [ { "tcp_stream": 1070, "frame_number": 46268, "display_filter": "frame.number == 46268", "timestamp_epoch": "1533965790.405757000" } ], "is_private": null, "observable_id": "observable-e23cd11b45d5cc17f8d7893d", "last_seen_epoch": "1533965790.405757000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965790.405757000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tass.com/favicon.ico?225", "evidence": [ { "tcp_stream": 1073, "frame_number": 46258, "display_filter": "frame.number == 46258", "timestamp_epoch": "1533965790.166964000" } ], "is_private": null, "observable_id": "observable-2a860b5343e8dba530bbad93", "last_seen_epoch": "1533965790.166964000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965790.166964000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tass.com/fonts/icontass/icontass.eot?", "evidence": [ { "tcp_stream": 1071, "frame_number": 43657, "display_filter": "frame.number == 43657", "timestamp_epoch": "1533965783.078816000" } ], "is_private": null, "observable_id": "observable-b9f9cac6731fb4a45d0b116f", "last_seen_epoch": "1533965783.078816000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965783.078816000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tass.com/i/b-search-icon.png", "evidence": [ { "tcp_stream": 1073, "frame_number": 43972, "display_filter": "frame.number == 43972", "timestamp_epoch": "1533965783.863922000" } ], "is_private": null, "observable_id": "observable-36148bd0a55b5a3698d9bbe2", "last_seen_epoch": "1533965783.863922000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965783.863922000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tass.com/i/loader_animation.gif", "evidence": [ { "tcp_stream": 1132, "frame_number": 42753, "display_filter": "frame.number == 42753", "timestamp_epoch": "1533965777.082941000" } ], "is_private": null, "observable_id": "observable-dd8799d5225cef37a563328d", "last_seen_epoch": "1533965777.082941000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965777.082941000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tass.com/i/loader_animation_lenta_new.gif", "evidence": [ { "tcp_stream": 1131, "frame_number": 42759, "display_filter": "frame.number == 42759", "timestamp_epoch": "1533965777.083931000" } ], "is_private": null, "observable_id": "observable-70544b3836dfc590f91e2cb0", "last_seen_epoch": "1533965777.083931000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965777.083931000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tass.com/i/mobile-search-header.png", "evidence": [ { "tcp_stream": 1130, "frame_number": 43851, "display_filter": "frame.number == 43851", "timestamp_epoch": "1533965783.656953000" } ], "is_private": null, "observable_id": "observable-7bac9d9643e88eb788bcde4a", "last_seen_epoch": "1533965783.656953000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965783.656953000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tass.com/i/up-button.png", "evidence": [ { "tcp_stream": 1070, "frame_number": 43877, "display_filter": "frame.number == 43877", "timestamp_epoch": "1533965783.726362000" } ], "is_private": null, "observable_id": "observable-474ef4c2748aab69c901e874", "last_seen_epoch": "1533965783.726362000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965783.726362000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tass.com/images/appstore.svg", "evidence": [ { "tcp_stream": 1133, "frame_number": 44183, "display_filter": "frame.number == 44183", "timestamp_epoch": "1533965784.398106000" } ], "is_private": null, "observable_id": "observable-ae6d426d78fbb57905981f94", "last_seen_epoch": "1533965784.398106000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965784.398106000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tass.com/images/newStyle/normal/foto.png", "evidence": [ { "tcp_stream": 1072, "frame_number": 44034, "display_filter": "frame.number == 44034", "timestamp_epoch": "1533965784.001309000" } ], "is_private": null, "observable_id": "observable-a20607758f18f258a2973ef2", "last_seen_epoch": "1533965784.001309000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965784.001309000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tass.com/images/newStyle/normal/icon_rybriki_normal.png", "evidence": [ { "tcp_stream": 1130, "frame_number": 44024, "display_filter": "frame.number == 44024", "timestamp_epoch": "1533965783.984760000" } ], "is_private": null, "observable_id": "observable-34d65076ae60504eec64acfc", "last_seen_epoch": "1533965783.984760000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965783.984760000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tass.com/images/newStyle/normal/lenta.png", "evidence": [ { "tcp_stream": 1133, "frame_number": 43996, "display_filter": "frame.number == 43996", "timestamp_epoch": "1533965783.906069000" } ], "is_private": null, "observable_id": "observable-86c705fa79b90a3999097077", "last_seen_epoch": "1533965783.906069000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965783.906069000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tass.com/images/newStyle/normal/logo/logo_footer_print_eng.png", "evidence": [ { "tcp_stream": 1073, "frame_number": 42766, "display_filter": "frame.number == 42766", "timestamp_epoch": "1533965777.098461000" } ], "is_private": null, "observable_id": "observable-b6a3357f5c76f8bb97a78dc6", "last_seen_epoch": "1533965777.098461000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965777.098461000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tass.com/images/newStyle/normal/logo/logo_futter_web_eng.png", "evidence": [ { "tcp_stream": 1070, "frame_number": 44072, "display_filter": "frame.number == 44072", "timestamp_epoch": "1533965784.033493000" } ], "is_private": null, "observable_id": "observable-bea7cf3830bf8277fa430eba", "last_seen_epoch": "1533965784.033493000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965784.033493000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tass.com/images/newStyle/normal/logo/logo_web_eng.png", "evidence": [ { "tcp_stream": 1134, "frame_number": 42704, "display_filter": "frame.number == 42704", "timestamp_epoch": "1533965776.948661000" } ], "is_private": null, "observable_id": "observable-24b75578394731391cd7624f", "last_seen_epoch": "1533965776.948661000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965776.948661000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tass.com/images/newStyle/normal/RSS.png", "evidence": [ { "tcp_stream": 1133, "frame_number": 43708, "display_filter": "frame.number == 43708", "timestamp_epoch": "1533965783.195452000" } ], "is_private": null, "observable_id": "observable-53111370f69a6a2f96168eb0", "last_seen_epoch": "1533965783.195452000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965783.195452000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tass.com/images/newStyle/normal/ru_en.png", "evidence": [ { "tcp_stream": 1073, "frame_number": 43710, "display_filter": "frame.number == 43710", "timestamp_epoch": "1533965783.196117000" } ], "is_private": null, "observable_id": "observable-37bfd364badee6803859155c", "last_seen_epoch": "1533965783.196117000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965783.196117000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tass.com/images/newStyle/normal/social/fb_futter_norma_1.png", "evidence": [ { "tcp_stream": 1130, "frame_number": 44220, "display_filter": "frame.number == 44220", "timestamp_epoch": "1533965784.463050000" } ], "is_private": null, "observable_id": "observable-0a9dbe16af02def60d3fd4f3", "last_seen_epoch": "1533965784.463050000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965784.463050000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tass.com/images/newStyle/normal/social/fb_top_norma_1.png", "evidence": [ { "tcp_stream": 1072, "frame_number": 43702, "display_filter": "frame.number == 43702", "timestamp_epoch": "1533965783.194825000" } ], "is_private": null, "observable_id": "observable-7adac10735d855cecdb3b007", "last_seen_epoch": "1533965783.194825000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965783.194825000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tass.com/images/newStyle/normal/social/g+_top_norma.png", "evidence": [ { "tcp_stream": 1070, "frame_number": 43706, "display_filter": "frame.number == 43706", "timestamp_epoch": "1533965783.195291000" } ], "is_private": null, "observable_id": "observable-46618f144f10d639c9cfa02b", "last_seen_epoch": "1533965783.195291000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965783.195291000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tass.com/images/newStyle/normal/social/rss_futter_norma_1.png", "evidence": [ { "tcp_stream": 1073, "frame_number": 44172, "display_filter": "frame.number == 44172", "timestamp_epoch": "1533965784.386643000" } ], "is_private": null, "observable_id": "observable-01476268a8a533dbe2658d38", "last_seen_epoch": "1533965784.386643000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965784.386643000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tass.com/images/newStyle/normal/social/tw_futter_norma_1.png", "evidence": [ { "tcp_stream": 1072, "frame_number": 44226, "display_filter": "frame.number == 44226", "timestamp_epoch": "1533965784.464167000" } ], "is_private": null, "observable_id": "observable-da1890a27bc507ec0ca3ce70", "last_seen_epoch": "1533965784.464167000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965784.464167000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tass.com/images/newStyle/normal/social/tw_top_norma_1.png", "evidence": [ { "tcp_stream": 1130, "frame_number": 43704, "display_filter": "frame.number == 43704", "timestamp_epoch": "1533965783.195053000" } ], "is_private": null, "observable_id": "observable-35df9874750b3ac51b162081", "last_seen_epoch": "1533965783.195053000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965783.195053000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tass.com/images/newStyle/normal/strelka.png", "evidence": [ { "tcp_stream": 1072, "frame_number": 43853, "display_filter": "frame.number == 43853", "timestamp_epoch": "1533965783.657067000" } ], "is_private": null, "observable_id": "observable-5af1ba4ed22e4fa9009e8ab3", "last_seen_epoch": "1533965783.657067000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965783.657067000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tass.com/js/activeViewService.js?v=1533913284", "evidence": [ { "tcp_stream": 1135, "frame_number": 42022, "display_filter": "frame.number == 42022", "timestamp_epoch": "1533965775.393893000" } ], "is_private": null, "observable_id": "observable-7af173994abead7f6ac3a2fe", "last_seen_epoch": "1533965775.393893000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965775.393893000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tass.com/js/adfox.asyn.code.scroll.js", "evidence": [ { "tcp_stream": 1075, "frame_number": 42289, "display_filter": "frame.number == 42289", "timestamp_epoch": "1533965775.986796000" } ], "is_private": null, "observable_id": "observable-22b787e042bf6bc566a9259d", "last_seen_epoch": "1533965775.986796000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965775.986796000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tass.com/js/angular-1.2.4.min.js?v=1533913284", "evidence": [ { "tcp_stream": 1133, "frame_number": 41784, "display_filter": "frame.number == 41784", "timestamp_epoch": "1533965774.640184000" } ], "is_private": null, "observable_id": "observable-b7e1a08162556688630883ea", "last_seen_epoch": "1533965774.640184000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965774.640184000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tass.com/js/audioWidget.js", "evidence": [ { "tcp_stream": 1071, "frame_number": 46441, "display_filter": "frame.number == 46441", "timestamp_epoch": "1533965791.370352000" } ], "is_private": null, "observable_id": "observable-927af26a6d913379ead7aebb", "last_seen_epoch": "1533965791.370352000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965791.370352000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tass.com/js/common/angular-sanitize.min.js?v=1533913284", "evidence": [ { "tcp_stream": 1132, "frame_number": 41781, "display_filter": "frame.number == 41781", "timestamp_epoch": "1533965774.639806000" } ], "is_private": null, "observable_id": "observable-38a1c15ec2c734fff3385ca1", "last_seen_epoch": "1533965774.639806000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965774.639806000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tass.com/js/common/angular-touch.js?v=1533913284", "evidence": [ { "tcp_stream": 1072, "frame_number": 41353, "display_filter": "frame.number == 41353", "timestamp_epoch": "1533965773.026022000" } ], "is_private": null, "observable_id": "observable-cc98a5a1fa4cbb61f2d55e53", "last_seen_epoch": "1533965773.026022000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965773.026022000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tass.com/js/common/infinite-scroll.js?v=1533913284", "evidence": [ { "tcp_stream": 1073, "frame_number": 41347, "display_filter": "frame.number == 41347", "timestamp_epoch": "1533965773.014142000" } ], "is_private": null, "observable_id": "observable-4bc81a1ff3d819761a681eaa", "last_seen_epoch": "1533965773.014142000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965773.014142000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tass.com/js/common/mainDirect.js?v=1533913284", "evidence": [ { "tcp_stream": 1134, "frame_number": 42021, "display_filter": "frame.number == 42021", "timestamp_epoch": "1533965775.393890000" } ], "is_private": null, "observable_id": "observable-f69066c0dbc99e21cb09febf", "last_seen_epoch": "1533965775.393890000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965775.393890000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tass.com/js/common/mainTopSlider.js?v=1533913284", "evidence": [ { "tcp_stream": 1070, "frame_number": 41850, "display_filter": "frame.number == 41850", "timestamp_epoch": "1533965774.796502000" } ], "is_private": null, "observable_id": "observable-0cecc40d9a73497eb2ed3ab2", "last_seen_epoch": "1533965774.796502000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965774.796502000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tass.com/js/common/mediaBlocksController.js?v=1533913284", "evidence": [ { "tcp_stream": 1132, "frame_number": 42230, "display_filter": "frame.number == 42230", "timestamp_epoch": "1533965775.861597000" } ], "is_private": null, "observable_id": "observable-12879c404d2548e56d5b09cb", "last_seen_epoch": "1533965775.861597000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965775.861597000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tass.com/js/common/photoModeController.js?v=1533913284", "evidence": [ { "tcp_stream": 1073, "frame_number": 41791, "display_filter": "frame.number == 41791", "timestamp_epoch": "1533965774.642796000" } ], "is_private": null, "observable_id": "observable-653a0761135ec60ac1446f1e", "last_seen_epoch": "1533965774.642796000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965774.642796000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tass.com/js/common/pressCenterCalendar.js?v=1533913284", "evidence": [ { "tcp_stream": 1075, "frame_number": 41876, "display_filter": "frame.number == 41876", "timestamp_epoch": "1533965774.845808000" } ], "is_private": null, "observable_id": "observable-ec8854160fc26172d3d824b7", "last_seen_epoch": "1533965774.845808000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965774.845808000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tass.com/js/common/tass.js?v=1533913284", "evidence": [ { "tcp_stream": 1075, "frame_number": 41437, "display_filter": "frame.number == 41437", "timestamp_epoch": "1533965773.488179000" } ], "is_private": null, "observable_id": "observable-759814d1da1cd619c480465b", "last_seen_epoch": "1533965773.488179000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965773.488179000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tass.com/js/common/textBroadcastController.js?v=1533913284", "evidence": [ { "tcp_stream": 1130, "frame_number": 46427, "display_filter": "frame.number == 46427", "timestamp_epoch": "1533965791.295458000" } ], "is_private": null, "observable_id": "observable-ebae22db7275da4d34b0bcbe", "last_seen_epoch": "1533965791.295458000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965791.295458000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tass.com/js/doublephoto/doublephoto.js?v=1533913284", "evidence": [ { "tcp_stream": 1130, "frame_number": 42049, "display_filter": "frame.number == 42049", "timestamp_epoch": "1533965775.438635000" } ], "is_private": null, "observable_id": "observable-2eb4f469f09c131e8e876123", "last_seen_epoch": "1533965775.438635000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965775.438635000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tass.com/js/hammer.min.js?v=1533913284", "evidence": [ { "tcp_stream": 1131, "frame_number": 42057, "display_filter": "frame.number == 42057", "timestamp_epoch": "1533965775.442355000" } ], "is_private": null, "observable_id": "observable-d718c17b55b7c192943946de", "last_seen_epoch": "1533965775.442355000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965775.442355000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tass.com/js/highcharts/highcharts.js?v=1533913284", "evidence": [ { "tcp_stream": 1070, "frame_number": 42266, "display_filter": "frame.number == 42266", "timestamp_epoch": "1533965775.928489000" } ], "is_private": null, "observable_id": "observable-44125596516c1bb995989de4", "last_seen_epoch": "1533965775.928489000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965775.928489000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tass.com/js/jquery-1.8.3.min.js?v=1533913284", "evidence": [ { "tcp_stream": 1070, "frame_number": 40113, "display_filter": "frame.number == 40113", "timestamp_epoch": "1533965770.052650000" } ], "is_private": null, "observable_id": "observable-c39d69325a2a9b929a2c0029", "last_seen_epoch": "1533965770.052650000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965770.052650000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tass.com/js/jquery-ui.min.js?v=1533913284", "evidence": [ { "tcp_stream": 1071, "frame_number": 41126, "display_filter": "frame.number == 41126", "timestamp_epoch": "1533965772.393285000" } ], "is_private": null, "observable_id": "observable-c775783562b9152165daadb7", "last_seen_epoch": "1533965772.393285000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965772.393285000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tass.com/js/jquery.cookie.js?v=1533913284", "evidence": [ { "tcp_stream": 1073, "frame_number": 42248, "display_filter": "frame.number == 42248", "timestamp_epoch": "1533965775.873952000" } ], "is_private": null, "observable_id": "observable-8bb6616e49ac0cc54457e45a", "last_seen_epoch": "1533965775.873952000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965775.873952000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tass.com/js/jwplayer7/jwplayer.js", "evidence": [ { "tcp_stream": 1072, "frame_number": 46437, "display_filter": "frame.number == 46437", "timestamp_epoch": "1533965791.350526000" } ], "is_private": null, "observable_id": "observable-5a2250945f7d9841ca7d1f48", "last_seen_epoch": "1533965791.350526000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965791.350526000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tass.com/js/mainSliderWidget.js", "evidence": [ { "tcp_stream": 1135, "frame_number": 42488, "display_filter": "frame.number == 42488", "timestamp_epoch": "1533965776.394706000" } ], "is_private": null, "observable_id": "observable-be77194c54689d6a71711032", "last_seen_epoch": "1533965776.394706000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965776.394706000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tass.com/js/social/socialDirective.js", "evidence": [ { "tcp_stream": 1070, "frame_number": 46484, "display_filter": "frame.number == 46484", "timestamp_epoch": "1533965791.472841000" } ], "is_private": null, "observable_id": "observable-7065842fce050a9b2ec65349", "last_seen_epoch": "1533965791.472841000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965791.472841000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tass.com/js/videoWidget.js", "evidence": [ { "tcp_stream": 1133, "frame_number": 46465, "display_filter": "frame.number == 46465", "timestamp_epoch": "1533965791.437407000" } ], "is_private": null, "observable_id": "observable-4311afe49b9dd3c3f04e7790", "last_seen_epoch": "1533965791.437407000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965791.437407000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tass.com/js/zoom/angular.rangeSlider.js?v=1533913284", "evidence": [ { "tcp_stream": 1070, "frame_number": 41365, "display_filter": "frame.number == 41365", "timestamp_epoch": "1533965773.105996000" } ], "is_private": null, "observable_id": "observable-bf1eddb4776f95e658b19003", "last_seen_epoch": "1533965773.105996000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965773.105996000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tass.com/js/zoom/ng-pinch-zoom.js?v=1533913284", "evidence": [ { "tcp_stream": 1074, "frame_number": 41391, "display_filter": "frame.number == 41391", "timestamp_epoch": "1533965773.250617000" } ], "is_private": null, "observable_id": "observable-2ad30590414d0868b4eff6c8", "last_seen_epoch": "1533965773.250617000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965773.250617000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tass.com/js/zoom/zoomController.js?v=1533913284", "evidence": [ { "tcp_stream": 1074, "frame_number": 42204, "display_filter": "frame.number == 42204", "timestamp_epoch": "1533965775.813738000" } ], "is_private": null, "observable_id": "observable-f607558937ea40148bf00969", "last_seen_epoch": "1533965775.813738000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965775.813738000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tass.com/site/getCurrencyDynamics?currency=USD", "evidence": [ { "tcp_stream": 1070, "frame_number": 44239, "display_filter": "frame.number == 44239", "timestamp_epoch": "1533965784.480473000" } ], "is_private": null, "observable_id": "observable-af36fa0ad616386092e7bd94", "last_seen_epoch": "1533965784.480473000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965784.480473000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tpc.googlesyndication.com/safeframe/1-0-29/html/container.html", "evidence": [ { "tcp_stream": 1165, "frame_number": 44277, "display_filter": "frame.number == 44277", "timestamp_epoch": "1533965784.655535000" }, { "tcp_stream": 1166, "frame_number": 44398, "display_filter": "frame.number == 44398", "timestamp_epoch": "1533965785.099585000" } ], "is_private": null, "observable_id": "observable-df93778287688af42c54e87b", "last_seen_epoch": "1533965785.099585000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965784.655535000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://vk.com/js/api/openapi.js?v=1533913284", "evidence": [ { "tcp_stream": 1076, "frame_number": 40209, "display_filter": "frame.number == 40209", "timestamp_epoch": "1533965770.487843000" } ], "is_private": null, "observable_id": "observable-c097d75e1657927c27d44b3b", "last_seen_epoch": "1533965770.487843000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965770.487843000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt", "evidence": [ { "tcp_stream": 1034, "frame_number": 39486, "display_filter": "frame.number == 39486", "timestamp_epoch": "1533965401.164021000" } ], "is_private": null, "observable_id": "observable-4e3b5aa48737bccf00854375", "last_seen_epoch": "1533965401.164021000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965401.164021000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab", "evidence": [ { "tcp_stream": 1035, "frame_number": 39496, "display_filter": "frame.number == 39496", "timestamp_epoch": "1533965406.568628000" } ], "is_private": null, "observable_id": "observable-f3026828d356b0a60ae1cfcd", "last_seen_epoch": "1533965406.568628000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965406.568628000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/D69B561148F01C77C54578C10926DF5B856976AD.crt", "evidence": [ { "tcp_stream": 104, "frame_number": 4331, "display_filter": "frame.number == 4331", "timestamp_epoch": "1533964554.234128000" }, { "tcp_stream": 103, "frame_number": 4350, "display_filter": "frame.number == 4350", "timestamp_epoch": "1533964554.236277000" } ], "is_private": null, "observable_id": "observable-0d7cbd7146e7b70d63742253", "last_seen_epoch": "1533964554.236277000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964554.234128000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/DF3C24F9BFD666761B268073FE06D1CC8D4F82A4.crt", "evidence": [ { "tcp_stream": 773, "frame_number": 28015, "display_filter": "frame.number == 28015", "timestamp_epoch": "1533965036.696949000" }, { "tcp_stream": 774, "frame_number": 28018, "display_filter": "frame.number == 28018", "timestamp_epoch": "1533965036.700513000" }, { "tcp_stream": 775, "frame_number": 28026, "display_filter": "frame.number == 28026", "timestamp_epoch": "1533965036.752397000" }, { "tcp_stream": 776, "frame_number": 28030, "display_filter": "frame.number == 28030", "timestamp_epoch": "1533965036.807677000" } ], "is_private": null, "observable_id": "observable-0d02afeb1125a2804880a40f", "last_seen_epoch": "1533965036.807677000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965036.696949000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.google.com/ads/measurement/l?ebcid=ALh7CaQwkG-IqLuL2aDRnK970v9nGK385P_BkWxEG1yaUS4rlUVqUrlgZf-3JS25GWjS571y2n1JUt5kBztsnVFTQN5y-yC8Tw", "evidence": [ { "tcp_stream": 1208, "frame_number": 45898, "display_filter": "frame.number == 45898", "timestamp_epoch": "1533965789.194892000" } ], "is_private": null, "observable_id": "observable-ce4eebb46188d5ebfc88ec85", "last_seen_epoch": "1533965789.194892000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965789.194892000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.googletagmanager.com/gtm.js?id=GTM-KX9ZXT", "evidence": [ { "tcp_stream": 1147, "frame_number": 43686, "display_filter": "frame.number == 43686", "timestamp_epoch": "1533965783.173455000" } ], "is_private": null, "observable_id": "observable-1fe50dd387c89078c02c8ed4", "last_seen_epoch": "1533965783.173455000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965783.173455000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.googletagservices.com/tag/js/gpt.js", "evidence": [ { "tcp_stream": 1139, "frame_number": 43669, "display_filter": "frame.number == 43669", "timestamp_epoch": "1533965783.098093000" } ], "is_private": null, "observable_id": "observable-0ba6045ab36eeca428885917", "last_seen_epoch": "1533965783.098093000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965783.098093000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.msftncsi.com/ncsi.txt", "evidence": [ { "tcp_stream": 26, "frame_number": 385, "display_filter": "frame.number == 385", "timestamp_epoch": "1533964519.556735000" } ], "is_private": null, "observable_id": "observable-3c493a967583e617bdd93dd5", "last_seen_epoch": "1533964519.556735000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964519.556735000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.tns-counter.ru/V13a***R%3E*itartass_com/ru/UTF-8/tmsec=itartass_total/851285090", "evidence": [ { "tcp_stream": 1137, "frame_number": 43727, "display_filter": "frame.number == 43727", "timestamp_epoch": "1533965783.254353000" } ], "is_private": null, "observable_id": "observable-643aff7c7625220b31a5675f", "last_seen_epoch": "1533965783.254353000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965783.254353000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.tns-counter.ru/V13b***R%3E*itartass_com/ru/UTF-8/tmsec=itartass_total/851285090", "evidence": [ { "tcp_stream": 1137, "frame_number": 43933, "display_filter": "frame.number == 43933", "timestamp_epoch": "1533965783.795213000" } ], "is_private": null, "observable_id": "observable-0058f646519d12c02bbb0738", "last_seen_epoch": "1533965783.795213000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965783.795213000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://x.ss2.us/x.cer", "evidence": [ { "tcp_stream": 158, "frame_number": 6267, "display_filter": "frame.number == 6267", "timestamp_epoch": "1533964560.250312000" }, { "tcp_stream": 159, "frame_number": 6271, "display_filter": "frame.number == 6271", "timestamp_epoch": "1533964560.267322000" } ], "is_private": null, "observable_id": "observable-457e49d734a4ccac9e0f7453", "last_seen_epoch": "1533964560.267322000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964560.250312000" }, { "type": "user_agent", "roles": [ "http-client" ], "value": "Microsoft NCSI", "evidence": [ { "tcp_stream": 26, "frame_number": 385, "display_filter": "frame.number == 385", "timestamp_epoch": "1533964519.556735000" } ], "is_private": null, "observable_id": "observable-87fa9ae54d327770952d5a4e", "last_seen_epoch": "1533964519.556735000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964519.556735000" }, { "type": "user_agent", "roles": [ "http-client" ], "value": "Microsoft-CryptoAPI/6.1", "evidence": [ { "tcp_stream": 104, "frame_number": 4331, "display_filter": "frame.number == 4331", "timestamp_epoch": "1533964554.234128000" }, { "tcp_stream": 103, "frame_number": 4350, "display_filter": "frame.number == 4350", "timestamp_epoch": "1533964554.236277000" }, { "tcp_stream": 127, "frame_number": 5383, "display_filter": "frame.number == 5383", "timestamp_epoch": "1533964556.494073000" }, { "tcp_stream": 128, "frame_number": 5387, "display_filter": "frame.number == 5387", "timestamp_epoch": "1533964556.515882000" }, { "tcp_stream": 158, "frame_number": 6267, "display_filter": "frame.number == 6267", "timestamp_epoch": "1533964560.250312000" }, { "tcp_stream": 159, "frame_number": 6271, "display_filter": "frame.number == 6271", "timestamp_epoch": "1533964560.267322000" }, { "tcp_stream": 218, "frame_number": 8633, "display_filter": "frame.number == 8633", "timestamp_epoch": "1533964898.552621000" }, { "tcp_stream": 217, "frame_number": 8637, "display_filter": "frame.number == 8637", "timestamp_epoch": "1533964898.553823000" }, { "tcp_stream": 296, "frame_number": 11487, "display_filter": "frame.number == 11487", "timestamp_epoch": "1533964901.324527000" }, { "tcp_stream": 297, "frame_number": 11488, "display_filter": "frame.number == 11488", "timestamp_epoch": "1533964901.324607000" }, { "tcp_stream": 665, "frame_number": 23982, "display_filter": "frame.number == 23982", "timestamp_epoch": "1533964998.555480000" }, { "tcp_stream": 664, "frame_number": 23985, "display_filter": "frame.number == 23985", "timestamp_epoch": "1533964998.555964000" }, { "tcp_stream": 773, "frame_number": 28015, "display_filter": "frame.number == 28015", "timestamp_epoch": "1533965036.696949000" }, { "tcp_stream": 774, "frame_number": 28018, "display_filter": "frame.number == 28018", "timestamp_epoch": "1533965036.700513000" }, { "tcp_stream": 775, "frame_number": 28026, "display_filter": "frame.number == 28026", "timestamp_epoch": "1533965036.752397000" }, { "tcp_stream": 776, "frame_number": 28030, "display_filter": "frame.number == 28030", "timestamp_epoch": "1533965036.807677000" } ], "is_private": null, "observable_id": "observable-dd97daa8ada09b4f120ea697", "last_seen_epoch": "1533965036.807677000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964554.234128000" }, { "type": "user_agent", "roles": [ "http-client" ], "value": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)", "evidence": [ { "tcp_stream": 178, "frame_number": 7263, "display_filter": "frame.number == 7263", "timestamp_epoch": "1533964850.464296000" }, { "tcp_stream": 1034, "frame_number": 39486, "display_filter": "frame.number == 39486", "timestamp_epoch": "1533965401.164021000" }, { "tcp_stream": 1035, "frame_number": 39496, "display_filter": "frame.number == 39496", "timestamp_epoch": "1533965406.568628000" }, { "tcp_stream": 1036, "frame_number": 39557, "display_filter": "frame.number == 39557", "timestamp_epoch": "1533965406.977212000" }, { "tcp_stream": 1046, "frame_number": 39676, "display_filter": "frame.number == 39676", "timestamp_epoch": "1533965418.580357000" }, { "tcp_stream": 1046, "frame_number": 39681, "display_filter": "frame.number == 39681", "timestamp_epoch": "1533965419.412338000" }, { "tcp_stream": 1047, "frame_number": 39699, "display_filter": "frame.number == 39699", "timestamp_epoch": "1533965435.576793000" }, { "tcp_stream": 1048, "frame_number": 39712, "display_filter": "frame.number == 39712", "timestamp_epoch": "1533965451.757604000" }, { "tcp_stream": 1049, "frame_number": 39725, "display_filter": "frame.number == 39725", "timestamp_epoch": "1533965467.936416000" }, { "tcp_stream": 1050, "frame_number": 39741, "display_filter": "frame.number == 39741", "timestamp_epoch": "1533965484.293094000" }, { "tcp_stream": 1051, "frame_number": 39754, "display_filter": "frame.number == 39754", "timestamp_epoch": "1533965500.471438000" }, { "tcp_stream": 1052, "frame_number": 39767, "display_filter": "frame.number == 39767", "timestamp_epoch": "1533965516.649335000" }, { "tcp_stream": 1053, "frame_number": 39781, "display_filter": "frame.number == 39781", "timestamp_epoch": "1533965532.902740000" }, { "tcp_stream": 1054, "frame_number": 39796, "display_filter": "frame.number == 39796", "timestamp_epoch": "1533965549.287287000" }, { "tcp_stream": 1055, "frame_number": 39809, "display_filter": "frame.number == 39809", "timestamp_epoch": "1533965565.437819000" }, { "tcp_stream": 1057, "frame_number": 39879, "display_filter": "frame.number == 39879", "timestamp_epoch": "1533965581.646796000" }, { "tcp_stream": 1058, "frame_number": 39895, "display_filter": "frame.number == 39895", "timestamp_epoch": "1533965597.772796000" }, { "tcp_stream": 1060, "frame_number": 39951, "display_filter": "frame.number == 39951", "timestamp_epoch": "1533965613.953658000" }, { "tcp_stream": 1061, "frame_number": 39970, "display_filter": "frame.number == 39970", "timestamp_epoch": "1533965630.124714000" }, { "tcp_stream": 1062, "frame_number": 39983, "display_filter": "frame.number == 39983", "timestamp_epoch": "1533965646.289888000" } ], "is_private": null, "observable_id": "observable-547137dfe17242ba21f001c0", "last_seen_epoch": "1533965906.527374000", "enrichment_state": "not_requested", "first_seen_epoch": "1533964850.464296000" }, { "type": "user_agent", "roles": [ "http-client" ], "value": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "evidence": [ { "tcp_stream": 1071, "frame_number": 40100, "display_filter": "frame.number == 40100", "timestamp_epoch": "1533965768.745327000" }, { "tcp_stream": 1070, "frame_number": 40113, "display_filter": "frame.number == 40113", "timestamp_epoch": "1533965770.052650000" }, { "tcp_stream": 1074, "frame_number": 40165, "display_filter": "frame.number == 40165", "timestamp_epoch": "1533965770.465535000" }, { "tcp_stream": 1072, "frame_number": 40171, "display_filter": "frame.number == 40171", "timestamp_epoch": "1533965770.466207000" }, { "tcp_stream": 1073, "frame_number": 40173, "display_filter": "frame.number == 40173", "timestamp_epoch": "1533965770.466368000" }, { "tcp_stream": 1075, "frame_number": 40177, "display_filter": "frame.number == 40177", "timestamp_epoch": "1533965770.467225000" }, { "tcp_stream": 1076, "frame_number": 40209, "display_filter": "frame.number == 40209", "timestamp_epoch": "1533965770.487843000" }, { "tcp_stream": 1071, "frame_number": 40213, "display_filter": "frame.number == 40213", "timestamp_epoch": "1533965770.489095000" }, { "tcp_stream": 1071, "frame_number": 40361, "display_filter": "frame.number == 40361", "timestamp_epoch": "1533965770.816258000" }, { "tcp_stream": 1074, "frame_number": 40510, "display_filter": "frame.number == 40510", "timestamp_epoch": "1533965771.062766000" }, { "tcp_stream": 1072, "frame_number": 40518, "display_filter": "frame.number == 40518", "timestamp_epoch": "1533965771.072573000" }, { "tcp_stream": 1075, "frame_number": 40562, "display_filter": "frame.number == 40562", "timestamp_epoch": "1533965771.132264000" }, { "tcp_stream": 1071, "frame_number": 40737, "display_filter": "frame.number == 40737", "timestamp_epoch": "1533965771.477596000" }, { "tcp_stream": 1073, "frame_number": 41022, "display_filter": "frame.number == 41022", "timestamp_epoch": "1533965773.993678000" }, { "tcp_stream": 1070, "frame_number": 41026, "display_filter": "frame.number == 41026", "timestamp_epoch": "1533965774.002334000" }, { "tcp_stream": 1072, "frame_number": 41034, "display_filter": "frame.number == 41034", "timestamp_epoch": "1533965774.016397000" }, { "tcp_stream": 1074, "frame_number": 41036, "display_filter": "frame.number == 41036", "timestamp_epoch": "1533965774.016484000" }, { "tcp_stream": 1075, "frame_number": 41060, "display_filter": "frame.number == 41060", "timestamp_epoch": "1533965774.048915000" }, { "tcp_stream": 1071, "frame_number": 41126, "display_filter": "frame.number == 41126", "timestamp_epoch": "1533965772.393285000" }, { "tcp_stream": 1130, "frame_number": 41322, "display_filter": "frame.number == 41322", "timestamp_epoch": "1533965772.824858000" } ], "is_private": null, "observable_id": "observable-3683ea38f54246a4cd284712", "last_seen_epoch": "1533965791.472841000", "enrichment_state": "not_requested", "first_seen_epoch": "1533965768.745327000" } ], "schema_version": "pcap-analysis-v1", "semantic_sha256": "eff186db84f39bad8d8e2238b877933bb8a81647330004f85a47dde7eb9b8ce5", "analyzer_manifest": { "limits": { "max_flows": 50000, "max_endpoints": 20000, "max_upload_bytes": 536870912, "max_exported_files": 50000, "max_events_per_kind": 50000, "max_exported_objects": 500, "tool_timeout_seconds": 300, "max_object_hash_index": 50000, "max_tool_output_bytes": 268435456, "max_exported_total_bytes": 268435456, "max_exported_object_bytes": 52428800 }, "profile_id": "tshark-evidence-v6", "profile_sha256": "aff64bf3786902d5d7a2c1a9be158a5246cc81aecea6c44eda74701431070465", "schema_version": "pcap-analyzer-manifest-v1", "tshark_version": "TShark (Wireshark) 4.4.18.", "manifest_sha256": "1f3c02483cfea06d85bd326f6e225f3f41a4ab703677d40537577e8bb85c1ce0", "capinfos_version": "Capinfos (Wireshark) 4.4.18.", "rulepack_version": "pcap-rules-v5", "implementation_sha256": "1a7d19199ff58059a12b34656620481b502fadc52d115b5f4b42fc28e5817c3c", "requested_fields_sha256": "e7a6eff11f7ae2101845897ce7e3b0a0e9cea31bdea4a824734869f39f3fb4f3", "supported_profile_fields_sha256": "6d94b9bc3aea93d5f7f4f815bdd025560ceba0d5e27b380ad14da28b44947994" }, "attack_candidates": [ { "name": "Application Layer Protocol: Web Protocols", "status": "suggested", "tactic": "command-and-control", "evidence": [ { "tcp_stream": 1036, "frame_number": 39557, "display_filter": "frame.number == 39557", "timestamp_epoch": "1533965406.977212000" }, { "tcp_stream": 1046, "frame_number": 39676, "display_filter": "frame.number == 39676", "timestamp_epoch": "1533965418.580357000" }, { "tcp_stream": 1046, "frame_number": 39681, "display_filter": "frame.number == 39681", "timestamp_epoch": "1533965419.412338000" }, { "tcp_stream": 1047, "frame_number": 39699, "display_filter": "frame.number == 39699", "timestamp_epoch": "1533965435.576793000" }, { "tcp_stream": 1048, "frame_number": 39712, "display_filter": "frame.number == 39712", "timestamp_epoch": "1533965451.757604000" } ], "attack_id": "T1071.001", "confidence": 0.85, "finding_ids": [ "finding-8798192d6b4571d1d4d40028" ], "mapping_basis": "versioned-deterministic-rule" }, { "name": "Ingress Tool Transfer", "status": "suggested", "tactic": "command-and-control", "evidence": [ { "tcp_stream": 1070, "frame_number": 40113, "display_filter": "frame.number == 40113", "timestamp_epoch": "1533965770.052650000" }, { "tcp_stream": 1076, "frame_number": 40209, "display_filter": "frame.number == 40209", "timestamp_epoch": "1533965770.487843000" }, { "tcp_stream": 1076, "frame_number": 40506, "display_filter": "frame.number == 40506", "timestamp_epoch": "1533965771.061475000" }, { "tcp_stream": 1070, "frame_number": 41024, "display_filter": "frame.number == 41024", "timestamp_epoch": "1533965774.001669000" }, { "tcp_stream": 1071, "frame_number": 41126, "display_filter": "frame.number == 41126", "timestamp_epoch": "1533965772.393285000" }, { "tcp_stream": 1073, "frame_number": 41347, "display_filter": "frame.number == 41347", "timestamp_epoch": "1533965773.014142000" }, { "tcp_stream": 1072, "frame_number": 41353, "display_filter": "frame.number == 41353", "timestamp_epoch": "1533965773.026022000" }, { "tcp_stream": 1070, "frame_number": 41365, "display_filter": "frame.number == 41365", "timestamp_epoch": "1533965773.105996000" }, { "tcp_stream": 1074, "frame_number": 41391, "display_filter": "frame.number == 41391", "timestamp_epoch": "1533965773.250617000" }, { "tcp_stream": 1075, "frame_number": 41437, "display_filter": "frame.number == 41437", "timestamp_epoch": "1533965773.488179000" }, { "tcp_stream": 1132, "frame_number": 41781, "display_filter": "frame.number == 41781", "timestamp_epoch": "1533965774.639806000" }, { "tcp_stream": 1133, "frame_number": 41784, "display_filter": "frame.number == 41784", "timestamp_epoch": "1533965774.640184000" }, { "tcp_stream": 1073, "frame_number": 41786, "display_filter": "frame.number == 41786", "timestamp_epoch": "1533965774.640490000" }, { "tcp_stream": 1073, "frame_number": 41791, "display_filter": "frame.number == 41791", "timestamp_epoch": "1533965774.642796000" }, { "tcp_stream": 1070, "frame_number": 41848, "display_filter": "frame.number == 41848", "timestamp_epoch": "1533965774.795760000" }, { "tcp_stream": 1070, "frame_number": 41850, "display_filter": "frame.number == 41850", "timestamp_epoch": "1533965774.796502000" }, { "tcp_stream": 1075, "frame_number": 41872, "display_filter": "frame.number == 41872", "timestamp_epoch": "1533965774.844975000" }, { "tcp_stream": 1075, "frame_number": 41876, "display_filter": "frame.number == 41876", "timestamp_epoch": "1533965774.845808000" }, { "tcp_stream": 1134, "frame_number": 42021, "display_filter": "frame.number == 42021", "timestamp_epoch": "1533965775.393890000" }, { "tcp_stream": 1135, "frame_number": 42022, "display_filter": "frame.number == 42022", "timestamp_epoch": "1533965775.393893000" }, { "tcp_stream": 1130, "frame_number": 42049, "display_filter": "frame.number == 42049", "timestamp_epoch": "1533965775.438635000" }, { "tcp_stream": 1131, "frame_number": 42057, "display_filter": "frame.number == 42057", "timestamp_epoch": "1533965775.442355000" }, { "tcp_stream": 1074, "frame_number": 42201, "display_filter": "frame.number == 42201", "timestamp_epoch": "1533965775.812971000" }, { "tcp_stream": 1074, "frame_number": 42204, "display_filter": "frame.number == 42204", "timestamp_epoch": "1533965775.813738000" }, { "tcp_stream": 1132, "frame_number": 42224, "display_filter": "frame.number == 42224", "timestamp_epoch": "1533965775.860779000" } ], "attack_id": "T1105", "confidence": 0.8, "finding_ids": [ "finding-00c291b89975a084ec3ca605", "finding-08888b1df2552c9ad869e978", "finding-0b8a7bfdd58462b99bf6585d", "finding-15444850cb1a65256f1cc02b", "finding-1a2d3f5d7f8e3cd604dfdfe9", "finding-1dea55259f57f179e0d2eb71", "finding-21f6889d14d5ee7e07f12cd2", "finding-2a1ed4994e65289283c77598", "finding-361b6ad8a0eb9a61e280b4e8", "finding-395d635f884761d139c04a85", "finding-3cdb2afccdff86b9c35bec62", "finding-3f0ed1b278193d391bf5372f", "finding-5c2d05d29eda3147469063ac", "finding-5c426f25219e07b1a83e312f", "finding-745f7c23326bbe6e83ba542c", "finding-779eca848c7626f7eb302d1a", "finding-78daea85d10928f7a2fc4662", "finding-79d2965a7b00ce4479fc8da3", "finding-7c01c3477831862903d07f33", "finding-8bd76b09c82f5f200541d495", "finding-96abb0b6a1f83a6e50509b6a", "finding-9b11ebef8f3e3a98db57e1a6", "finding-9c60064dc2f38d4b856a1246", "finding-9c9340b301125a695118cef7", "finding-a2426691066db3250439f5a9", "finding-a9a89059f9e02062a63ed0b8", "finding-bb4b4ff8054af1a06f563eb7", "finding-bc988b8b9edf9da315bdd9fd", "finding-bf5cd1cd4a136eb5c4cbe791", "finding-c49073509e03d50105c86230", "finding-c7236ee2bc47223de830e818", "finding-ca9597b4e67b7fe2b72c27d6", "finding-cdde78502cba802e6e588769", "finding-d0321b76736ebd67bb6e2035", "finding-e5cb782606a98614ecaf2a4f", "finding-fb2142355b7d51b4050b493b", "finding-ffc196f02b7c315e5e7f9a9f" ], "mapping_basis": "versioned-deterministic-rule" } ], "analysis_key_material": { "source_sha256": "c9e136e6e53daec4deec416e545d56e3c430dbc2d38374cf7a4dc839a0f4a3ff", "rulepack_version": "pcap-rules-v5", "analyzer_manifest_sha256": "1f3c02483cfea06d85bd326f6e225f3f41a4ab703677d40537577e8bb85c1ce0" } }, "context": { "mode": "local-only", "matches": [], "coverage": { "truncated": false, "no_exact_match": 1459, "observable_limit": 5000, "observables_total": 1459, "matched_observables": 0, "observables_checked": 1459, "prior_cases_checked": 50, "prior_case_limit_reached": true }, "created_at": "2026-09-22T16:10:05.666009+00:00", "session_id": "e81e8f60-468f-4cc1-a8e4-2c0bac2dbd15", "techniques": [ { "url": "https://attack.mitre.org/techniques/T1071/001", "name": "Web Protocols", "status": "catalog-context-not-validation-of-behavior", "attack_id": "T1071.001", "detection": "", "platforms": [ "ESXi", "Linux", "macOS", "Network Devices", "Windows" ], "data_sources": [ "NSM:Flow", "WinEventLog:Sysmon", "auditd:SYSCALL", "macos:osquery", "macos:unifiedlog", "esxi:shell" ], "catalog_version_id": 851, "detection_strategies": [ { "name": "Detection of Web Protocol-Based C2 Over HTTP, HTTPS, or WebSockets", "stix_id": "x-mitre-detection-strategy--e6496b9b-2458-4616-9712-a7c0da7fd3bc", "attack_id": "DET0027" } ], "detection_links_truncated": false }, { "url": "https://attack.mitre.org/techniques/T1105", "name": "Ingress Tool Transfer", "status": "catalog-context-not-validation-of-behavior", "attack_id": "T1105", "detection": "", "platforms": [ "ESXi", "Linux", "macOS", "Network Devices", "Windows" ], "data_sources": [ "WinEventLog:Sysmon", "auditd:SYSCALL", "iptables:LOG", "macos:endpointsecurity", "macos:unifiedlog", "esxi:hostd", "esxi:vmkernel", "NSM:Flow", "snmp:syslog" ], "catalog_version_id": 851, "detection_strategies": [ { "name": "Detect Ingress Tool Transfers via Behavioral Chain", "stix_id": "x-mitre-detection-strategy--67677c4c-5778-49eb-ae74-1920645b8554", "attack_id": "DET0060" } ], "detection_links_truncated": false } ], "interpretation": "No match means unknown in this corpus. Local CTI may postdate the capture. Matches and shared infrastructure require review; no automatic promotion or attribution.", "schema_version": "pcap-context-v1", "snapshot_sha256": "1cc9263973d160d702ecb33226cfcf15dda3096212aafa2210225d8a92346c69", "source_actor_links": [], "external_enrichment": { "reason": "Requires explicit provider consent and privacy review", "status": "not-requested", "requests": 0 }, "source_semantic_sha256": "eff186db84f39bad8d8e2238b877933bb8a81647330004f85a47dde7eb9b8ce5", "cross_case_correlations": [ { "shared_count": 4, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 9, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 35, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 140, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 7, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 20, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 6, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 14, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 5, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 34, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 13, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 8, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 64, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 106, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 13, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 10, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 51, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 157, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 2, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 6, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 3, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 6, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 6, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 8, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 5, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 10, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 8, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 5, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 7, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." } ] }, "assessment": { "policy_version": "pcap-assessment-v3", "source_semantic_sha256": "eff186db84f39bad8d8e2238b877933bb8a81647330004f85a47dde7eb9b8ce5", "items": [ { "observable_id": "observable-76583fca897523fee7e5fcf4", "type": "domain", "value": "1605158521.rsc.cdn77.org", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 221, "frame_number": 21150, "display_filter": "frame.number == 21150", "timestamp_epoch": "1533964967.906377000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-934e2627f9334c71757cb2a7", "type": "domain", "value": "2886.tm.zedo.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:49:00.522590+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:00.520047+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 108, "frame_number": 9478, "display_filter": "frame.number == 9478", "timestamp_epoch": "1533964899.379243000" }, { "udp_stream": 108, "frame_number": 9752, "display_filter": "frame.number == 9752", "timestamp_epoch": "1533964899.625132000" }, { "tcp_stream": 262, "frame_number": 9929, "display_filter": "frame.number == 9929", "timestamp_epoch": "1533964899.746035000" }, { "tcp_stream": 263, "frame_number": 9933, "display_filter": "frame.number == 9933", "timestamp_epoch": "1533964899.746839000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:49:00.516856+00:00" }, { "observable_id": "observable-fe10fa0795e6b4e516999708", "type": "domain", "value": "506163eff52ac0e798da9465b8af1d86.lswcdn.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 33, "frame_number": 649, "display_filter": "frame.number == 649", "timestamp_epoch": "1533964545.745951000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f777454fc3bd916acbb09b8e", "type": "domain", "value": "a.company-target.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:49:00.706504+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:00.703676+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 109, "frame_number": 9971, "display_filter": "frame.number == 9971", "timestamp_epoch": "1533964899.767493000" }, { "udp_stream": 109, "frame_number": 10021, "display_filter": "frame.number == 10021", "timestamp_epoch": "1533964899.857368000" }, { "tcp_stream": 266, "frame_number": 10224, "display_filter": "frame.number == 10224", "timestamp_epoch": "1533964899.986592000" }, { "tcp_stream": 267, "frame_number": 10240, "display_filter": "frame.number == 10240", "timestamp_epoch": "1533964899.991848000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:49:00.700020+00:00" }, { "observable_id": "observable-10222abcad79cdccbc816638", "type": "domain", "value": "a.tribalfusion.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:44:46.368151+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:00.875661+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 193, "frame_number": 18475, "display_filter": "frame.number == 18475", "timestamp_epoch": "1533964959.057459000" }, { "udp_stream": 193, "frame_number": 18627, "display_filter": "frame.number == 18627", "timestamp_epoch": "1533964959.502881000" }, { "tcp_stream": 532, "frame_number": 18707, "display_filter": "frame.number == 18707", "timestamp_epoch": "1533964959.880531000" }, { "tcp_stream": 531, "frame_number": 18708, "display_filter": "frame.number == 18708", "timestamp_epoch": "1533964959.880813000" }, { "tcp_stream": 816, "frame_number": 30631, "display_filter": "frame.number == 30631", "timestamp_epoch": "1533965099.029671000" }, { "tcp_stream": 817, "frame_number": 30642, "display_filter": "frame.number == 30642", "timestamp_epoch": "1533965099.044869000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:49:00.873479+00:00" }, { "observable_id": "observable-fbb47adf15a799bb788dab4c", "type": "domain", "value": "a1.adform.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:49:00.881562+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:00.879602+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 195, "frame_number": 18665, "display_filter": "frame.number == 18665", "timestamp_epoch": "1533964959.603319000" }, { "udp_stream": 195, "frame_number": 18760, "display_filter": "frame.number == 18760", "timestamp_epoch": "1533964960.021343000" }, { "tcp_stream": 538, "frame_number": 18890, "display_filter": "frame.number == 18890", "timestamp_epoch": "1533964960.194958000" }, { "tcp_stream": 537, "frame_number": 18894, "display_filter": "frame.number == 18894", "timestamp_epoch": "1533964960.196730000" }, { "tcp_stream": 724, "frame_number": 27001, "display_filter": "frame.number == 27001", "timestamp_epoch": "1533965034.057886000" }, { "tcp_stream": 723, "frame_number": 27008, "display_filter": "frame.number == 27008", "timestamp_epoch": "1533965034.073971000" }, { "tcp_stream": 792, "frame_number": 29613, "display_filter": "frame.number == 29613", "timestamp_epoch": "1533965096.865848000" }, { "tcp_stream": 793, "frame_number": 29617, "display_filter": "frame.number == 29617", "timestamp_epoch": "1533965096.882289000" }, { "tcp_stream": 947, "frame_number": 34722, "display_filter": "frame.number == 34722", "timestamp_epoch": "1533965158.851379000" }, { "tcp_stream": 946, "frame_number": 34726, "display_filter": "frame.number == 34726", "timestamp_epoch": "1533965158.851787000" }, { "tcp_stream": 1026, "frame_number": 39185, "display_filter": "frame.number == 39185", "timestamp_epoch": "1533965245.934643000" }, { "tcp_stream": 1027, "frame_number": 39201, "display_filter": "frame.number == 39201", "timestamp_epoch": "1533965245.953287000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:49:00.877635+00:00" }, { "observable_id": "observable-dcebfe608057869781e73cab", "type": "domain", "value": "a1.seadform.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:49:01.041410+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:01.038517+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 255, "frame_number": 27153, "display_filter": "frame.number == 27153", "timestamp_epoch": "1533965034.720415000" }, { "udp_stream": 255, "frame_number": 27166, "display_filter": "frame.number == 27166", "timestamp_epoch": "1533965034.849432000" }, { "tcp_stream": 732, "frame_number": 27225, "display_filter": "frame.number == 27225", "timestamp_epoch": "1533965034.998139000" }, { "tcp_stream": 731, "frame_number": 27231, "display_filter": "frame.number == 27231", "timestamp_epoch": "1533965035.004157000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:49:01.035778+00:00" }, { "observable_id": "observable-2f1304c9b5a98cd310d5a050", "type": "domain", "value": "aa.agkn.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:44:46.562458+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:01.225470+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 180, "frame_number": 20176, "display_filter": "frame.number == 20176", "timestamp_epoch": "1533964964.882244000" }, { "udp_stream": 180, "frame_number": 20228, "display_filter": "frame.number == 20228", "timestamp_epoch": "1533964965.012614000" }, { "tcp_stream": 588, "frame_number": 20344, "display_filter": "frame.number == 20344", "timestamp_epoch": "1533964965.302742000" }, { "tcp_stream": 585, "frame_number": 20348, "display_filter": "frame.number == 20348", "timestamp_epoch": "1533964965.303088000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:49:01.222737+00:00" }, { "observable_id": "observable-d77642f1caea417e65b2c887", "type": "domain", "value": "acdn.adnxs.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:44:47.815272+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:01.231849+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 201, "frame_number": 19272, "display_filter": "frame.number == 19272", "timestamp_epoch": "1533964961.686987000" }, { "udp_stream": 201, "frame_number": 19305, "display_filter": "frame.number == 19305", "timestamp_epoch": "1533964961.766961000" }, { "tcp_stream": 554, "frame_number": 19349, "display_filter": "frame.number == 19349", "timestamp_epoch": "1533964961.843188000" }, { "tcp_stream": 555, "frame_number": 19352, "display_filter": "frame.number == 19352", "timestamp_epoch": "1533964961.843951000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:49:01.228626+00:00" }, { "observable_id": "observable-5068e3d77075aadc4713431e", "type": "domain", "value": "ad.360yield.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:49:01.239305+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:01.237086+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 120, "frame_number": 23571, "display_filter": "frame.number == 23571", "timestamp_epoch": "1533964997.745387000" }, { "udp_stream": 120, "frame_number": 23682, "display_filter": "frame.number == 23682", "timestamp_epoch": "1533964997.887170000" }, { "tcp_stream": 663, "frame_number": 23812, "display_filter": "frame.number == 23812", "timestamp_epoch": "1533964998.060581000" }, { "tcp_stream": 662, "frame_number": 23818, "display_filter": "frame.number == 23818", "timestamp_epoch": "1533964998.062358000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:49:01.234582+00:00" }, { "observable_id": "observable-d40ace90662479f3f4ca0111", "type": "domain", "value": "ad.lkqd.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:49:01.731613+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:01.729517+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 160, "frame_number": 15185, "display_filter": "frame.number == 15185", "timestamp_epoch": "1533964905.944747000" }, { "udp_stream": 160, "frame_number": 15186, "display_filter": "frame.number == 15186", "timestamp_epoch": "1533964906.152257000" }, { "tcp_stream": 417, "frame_number": 15195, "display_filter": "frame.number == 15195", "timestamp_epoch": "1533964906.256898000" }, { "tcp_stream": 418, "frame_number": 15199, "display_filter": "frame.number == 15199", "timestamp_epoch": "1533964906.257378000" }, { "tcp_stream": 420, "frame_number": 15205, "display_filter": "frame.number == 15205", "timestamp_epoch": "1533964906.258704000" }, { "tcp_stream": 419, "frame_number": 15206, "display_filter": "frame.number == 15206", "timestamp_epoch": "1533964906.258705000" }, { "tcp_stream": 421, "frame_number": 15211, "display_filter": "frame.number == 15211", "timestamp_epoch": "1533964906.272741000" }, { "tcp_stream": 422, "frame_number": 15221, "display_filter": "frame.number == 15221", "timestamp_epoch": "1533964906.310134000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:49:01.726542+00:00" }, { "observable_id": "observable-8ac8395c06607fe22abab7c7", "type": "domain", "value": "ad.sxp.smartclip.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:49:01.911066+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:01.909237+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 285, "frame_number": 31611, "display_filter": "frame.number == 31611", "timestamp_epoch": "1533965100.695737000" }, { "udp_stream": 285, "frame_number": 31674, "display_filter": "frame.number == 31674", "timestamp_epoch": "1533965100.796522000" }, { "tcp_stream": 867, "frame_number": 31863, "display_filter": "frame.number == 31863", "timestamp_epoch": "1533965101.066755000" }, { "tcp_stream": 866, "frame_number": 31866, "display_filter": "frame.number == 31866", "timestamp_epoch": "1533965101.066759000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:49:01.906960+00:00" }, { "observable_id": "observable-beb6113bbe9119ab1a034569", "type": "domain", "value": "ad.turn.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:44:48.311339+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:02.086451+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 62, "frame_number": 5077, "display_filter": "frame.number == 5077", "timestamp_epoch": "1533964555.920423000" }, { "udp_stream": 62, "frame_number": 5145, "display_filter": "frame.number == 5145", "timestamp_epoch": "1533964556.026779000" }, { "tcp_stream": 122, "frame_number": 5211, "display_filter": "frame.number == 5211", "timestamp_epoch": "1533964556.093873000" }, { "tcp_stream": 123, "frame_number": 5216, "display_filter": "frame.number == 5216", "timestamp_epoch": "1533964556.094416000" }, { "tcp_stream": 440, "frame_number": 15992, "display_filter": "frame.number == 15992", "timestamp_epoch": "1533964908.383881000" }, { "tcp_stream": 439, "frame_number": 16000, "display_filter": "frame.number == 16000", "timestamp_epoch": "1533964908.387288000" }, { "tcp_stream": 692, "frame_number": 26354, "display_filter": "frame.number == 26354", "timestamp_epoch": "1533965032.538900000" }, { "tcp_stream": 693, "frame_number": 26356, "display_filter": "frame.number == 26356", "timestamp_epoch": "1533965032.542361000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:49:02.084389+00:00" }, { "observable_id": "observable-a5bb793866c2afcb813d62d8", "type": "domain", "value": "ad.turn.com.akadns.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 62, "frame_number": 5145, "display_filter": "frame.number == 5145", "timestamp_epoch": "1533964556.026779000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2a62c6218d8e77b494a02db1", "type": "domain", "value": "ade.googlesyndication.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:44:48.492813+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:02.089950+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 177, "frame_number": 16943, "display_filter": "frame.number == 16943", "timestamp_epoch": "1533964912.828553000" }, { "udp_stream": 177, "frame_number": 16951, "display_filter": "frame.number == 16951", "timestamp_epoch": "1533964912.917076000" }, { "tcp_stream": 485, "frame_number": 16958, "display_filter": "frame.number == 16958", "timestamp_epoch": "1533964912.979369000" }, { "tcp_stream": 486, "frame_number": 16962, "display_filter": "frame.number == 16962", "timestamp_epoch": "1533964912.980377000" }, { "tcp_stream": 685, "frame_number": 25293, "display_filter": "frame.number == 25293", "timestamp_epoch": "1533965023.576293000" }, { "tcp_stream": 684, "frame_number": 25294, "display_filter": "frame.number == 25294", "timestamp_epoch": "1533965023.576308000" }, { "tcp_stream": 919, "frame_number": 33424, "display_filter": "frame.number == 33424", "timestamp_epoch": "1533965142.863003000" }, { "tcp_stream": 920, "frame_number": 33426, "display_filter": "frame.number == 33426", "timestamp_epoch": "1533965142.863666000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:49:02.088189+00:00" }, { "observable_id": "observable-7aeb5097eb572f241799e07a", "type": "domain", "value": "ads-bid.l.doubleclick.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 289, "frame_number": 32653, "display_filter": "frame.number == 32653", "timestamp_epoch": "1533965134.234653000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0f7ce750d04ffb0fcf24d428", "type": "domain", "value": "ads-east1-132899269.us-east-1.elb.amazonaws.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 182, "frame_number": 17855, "display_filter": "frame.number == 17855", "timestamp_epoch": "1533964957.358759000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f2b1a270b75af79f4c286e81", "type": "domain", "value": "ads-sc2-lb9.adsymptotic.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 288, "frame_number": 32219, "display_filter": "frame.number == 32219", "timestamp_epoch": "1533965102.184319000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1431f11394a076d5106bd8b9", "type": "domain", "value": "ads.adaptv.advertising.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:49:02.095057+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:02.093353+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 197, "frame_number": 19011, "display_filter": "frame.number == 19011", "timestamp_epoch": "1533964960.452739000" }, { "udp_stream": 197, "frame_number": 19066, "display_filter": "frame.number == 19066", "timestamp_epoch": "1533964960.516077000" }, { "tcp_stream": 545, "frame_number": 19099, "display_filter": "frame.number == 19099", "timestamp_epoch": "1533964960.618867000" }, { "tcp_stream": 546, "frame_number": 19103, "display_filter": "frame.number == 19103", "timestamp_epoch": "1533964960.619216000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:49:02.091623+00:00" }, { "observable_id": "observable-0301b278b153e90a49cdbcbd", "type": "domain", "value": "ads.creative-serving.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:49:02.673702+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:02.671994+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 274, "frame_number": 30393, "display_filter": "frame.number == 30393", "timestamp_epoch": "1533965098.617525000" }, { "udp_stream": 274, "frame_number": 30691, "display_filter": "frame.number == 30691", "timestamp_epoch": "1533965099.093757000" }, { "tcp_stream": 833, "frame_number": 31026, "display_filter": "frame.number == 31026", "timestamp_epoch": "1533965099.746688000" }, { "tcp_stream": 832, "frame_number": 31035, "display_filter": "frame.number == 31035", "timestamp_epoch": "1533965099.754724000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:49:02.669721+00:00" }, { "observable_id": "observable-1c113eb07020d9064f3519eb", "type": "domain", "value": "ads.deliverimp.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:49:02.849478+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:02.846193+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 117, "frame_number": 10975, "display_filter": "frame.number == 10975", "timestamp_epoch": "1533964900.961738000" }, { "udp_stream": 117, "frame_number": 11114, "display_filter": "frame.number == 11114", "timestamp_epoch": "1533964901.056360000" }, { "tcp_stream": 288, "frame_number": 11409, "display_filter": "frame.number == 11409", "timestamp_epoch": "1533964901.242573000" }, { "tcp_stream": 289, "frame_number": 11411, "display_filter": "frame.number == 11411", "timestamp_epoch": "1533964901.243326000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:49:02.841923+00:00" }, { "observable_id": "observable-4ab618521f66e8ca2f522a1f", "type": "domain", "value": "ads.lfstmedia.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:49:03.039384+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:03.035030+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 282, "frame_number": 31608, "display_filter": "frame.number == 31608", "timestamp_epoch": "1533965100.695068000" }, { "udp_stream": 282, "frame_number": 31833, "display_filter": "frame.number == 31833", "timestamp_epoch": "1533965100.973117000" }, { "tcp_stream": 873, "frame_number": 31960, "display_filter": "frame.number == 31960", "timestamp_epoch": "1533965101.211552000" }, { "tcp_stream": 872, "frame_number": 31962, "display_filter": "frame.number == 31962", "timestamp_epoch": "1533965101.211676000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:49:03.029666+00:00" }, { "observable_id": "observable-8d783fe4d6467f6d8473f1fa", "type": "domain", "value": "ads.pubmatic.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:44:48.666824+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:03.234029+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 164, "frame_number": 15784, "display_filter": "frame.number == 15784", "timestamp_epoch": "1533964907.606307000" }, { "udp_stream": 164, "frame_number": 15826, "display_filter": "frame.number == 15826", "timestamp_epoch": "1533964907.702394000" }, { "tcp_stream": 435, "frame_number": 15851, "display_filter": "frame.number == 15851", "timestamp_epoch": "1533964907.775575000" }, { "tcp_stream": 436, "frame_number": 15853, "display_filter": "frame.number == 15853", "timestamp_epoch": "1533964907.776016000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:49:03.228281+00:00" }, { "observable_id": "observable-1bd0579a2c166a0a875f00ee", "type": "domain", "value": "ads.rubiconproject.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:48:20.371432+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:03.242321+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 136, "frame_number": 12778, "display_filter": "frame.number == 12778", "timestamp_epoch": "1533964902.711278000" }, { "udp_stream": 136, "frame_number": 12842, "display_filter": "frame.number == 12842", "timestamp_epoch": "1533964902.809158000" }, { "tcp_stream": 333, "frame_number": 12923, "display_filter": "frame.number == 12923", "timestamp_epoch": "1533964902.867200000" }, { "tcp_stream": 332, "frame_number": 12930, "display_filter": "frame.number == 12930", "timestamp_epoch": "1533964902.870165000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:49:03.238390+00:00" }, { "observable_id": "observable-3a62ea6ed897542e9266e274", "type": "domain", "value": "ads.scorecardresearch.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:49:03.668905+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:03.666296+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 149, "frame_number": 14513, "display_filter": "frame.number == 14513", "timestamp_epoch": "1533964904.540196000" }, { "udp_stream": 149, "frame_number": 14601, "display_filter": "frame.number == 14601", "timestamp_epoch": "1533964904.629602000" }, { "tcp_stream": 392, "frame_number": 14680, "display_filter": "frame.number == 14680", "timestamp_epoch": "1533964904.690554000" }, { "tcp_stream": 391, "frame_number": 14701, "display_filter": "frame.number == 14701", "timestamp_epoch": "1533964904.697213000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:49:03.663234+00:00" }, { "observable_id": "observable-733b2479d76b6a3b6565c633", "type": "domain", "value": "ads.stickyadstv.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:49:03.850117+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:03.845857+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 257, "frame_number": 27300, "display_filter": "frame.number == 27300", "timestamp_epoch": "1533965035.315723000" }, { "udp_stream": 257, "frame_number": 27357, "display_filter": "frame.number == 27357", "timestamp_epoch": "1533965035.496495000" }, { "tcp_stream": 749, "frame_number": 27403, "display_filter": "frame.number == 27403", "timestamp_epoch": "1533965035.568002000" }, { "tcp_stream": 748, "frame_number": 27404, "display_filter": "frame.number == 27404", "timestamp_epoch": "1533965035.568078000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:49:03.841010+00:00" }, { "observable_id": "observable-6532c7f57b1bf4d31af9b9aa", "type": "domain", "value": "ads.yahoo.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:44:48.848605+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:04.034254+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 81, "frame_number": 6084, "display_filter": "frame.number == 6084", "timestamp_epoch": "1533964559.791256000" }, { "udp_stream": 81, "frame_number": 6113, "display_filter": "frame.number == 6113", "timestamp_epoch": "1533964559.840586000" }, { "tcp_stream": 153, "frame_number": 6171, "display_filter": "frame.number == 6171", "timestamp_epoch": "1533964559.929820000" }, { "tcp_stream": 152, "frame_number": 6172, "display_filter": "frame.number == 6172", "timestamp_epoch": "1533964559.929935000" }, { "tcp_stream": 479, "frame_number": 16747, "display_filter": "frame.number == 16747", "timestamp_epoch": "1533964910.427694000" }, { "tcp_stream": 480, "frame_number": 16750, "display_filter": "frame.number == 16750", "timestamp_epoch": "1533964910.428144000" }, { "tcp_stream": 938, "frame_number": 33913, "display_filter": "frame.number == 33913", "timestamp_epoch": "1533965157.843534000" }, { "tcp_stream": 939, "frame_number": 33928, "display_filter": "frame.number == 33928", "timestamp_epoch": "1533965157.852767000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:49:04.028193+00:00" }, { "observable_id": "observable-ddb670955e1ae440d1b2174a", "type": "domain", "value": "adserver.adtech.advertising.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:45:52.871850+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:04.042538+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 247, "frame_number": 26598, "display_filter": "frame.number == 26598", "timestamp_epoch": "1533965032.986172000" }, { "udp_stream": 247, "frame_number": 26644, "display_filter": "frame.number == 26644", "timestamp_epoch": "1533965033.203044000" }, { "tcp_stream": 707, "frame_number": 26670, "display_filter": "frame.number == 26670", "timestamp_epoch": "1533965033.324564000" }, { "tcp_stream": 706, "frame_number": 26672, "display_filter": "frame.number == 26672", "timestamp_epoch": "1533965033.324943000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:49:04.038468+00:00" }, { "observable_id": "observable-ac850e4b152503246c39a787", "type": "domain", "value": "adservice.google.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:44:49.436607+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:04.051287+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 53, "frame_number": 3792, "display_filter": "frame.number == 3792", "timestamp_epoch": "1533964553.383949000" }, { "udp_stream": 53, "frame_number": 3925, "display_filter": "frame.number == 3925", "timestamp_epoch": "1533964553.575811000" }, { "udp_stream": 345, "frame_number": 43722, "display_filter": "frame.number == 43722", "timestamp_epoch": "1533965783.242495000" }, { "udp_stream": 345, "frame_number": 43840, "display_filter": "frame.number == 43840", "timestamp_epoch": "1533965783.630277000" }, { "tcp_stream": 99, "frame_number": 4029, "display_filter": "frame.number == 4029", "timestamp_epoch": "1533964553.660668000" }, { "tcp_stream": 100, "frame_number": 4031, "display_filter": "frame.number == 4031", "timestamp_epoch": "1533964553.662840000" }, { "tcp_stream": 197, "frame_number": 7831, "display_filter": "frame.number == 7831", "timestamp_epoch": "1533964897.703908000" }, { "tcp_stream": 196, "frame_number": 7833, "display_filter": "frame.number == 7833", "timestamp_epoch": "1533964897.704223000" }, { "tcp_stream": 497, "frame_number": 17533, "display_filter": "frame.number == 17533", "timestamp_epoch": "1533964956.641278000" }, { "tcp_stream": 1156, "frame_number": 43919, "display_filter": "frame.number == 43919", "timestamp_epoch": "1533965783.792386000" }, { "tcp_stream": 1155, "frame_number": 43925, "display_filter": "frame.number == 43925", "timestamp_epoch": "1533965783.794083000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:49:04.047329+00:00" }, { "observable_id": "observable-4eaccdae1741c28f56c7ec19", "type": "domain", "value": "adventori.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:49:04.063991+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:04.059067+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 269, "frame_number": 27493, "display_filter": "frame.number == 27493", "timestamp_epoch": "1533965035.666698000" }, { "udp_stream": 269, "frame_number": 27577, "display_filter": "frame.number == 27577", "timestamp_epoch": "1533965035.747708000" }, { "tcp_stream": 766, "frame_number": 27799, "display_filter": "frame.number == 27799", "timestamp_epoch": "1533965035.970037000" }, { "tcp_stream": 764, "frame_number": 27801, "display_filter": "frame.number == 27801", "timestamp_epoch": "1533965035.970486000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:49:04.055303+00:00" }, { "observable_id": "observable-2729e512305fa7b5b9910e38", "type": "domain", "value": "ag.innovid.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:48:21.118393+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:04.239317+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 296, "frame_number": 32965, "display_filter": "frame.number == 32965", "timestamp_epoch": "1533965136.705665000" }, { "udp_stream": 296, "frame_number": 32987, "display_filter": "frame.number == 32987", "timestamp_epoch": "1533965136.794310000" }, { "tcp_stream": 902, "frame_number": 33021, "display_filter": "frame.number == 33021", "timestamp_epoch": "1533965136.873817000" }, { "tcp_stream": 903, "frame_number": 33027, "display_filter": "frame.number == 33027", "timestamp_epoch": "1533965136.880761000" }, { "tcp_stream": 1006, "frame_number": 38861, "display_filter": "frame.number == 38861", "timestamp_epoch": "1533965240.375708000" }, { "tcp_stream": 1007, "frame_number": 38864, "display_filter": "frame.number == 38864", "timestamp_epoch": "1533965240.375840000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:49:04.237143+00:00" }, { "observable_id": "observable-bc47abb78996bf01806765d8", "type": "domain", "value": "ajax.googleapis.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:45:10.341533+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:04.243462+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 30, "frame_number": 594, "display_filter": "frame.number == 594", "timestamp_epoch": "1533964545.561585000" }, { "udp_stream": 30, "frame_number": 611, "display_filter": "frame.number == 611", "timestamp_epoch": "1533964545.651017000" }, { "tcp_stream": 48, "frame_number": 624, "display_filter": "frame.number == 624", "timestamp_epoch": "1533964545.709230000" }, { "tcp_stream": 47, "frame_number": 626, "display_filter": "frame.number == 626", "timestamp_epoch": "1533964545.709442000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:49:04.241621+00:00" }, { "observable_id": "observable-394c6e831c76b7ab1e8c8645", "type": "domain", "value": "alb-vpc-pixel-tracker-front-prod-1906776940.us-east-1.elb.amazonaws.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 248, "frame_number": 26728, "display_filter": "frame.number == 26728", "timestamp_epoch": "1533965033.481510000" }, { "udp_stream": 254, "frame_number": 27021, "display_filter": "frame.number == 27021", "timestamp_epoch": "1533965034.135661000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e7bc633a5f29e1c198ad7cf0", "type": "domain", "value": "an.yandex.ru", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:49:04.249057+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:04.247234+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 44, "frame_number": 3129, "display_filter": "frame.number == 3129", "timestamp_epoch": "1533964552.232112000" }, { "udp_stream": 44, "frame_number": 3197, "display_filter": "frame.number == 3197", "timestamp_epoch": "1533964552.405569000" }, { "udp_stream": 337, "frame_number": 43638, "display_filter": "frame.number == 43638", "timestamp_epoch": "1533965783.001053000" }, { "udp_stream": 337, "frame_number": 43651, "display_filter": "frame.number == 43651", "timestamp_epoch": "1533965783.060399000" }, { "tcp_stream": 71, "frame_number": 3430, "display_filter": "frame.number == 3430", "timestamp_epoch": "1533964552.803227000" }, { "tcp_stream": 72, "frame_number": 3432, "display_filter": "frame.number == 3432", "timestamp_epoch": "1533964552.803334000" }, { "tcp_stream": 201, "frame_number": 8338, "display_filter": "frame.number == 8338", "timestamp_epoch": "1533964898.152886000" }, { "tcp_stream": 200, "frame_number": 8340, "display_filter": "frame.number == 8340", "timestamp_epoch": "1533964898.153065000" }, { "tcp_stream": 1142, "frame_number": 43734, "display_filter": "frame.number == 43734", "timestamp_epoch": "1533965783.300133000" }, { "tcp_stream": 1141, "frame_number": 43738, "display_filter": "frame.number == 43738", "timestamp_epoch": "1533965783.307821000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:49:04.245261+00:00" }, { "observable_id": "observable-fb09fb4860e00c952245fa40", "type": "domain", "value": "api.bing.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 35, "frame_number": 2028, "display_filter": "frame.number == 2028", "timestamp_epoch": "1533964548.338132000" }, { "udp_stream": 36, "frame_number": 2029, "display_filter": "frame.number == 2029", "timestamp_epoch": "1533964548.338135000" }, { "udp_stream": 35, "frame_number": 2030, "display_filter": "frame.number == 2030", "timestamp_epoch": "1533964548.338547000" }, { "udp_stream": 36, "frame_number": 2032, "display_filter": "frame.number == 2032", "timestamp_epoch": "1533964548.338743000" }, { "udp_stream": 330, "frame_number": 41222, "display_filter": "frame.number == 41222", "timestamp_epoch": "1533965772.517902000" }, { "udp_stream": 331, "frame_number": 41223, "display_filter": "frame.number == 41223", "timestamp_epoch": "1533965772.517905000" }, { "udp_stream": 331, "frame_number": 41443, "display_filter": "frame.number == 41443", "timestamp_epoch": "1533965773.530763000" }, { "udp_stream": 330, "frame_number": 41444, "display_filter": "frame.number == 41444", "timestamp_epoch": "1533965773.530766000" }, { "udp_stream": 331, "frame_number": 41615, "display_filter": "frame.number == 41615", "timestamp_epoch": "1533965774.364547000" }, { "udp_stream": 331, "frame_number": 41618, "display_filter": "frame.number == 41618", "timestamp_epoch": "1533965774.364689000" }, { "udp_stream": 330, "frame_number": 41619, "display_filter": "frame.number == 41619", "timestamp_epoch": "1533965774.364956000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ba07179d2d5eb2f6a67c1c96", "type": "domain", "value": "apnx-match.dotomi.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:49:04.437220+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:04.433200+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 267, "frame_number": 27461, "display_filter": "frame.number == 27461", "timestamp_epoch": "1533965035.641721000" }, { "udp_stream": 267, "frame_number": 27573, "display_filter": "frame.number == 27573", "timestamp_epoch": "1533965035.747066000" }, { "tcp_stream": 765, "frame_number": 27656, "display_filter": "frame.number == 27656", "timestamp_epoch": "1533965035.831325000" }, { "tcp_stream": 767, "frame_number": 27657, "display_filter": "frame.number == 27657", "timestamp_epoch": "1533965035.831578000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:49:04.428668+00:00" }, { "observable_id": "observable-5db37a40b09aea568541b17c", "type": "domain", "value": "appnexus-partners.tremorhub.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:49:04.938184+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:04.936374+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 258, "frame_number": 27302, "display_filter": "frame.number == 27302", "timestamp_epoch": "1533965035.335814000" }, { "udp_stream": 258, "frame_number": 27323, "display_filter": "frame.number == 27323", "timestamp_epoch": "1533965035.406624000" }, { "tcp_stream": 736, "frame_number": 27388, "display_filter": "frame.number == 27388", "timestamp_epoch": "1533965035.527917000" }, { "tcp_stream": 737, "frame_number": 27391, "display_filter": "frame.number == 27391", "timestamp_epoch": "1533965035.528278000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:49:04.933642+00:00" }, { "observable_id": "observable-1b348bfc7c6c49215ee89197", "type": "domain", "value": "apps.digsigtrust.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 95, "frame_number": 8582, "display_filter": "frame.number == 8582", "timestamp_epoch": "1533964898.485160000" }, { "udp_stream": 94, "frame_number": 8583, "display_filter": "frame.number == 8583", "timestamp_epoch": "1533964898.485161000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-32914d384f2d694bc5e1387c", "type": "domain", "value": "apps.identrust.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:48:45.690197+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:05.113565+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 94, "frame_number": 8557, "display_filter": "frame.number == 8557", "timestamp_epoch": "1533964898.439074000" }, { "udp_stream": 95, "frame_number": 8558, "display_filter": "frame.number == 8558", "timestamp_epoch": "1533964898.441696000" }, { "udp_stream": 95, "frame_number": 8582, "display_filter": "frame.number == 8582", "timestamp_epoch": "1533964898.485160000" }, { "udp_stream": 94, "frame_number": 8583, "display_filter": "frame.number == 8583", "timestamp_epoch": "1533964898.485161000" }, { "tcp_stream": 218, "frame_number": 8633, "display_filter": "frame.number == 8633", "timestamp_epoch": "1533964898.552621000" }, { "tcp_stream": 217, "frame_number": 8637, "display_filter": "frame.number == 8637", "timestamp_epoch": "1533964898.553823000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:49:05.110663+00:00" }, { "observable_id": "observable-c7d7561fc45fc5da5cd46bfe", "type": "domain", "value": "b1-lsw-use1.zemanta.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 113, "frame_number": 10616, "display_filter": "frame.number == 10616", "timestamp_epoch": "1533964900.621029000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0e180111e55812a0780becb3", "type": "domain", "value": "b1sync.zemanta.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:44:54.921986+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:05.119349+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 113, "frame_number": 10583, "display_filter": "frame.number == 10583", "timestamp_epoch": "1533964900.526430000" }, { "udp_stream": 113, "frame_number": 10616, "display_filter": "frame.number == 10616", "timestamp_epoch": "1533964900.621029000" }, { "tcp_stream": 271, "frame_number": 10780, "display_filter": "frame.number == 10780", "timestamp_epoch": "1533964900.763909000" }, { "tcp_stream": 272, "frame_number": 10781, "display_filter": "frame.number == 10781", "timestamp_epoch": "1533964900.763991000" }, { "tcp_stream": 940, "frame_number": 33999, "display_filter": "frame.number == 33999", "timestamp_epoch": "1533965157.918564000" }, { "tcp_stream": 941, "frame_number": 34002, "display_filter": "frame.number == 34002", "timestamp_epoch": "1533965157.918784000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:49:05.116400+00:00" }, { "observable_id": "observable-3ce86d37873aa1ed1d48cfbe", "type": "domain", "value": "bcp.crwdcntrl.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:48:34.683484+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:05.124596+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 212, "frame_number": 20064, "display_filter": "frame.number == 20064", "timestamp_epoch": "1533964964.377258000" }, { "udp_stream": 212, "frame_number": 20071, "display_filter": "frame.number == 20071", "timestamp_epoch": "1533964964.450971000" }, { "tcp_stream": 579, "frame_number": 20080, "display_filter": "frame.number == 20080", "timestamp_epoch": "1533964964.502301000" }, { "tcp_stream": 580, "frame_number": 20084, "display_filter": "frame.number == 20084", "timestamp_epoch": "1533964964.511697000" }, { "tcp_stream": 880, "frame_number": 32283, "display_filter": "frame.number == 32283", "timestamp_epoch": "1533965106.594419000" }, { "tcp_stream": 881, "frame_number": 32285, "display_filter": "frame.number == 32285", "timestamp_epoch": "1533965106.594543000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:49:05.121831+00:00" }, { "observable_id": "observable-588ed136aab83456eb3f8e7a", "type": "domain", "value": "beacon-cdn.walmart.com.akadns.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 208, "frame_number": 19705, "display_filter": "frame.number == 19705", "timestamp_epoch": "1533964962.898059000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-039607d4ead2613692c45d40", "type": "domain", "value": "beacon.tru.am", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:49:05.132423+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:05.130001+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 93, "frame_number": 8439, "display_filter": "frame.number == 8439", "timestamp_epoch": "1533964898.292183000" }, { "udp_stream": 93, "frame_number": 8506, "display_filter": "frame.number == 8506", "timestamp_epoch": "1533964898.378728000" }, { "tcp_stream": 216, "frame_number": 8555, "display_filter": "frame.number == 8555", "timestamp_epoch": "1533964898.435467000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:49:05.127371+00:00" }, { "observable_id": "observable-fdd558bc7afada9660d6acb1", "type": "domain", "value": "beacon.walmart.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:49:05.315876+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:05.313366+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 208, "frame_number": 19654, "display_filter": "frame.number == 19654", "timestamp_epoch": "1533964962.787413000" }, { "udp_stream": 208, "frame_number": 19705, "display_filter": "frame.number == 19705", "timestamp_epoch": "1533964962.898059000" }, { "tcp_stream": 568, "frame_number": 19781, "display_filter": "frame.number == 19781", "timestamp_epoch": "1533964963.001566000" }, { "tcp_stream": 569, "frame_number": 19782, "display_filter": "frame.number == 19782", "timestamp_epoch": "1533964963.001718000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:49:05.310723+00:00" }, { "observable_id": "observable-e5148f17e6b2740d58ed8ab7", "type": "domain", "value": "bh.contextweb.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:44:56.288623+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:05.487713+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 246, "frame_number": 26371, "display_filter": "frame.number == 26371", "timestamp_epoch": "1533965032.576510000" }, { "udp_stream": 246, "frame_number": 26420, "display_filter": "frame.number == 26420", "timestamp_epoch": "1533965032.696494000" }, { "tcp_stream": 705, "frame_number": 26476, "display_filter": "frame.number == 26476", "timestamp_epoch": "1533965032.793471000" }, { "tcp_stream": 704, "frame_number": 26479, "display_filter": "frame.number == 26479", "timestamp_epoch": "1533965032.793850000" }, { "tcp_stream": 821, "frame_number": 30658, "display_filter": "frame.number == 30658", "timestamp_epoch": "1533965099.046863000" }, { "tcp_stream": 820, "frame_number": 30659, "display_filter": "frame.number == 30659", "timestamp_epoch": "1533965099.046897000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:49:05.483313+00:00" }, { "observable_id": "observable-0f5c0dd3987f243ffa61b174", "type": "domain", "value": "bid.contextweb.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:49:05.502231+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:05.497614+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 144, "frame_number": 13486, "display_filter": "frame.number == 13486", "timestamp_epoch": "1533964903.479648000" }, { "udp_stream": 144, "frame_number": 13593, "display_filter": "frame.number == 13593", "timestamp_epoch": "1533964903.573032000" }, { "tcp_stream": 355, "frame_number": 13633, "display_filter": "frame.number == 13633", "timestamp_epoch": "1533964903.624634000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:49:05.491713+00:00" }, { "observable_id": "observable-295eb88469c855b00c376e7c", "type": "domain", "value": "bid.g.doubleclick.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:46:16.065253+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:05.673366+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 289, "frame_number": 32650, "display_filter": "frame.number == 32650", "timestamp_epoch": "1533965134.154546000" }, { "udp_stream": 289, "frame_number": 32653, "display_filter": "frame.number == 32653", "timestamp_epoch": "1533965134.234653000" }, { "tcp_stream": 888, "frame_number": 32660, "display_filter": "frame.number == 32660", "timestamp_epoch": "1533965134.316392000" }, { "tcp_stream": 889, "frame_number": 32664, "display_filter": "frame.number == 32664", "timestamp_epoch": "1533965134.321488000" }, { "tcp_stream": 994, "frame_number": 38696, "display_filter": "frame.number == 38696", "timestamp_epoch": "1533965238.697191000" }, { "tcp_stream": 995, "frame_number": 38698, "display_filter": "frame.number == 38698", "timestamp_epoch": "1533965238.697273000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:49:05.671194+00:00" }, { "observable_id": "observable-49569d00ad9a501d3e711a9f", "type": "domain", "value": "bidder.criteo.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:44:56.487748+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:05.681076+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 143, "frame_number": 13464, "display_filter": "frame.number == 13464", "timestamp_epoch": "1533964903.460980000" }, { "udp_stream": 143, "frame_number": 13517, "display_filter": "frame.number == 13517", "timestamp_epoch": "1533964903.515128000" }, { "tcp_stream": 350, "frame_number": 13603, "display_filter": "frame.number == 13603", "timestamp_epoch": "1533964903.580609000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:49:05.676145+00:00" }, { "observable_id": "observable-cc14587a63bbb378e587abf2", "type": "domain", "value": "bttrack.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:44:56.981182+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:06.056900+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 275, "frame_number": 30402, "display_filter": "frame.number == 30402", "timestamp_epoch": "1533965098.634262000" }, { "udp_stream": 275, "frame_number": 30649, "display_filter": "frame.number == 30649", "timestamp_epoch": "1533965099.045804000" }, { "tcp_stream": 829, "frame_number": 30979, "display_filter": "frame.number == 30979", "timestamp_epoch": "1533965099.657732000" }, { "tcp_stream": 828, "frame_number": 30991, "display_filter": "frame.number == 30991", "timestamp_epoch": "1533965099.664719000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:49:06.054239+00:00" }, { "observable_id": "observable-8a95b938f3ca8ce1d9af9b6d", "type": "domain", "value": "c.bing.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:44:57.355750+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:06.061117+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 206, "frame_number": 19648, "display_filter": "frame.number == 19648", "timestamp_epoch": "1533964962.773029000" }, { "udp_stream": 206, "frame_number": 19673, "display_filter": "frame.number == 19673", "timestamp_epoch": "1533964962.856769000" }, { "tcp_stream": 564, "frame_number": 19753, "display_filter": "frame.number == 19753", "timestamp_epoch": "1533964962.972433000" }, { "tcp_stream": 565, "frame_number": 19773, "display_filter": "frame.number == 19773", "timestamp_epoch": "1533964963.000514000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:49:06.059420+00:00" }, { "observable_id": "observable-3e636082c043f30c46c39c71", "type": "domain", "value": "c1.adform.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:44:58.799281+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:06.064418+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 97, "frame_number": 8909, "display_filter": "frame.number == 8909", "timestamp_epoch": "1533964898.852948000" }, { "udp_stream": 97, "frame_number": 8972, "display_filter": "frame.number == 8972", "timestamp_epoch": "1533964898.937210000" }, { "tcp_stream": 239, "frame_number": 9121, "display_filter": "frame.number == 9121", "timestamp_epoch": "1533964899.068592000" }, { "tcp_stream": 238, "frame_number": 9156, "display_filter": "frame.number == 9156", "timestamp_epoch": "1533964899.081075000" }, { "tcp_stream": 519, "frame_number": 18603, "display_filter": "frame.number == 18603", "timestamp_epoch": "1533964959.399499000" }, { "tcp_stream": 520, "frame_number": 18604, "display_filter": "frame.number == 18604", "timestamp_epoch": "1533964959.399749000" }, { "tcp_stream": 632, "frame_number": 23357, "display_filter": "frame.number == 23357", "timestamp_epoch": "1533964997.363620000" }, { "tcp_stream": 633, "frame_number": 23372, "display_filter": "frame.number == 23372", "timestamp_epoch": "1533964997.375633000" }, { "tcp_stream": 694, "frame_number": 26437, "display_filter": "frame.number == 26437", "timestamp_epoch": "1533965032.719353000" }, { "tcp_stream": 695, "frame_number": 26443, "display_filter": "frame.number == 26443", "timestamp_epoch": "1533965032.721397000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:49:06.062721+00:00" }, { "observable_id": "observable-07b01bc6376db90653fd692d", "type": "domain", "value": "cacerts.digicert.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:49:06.069374+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:06.067688+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 236, "frame_number": 23933, "display_filter": "frame.number == 23933", "timestamp_epoch": "1533964998.322007000" }, { "udp_stream": 237, "frame_number": 23938, "display_filter": "frame.number == 23938", "timestamp_epoch": "1533964998.332011000" }, { "udp_stream": 237, "frame_number": 23970, "display_filter": "frame.number == 23970", "timestamp_epoch": "1533964998.468790000" }, { "udp_stream": 236, "frame_number": 23971, "display_filter": "frame.number == 23971", "timestamp_epoch": "1533964998.468958000" }, { "tcp_stream": 665, "frame_number": 23982, "display_filter": "frame.number == 23982", "timestamp_epoch": "1533964998.555480000" }, { "tcp_stream": 664, "frame_number": 23985, "display_filter": "frame.number == 23985", "timestamp_epoch": "1533964998.555964000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:49:06.066116+00:00" }, { "observable_id": "observable-7fd2b9f7ba17bd1af4deacb9", "type": "domain", "value": "cdn-na.onthe.io", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 349, "frame_number": 44215, "display_filter": "frame.number == 44215", "timestamp_epoch": "1533965784.462482000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3ef2c5743cff9c02351ac73c", "type": "domain", "value": "cdn-ssl.vidible.tv", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:49:06.240567+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:06.234901+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 194, "frame_number": 18662, "display_filter": "frame.number == 18662", "timestamp_epoch": "1533964959.545185000" }, { "udp_stream": 194, "frame_number": 18742, "display_filter": "frame.number == 18742", "timestamp_epoch": "1533964959.980701000" }, { "tcp_stream": 535, "frame_number": 18856, "display_filter": "frame.number == 18856", "timestamp_epoch": "1533964960.141466000" }, { "tcp_stream": 536, "frame_number": 18857, "display_filter": "frame.number == 18857", "timestamp_epoch": "1533964960.142493000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:49:06.228996+00:00" }, { "observable_id": "observable-447080e31c06cfe2a882149e", "type": "domain", "value": "cdn.adnxs.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:49:06.425885+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:06.421839+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 203, "frame_number": 19274, "display_filter": "frame.number == 19274", "timestamp_epoch": "1533964961.688095000" }, { "udp_stream": 203, "frame_number": 19312, "display_filter": "frame.number == 19312", "timestamp_epoch": "1533964961.782585000" }, { "tcp_stream": 556, "frame_number": 19365, "display_filter": "frame.number == 19365", "timestamp_epoch": "1533964961.847417000" }, { "tcp_stream": 557, "frame_number": 19368, "display_filter": "frame.number == 19368", "timestamp_epoch": "1533964961.847994000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:49:06.417528+00:00" }, { "observable_id": "observable-37f64cba6c320580e3093220", "type": "domain", "value": "cdn.digicertcdn.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 237, "frame_number": 23970, "display_filter": "frame.number == 23970", "timestamp_epoch": "1533964998.468790000" }, { "udp_stream": 236, "frame_number": 23971, "display_filter": "frame.number == 23971", "timestamp_epoch": "1533964998.468958000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4e7524f4352ae53c36402823", "type": "domain", "value": "cdn.doubleverify.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:44:59.472971+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:06.605219+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 292, "frame_number": 32836, "display_filter": "frame.number == 32836", "timestamp_epoch": "1533965136.002564000" }, { "udp_stream": 292, "frame_number": 32847, "display_filter": "frame.number == 32847", "timestamp_epoch": "1533965136.094373000" }, { "tcp_stream": 896, "frame_number": 32852, "display_filter": "frame.number == 32852", "timestamp_epoch": "1533965136.154989000" }, { "tcp_stream": 897, "frame_number": 32856, "display_filter": "frame.number == 32856", "timestamp_epoch": "1533965136.162089000" }, { "tcp_stream": 1014, "frame_number": 38980, "display_filter": "frame.number == 38980", "timestamp_epoch": "1533965240.725595000" }, { "tcp_stream": 1015, "frame_number": 38982, "display_filter": "frame.number == 38982", "timestamp_epoch": "1533965240.725799000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:49:06.600262+00:00" }, { "observable_id": "observable-f1ef276d2e5165b1376b7de6", "type": "domain", "value": "cdn.jsdelivr.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No direct maliciousness evidence", "actors": [], "source": "threatfox", "status": "ok", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:49:06.619253+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [ { "tier": 1, "source": "cdn.jsdelivr.net", "target": "https://cdn.jsdelivr.net/gh/vitiapig/api-bd7dff3f-84b7-4bbb-a8e1-7be98555d879/js", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "cdn.jsdelivr.net", "target": "https://cdn.jsdelivr.net/gh/vitiapig/lang-28/robot", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "cdn.jsdelivr.net", "target": "https://cdn.jsdelivr.net/gh/arinao7/8327ac99-c06c-422f-bd2e-4a80978d52c9/api-45", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "cdn.jsdelivr.net", "target": "https://cdn.jsdelivr.net/gh/arinao7/6e91d58f-acdf/e62", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "cdn.jsdelivr.net", "target": "https://cdn.jsdelivr.net/gh/arinao7/6e91d58f-acdf/key", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "cdn.jsdelivr.net", "target": "https://cdn.jsdelivr.net/gh/arinao7/86227780-d251hllg", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "cdn.jsdelivr.net", "target": "https://cdn.jsdelivr.net/gh/savina-41/mcv4f-jp5/launching", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "cdn.jsdelivr.net", "target": "https://cdn.jsdelivr.net/gh/savina-41/8a-96dfe89a4aa3/hum-id46", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "cdn.jsdelivr.net", "target": "https://cdn.jsdelivr.net/gh/savina-41/d846-4abc/id-7843", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "cdn.jsdelivr.net", "target": "https://cdn.jsdelivr.net/gh/savina-41/r4240-98d7-bc2c@main/fe3b", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "cdn.jsdelivr.net", "target": "https://cdn.jsdelivr.net/gh/savina-41/4240-98d7-bc2c@main/fe3b", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "cdn.jsdelivr.net", "target": "https://cdn.jsdelivr.net/gh/savina-41/jjh-765/nxx-5", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "cdn.jsdelivr.net", "target": "https://cdn.jsdelivr.net/gh/savina-41vf67-74j/forw-74", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "cdn.jsdelivr.net", "target": "https://cdn.jsdelivr.net/gh/louis-mellor/2d-aee4-1433332c1@main/f5", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "cdn.jsdelivr.net", "target": "https://cdn.jsdelivr.net/gh/galinavsuk6/sdg7-j9/r-fd7", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "cdn.jsdelivr.net", "target": "https://cdn.jsdelivr.net/gh/galinavsuk6/fjhg-567/hum", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "cdn.jsdelivr.net", "target": "https://cdn.jsdelivr.net/gh/galinavsuk6/fjhg-567/hm-354", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "cdn.jsdelivr.net", "target": "https://cdn.jsdelivr.net/gh/galinavsuk6/text-set/vbr", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "cdn.jsdelivr.net", "target": "https://cdn.jsdelivr.net/gh/galinavsuk6/text-set/vdr", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "cdn.jsdelivr.net", "target": "https://cdn.jsdelivr.net/gh/swiftvpnaccess/wanting-public-driver-barricade/78956-uuid", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "cdn.jsdelivr.net", "target": "https://cdn.jsdelivr.net/gh/swiftvpnaccess/wanting-public-driver-barricade/256446-uuid", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "cdn.jsdelivr.net", "target": "https://cdn.jsdelivr.net/gh/swiftvpnaccess/smtp-incoming-mx/load", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "cdn.jsdelivr.net", "target": "https://cdn.jsdelivr.net/gh/kud-981/9564-41286dbead85@d02d0a9/set", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "cdn.jsdelivr.net", "target": "https://cdn.jsdelivr.net/gh/zor-876/futures-import@8b224a7/requests", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "cdn.jsdelivr.net", "target": "https://cdn.jsdelivr.net/gh/zor-876/futures-import@04e2419/llm", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "cdn.jsdelivr.net", "target": "https://cdn.jsdelivr.net/gh/kud-981/sandy-lumping-mandarin@a1fee8e/sys", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "cdn.jsdelivr.net", "target": "https://cdn.jsdelivr.net/gh/kud-981/kirby-s1@3859d64/kk-w7", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "cdn.jsdelivr.net", "target": "https://cdn.jsdelivr.net/gh/kud-981/rt-3476@62fe780/kurt-38", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "cdn.jsdelivr.net", "target": "https://cdn.jsdelivr.net/gh/kud-981/upstroke@main/unaware", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "cdn.jsdelivr.net", "target": "https://cdn.jsdelivr.net/gh/kud-981/bunt@charred/error", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "cdn.jsdelivr.net", "target": "https://cdn.jsdelivr.net/gh/stroller-del/shrouded/growl", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "cdn.jsdelivr.net", "target": "https://cdn.jsdelivr.net/gh/stroller-del/slicing/doornail", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "cdn.jsdelivr.net", "target": "https://cdn.jsdelivr.net/gh/roadvillnet/fred/iren", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "cdn.jsdelivr.net", "target": "https://cdn.jsdelivr.net/gh/Max-856/treem/luda", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "cdn.jsdelivr.net", "target": "https://cdn.jsdelivr.net/gh/Max-856/crocs/fulls", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "cdn.jsdelivr.net", "target": "https://cdn.jsdelivr.net/gh/marye4562/trimester/implosive", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "cdn.jsdelivr.net", "target": "https://cdn.jsdelivr.net/gh/marye4562/drown/silenced", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "cdn.jsdelivr.net", "target": "https://cdn.jsdelivr.net/gh/payphone-blip/flamingo/lola", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "cdn.jsdelivr.net", "target": "https://cdn.jsdelivr.net/gh/marye4562/hd3y64jd8ryt6q/dh476f7fkr9t", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "cdn.jsdelivr.net", "target": "https://cdn.jsdelivr.net/gh/marye4562/hd3y64jd8ryt6q/dh476f7fkr9t", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" } ] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:06.614777+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 178, "frame_number": 17308, "display_filter": "frame.number == 17308", "timestamp_epoch": "1533964955.786374000" }, { "udp_stream": 178, "frame_number": 17309, "display_filter": "frame.number == 17309", "timestamp_epoch": "1533964955.900897000" }, { "tcp_stream": 491, "frame_number": 17318, "display_filter": "frame.number == 17318", "timestamp_epoch": "1533964955.947846000" }, { "tcp_stream": 492, "frame_number": 17319, "display_filter": "frame.number == 17319", "timestamp_epoch": "1533964955.947973000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:49:06.609651+00:00" }, { "observable_id": "observable-698ca1b7965a743c2cf40d8b", "type": "domain", "value": "cdn.marphezis.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:49:06.996611+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:06.992305+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 107, "frame_number": 9410, "display_filter": "frame.number == 9410", "timestamp_epoch": "1533964899.326173000" }, { "udp_stream": 107, "frame_number": 9794, "display_filter": "frame.number == 9794", "timestamp_epoch": "1533964899.640925000" }, { "tcp_stream": 264, "frame_number": 9963, "display_filter": "frame.number == 9963", "timestamp_epoch": "1533964899.757726000" }, { "tcp_stream": 265, "frame_number": 9965, "display_filter": "frame.number == 9965", "timestamp_epoch": "1533964899.757871000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:49:06.987958+00:00" }, { "observable_id": "observable-11caa9a42f5f0ef5cf7f4a52", "type": "domain", "value": "cdn.onthe.io", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:49:07.184087+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:07.180255+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 349, "frame_number": 44127, "display_filter": "frame.number == 44127", "timestamp_epoch": "1533965784.244464000" }, { "udp_stream": 349, "frame_number": 44215, "display_filter": "frame.number == 44215", "timestamp_epoch": "1533965784.462482000" }, { "tcp_stream": 1167, "frame_number": 44352, "display_filter": "frame.number == 44352", "timestamp_epoch": "1533965785.008624000" }, { "tcp_stream": 1170, "frame_number": 44364, "display_filter": "frame.number == 44364", "timestamp_epoch": "1533965785.009620000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:49:07.175221+00:00" }, { "observable_id": "observable-8f5e8915ac6812872d813d28", "type": "domain", "value": "cdn1.tass.ru", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:49:07.735438+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:07.733189+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 325, "frame_number": 40131, "display_filter": "frame.number == 40131", "timestamp_epoch": "1533965770.288010000" }, { "udp_stream": 325, "frame_number": 40223, "display_filter": "frame.number == 40223", "timestamp_epoch": "1533965770.569360000" }, { "tcp_stream": 1097, "frame_number": 40425, "display_filter": "frame.number == 40425", "timestamp_epoch": "1533965770.853120000" }, { "tcp_stream": 1107, "frame_number": 40437, "display_filter": "frame.number == 40437", "timestamp_epoch": "1533965770.856915000" }, { "tcp_stream": 1098, "frame_number": 40445, "display_filter": "frame.number == 40445", "timestamp_epoch": "1533965770.857931000" }, { "tcp_stream": 1106, "frame_number": 40449, "display_filter": "frame.number == 40449", "timestamp_epoch": "1533965770.860090000" }, { "tcp_stream": 1105, "frame_number": 40453, "display_filter": "frame.number == 40453", "timestamp_epoch": "1533965770.862012000" }, { "tcp_stream": 1101, "frame_number": 40457, "display_filter": "frame.number == 40457", "timestamp_epoch": "1533965770.865615000" }, { "tcp_stream": 1116, "frame_number": 40959, "display_filter": "frame.number == 40959", "timestamp_epoch": "1533965773.747726000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:49:07.730128+00:00" }, { "observable_id": "observable-3d588cad94e0883438b1d29c", "type": "domain", "value": "cdn2.tass.ru", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:49:07.908551+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:07.904378+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 327, "frame_number": 40133, "display_filter": "frame.number == 40133", "timestamp_epoch": "1533965770.289999000" }, { "udp_stream": 327, "frame_number": 40215, "display_filter": "frame.number == 40215", "timestamp_epoch": "1533965770.562042000" }, { "tcp_stream": 1084, "frame_number": 40305, "display_filter": "frame.number == 40305", "timestamp_epoch": "1533965770.800734000" }, { "tcp_stream": 1085, "frame_number": 40317, "display_filter": "frame.number == 40317", "timestamp_epoch": "1533965770.802376000" }, { "tcp_stream": 1086, "frame_number": 40318, "display_filter": "frame.number == 40318", "timestamp_epoch": "1533965770.802377000" }, { "tcp_stream": 1088, "frame_number": 40329, "display_filter": "frame.number == 40329", "timestamp_epoch": "1533965770.808469000" }, { "tcp_stream": 1089, "frame_number": 40337, "display_filter": "frame.number == 40337", "timestamp_epoch": "1533965770.810276000" }, { "tcp_stream": 1087, "frame_number": 40405, "display_filter": "frame.number == 40405", "timestamp_epoch": "1533965770.823596000" }, { "tcp_stream": 1118, "frame_number": 40955, "display_filter": "frame.number == 40955", "timestamp_epoch": "1533965773.747177000" }, { "tcp_stream": 1115, "frame_number": 40957, "display_filter": "frame.number == 40957", "timestamp_epoch": "1533965773.747380000" }, { "tcp_stream": 1125, "frame_number": 41162, "display_filter": "frame.number == 41162", "timestamp_epoch": "1533965772.399571000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:49:07.899290+00:00" }, { "observable_id": "observable-a77e611ca230b53dfbc16ba5", "type": "domain", "value": "cdn3.doubleverify.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:49:08.093195+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:08.088788+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 294, "frame_number": 32943, "display_filter": "frame.number == 32943", "timestamp_epoch": "1533965136.507812000" }, { "udp_stream": 294, "frame_number": 32947, "display_filter": "frame.number == 32947", "timestamp_epoch": "1533965136.618382000" }, { "tcp_stream": 898, "frame_number": 32960, "display_filter": "frame.number == 32960", "timestamp_epoch": "1533965136.671813000" }, { "tcp_stream": 899, "frame_number": 32968, "display_filter": "frame.number == 32968", "timestamp_epoch": "1533965136.717908000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:49:08.083889+00:00" }, { "observable_id": "observable-b1a30670a41ae63ba2bc4482", "type": "domain", "value": "cdni.rt.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:49:08.281199+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:08.276810+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 33, "frame_number": 599, "display_filter": "frame.number == 599", "timestamp_epoch": "1533964545.580055000" }, { "udp_stream": 33, "frame_number": 649, "display_filter": "frame.number == 649", "timestamp_epoch": "1533964545.745951000" }, { "tcp_stream": 53, "frame_number": 692, "display_filter": "frame.number == 692", "timestamp_epoch": "1533964545.823140000" }, { "tcp_stream": 54, "frame_number": 696, "display_filter": "frame.number == 696", "timestamp_epoch": "1533964545.823802000" }, { "tcp_stream": 56, "frame_number": 698, "display_filter": "frame.number == 698", "timestamp_epoch": "1533964545.824007000" }, { "tcp_stream": 55, "frame_number": 699, "display_filter": "frame.number == 699", "timestamp_epoch": "1533964545.824041000" }, { "tcp_stream": 57, "frame_number": 702, "display_filter": "frame.number == 702", "timestamp_epoch": "1533964545.824352000" }, { "tcp_stream": 58, "frame_number": 704, "display_filter": "frame.number == 704", "timestamp_epoch": "1533964545.824437000" }, { "tcp_stream": 59, "frame_number": 1264, "display_filter": "frame.number == 1264", "timestamp_epoch": "1533964546.538622000" }, { "tcp_stream": 60, "frame_number": 1266, "display_filter": "frame.number == 1266", "timestamp_epoch": "1533964546.538863000" }, { "tcp_stream": 62, "frame_number": 2255, "display_filter": "frame.number == 2255", "timestamp_epoch": "1533964549.224979000" }, { "tcp_stream": 61, "frame_number": 2257, "display_filter": "frame.number == 2257", "timestamp_epoch": "1533964549.225497000" }, { "tcp_stream": 63, "frame_number": 2381, "display_filter": "frame.number == 2381", "timestamp_epoch": "1533964549.653129000" }, { "tcp_stream": 188, "frame_number": 7493, "display_filter": "frame.number == 7493", "timestamp_epoch": "1533964897.294499000" }, { "tcp_stream": 190, "frame_number": 7501, "display_filter": "frame.number == 7501", "timestamp_epoch": "1533964897.294992000" }, { "tcp_stream": 191, "frame_number": 7503, "display_filter": "frame.number == 7503", "timestamp_epoch": "1533964897.295172000" }, { "tcp_stream": 189, "frame_number": 7505, "display_filter": "frame.number == 7505", "timestamp_epoch": "1533964897.295174000" }, { "tcp_stream": 193, "frame_number": 7511, "display_filter": "frame.number == 7511", "timestamp_epoch": "1533964897.295895000" }, { "tcp_stream": 192, "frame_number": 7513, "display_filter": "frame.number == 7513", "timestamp_epoch": "1533964897.295919000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:49:08.271620+00:00" }, { "observable_id": "observable-68cdfeacc780f8eb6173581c", "type": "domain", "value": "cds.n3g2w2j5.hwcdn.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 160, "frame_number": 15186, "display_filter": "frame.number == 15186", "timestamp_epoch": "1533964906.152257000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1359ffe062d1480e3e999067", "type": "domain", "value": "cds.p5q6b2e4.hwcdn.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 90, "frame_number": 7515, "display_filter": "frame.number == 7515", "timestamp_epoch": "1533964897.312123000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-54bf5b371f538e33b544ef53", "type": "domain", "value": "ce.lijit.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:48:09.572549+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:08.461930+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 284, "frame_number": 31610, "display_filter": "frame.number == 31610", "timestamp_epoch": "1533965100.695463000" }, { "udp_stream": 284, "frame_number": 31672, "display_filter": "frame.number == 31672", "timestamp_epoch": "1533965100.795928000" }, { "tcp_stream": 862, "frame_number": 31788, "display_filter": "frame.number == 31788", "timestamp_epoch": "1533965100.899662000" }, { "tcp_stream": 861, "frame_number": 31801, "display_filter": "frame.number == 31801", "timestamp_epoch": "1533965100.912659000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:49:08.456050+00:00" }, { "observable_id": "observable-21ca2fb53ad396b752303c24", "type": "domain", "value": "cm.adform.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:49:08.475717+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:08.471118+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 235, "frame_number": 23570, "display_filter": "frame.number == 23570", "timestamp_epoch": "1533964997.745243000" }, { "udp_stream": 235, "frame_number": 23649, "display_filter": "frame.number == 23649", "timestamp_epoch": "1533964997.831687000" }, { "tcp_stream": 660, "frame_number": 23834, "display_filter": "frame.number == 23834", "timestamp_epoch": "1533964998.080510000" }, { "tcp_stream": 661, "frame_number": 23835, "display_filter": "frame.number == 23835", "timestamp_epoch": "1533964998.080847000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:49:08.466432+00:00" }, { "observable_id": "observable-a880cd9083cb15bddfbce855", "type": "domain", "value": "cm.adgrx.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:45:55.750716+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:08.657755+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 276, "frame_number": 30492, "display_filter": "frame.number == 30492", "timestamp_epoch": "1533965098.783727000" }, { "udp_stream": 276, "frame_number": 30803, "display_filter": "frame.number == 30803", "timestamp_epoch": "1533965099.278838000" }, { "tcp_stream": 838, "frame_number": 31187, "display_filter": "frame.number == 31187", "timestamp_epoch": "1533965100.008452000" }, { "tcp_stream": 839, "frame_number": 31191, "display_filter": "frame.number == 31191", "timestamp_epoch": "1533965100.008832000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:49:08.653736+00:00" }, { "observable_id": "observable-5d78dc8fd8aadddcc222e2d5", "type": "domain", "value": "cm.eyereturn.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:45:56.146510+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:08.666916+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 299, "frame_number": 33838, "display_filter": "frame.number == 33838", "timestamp_epoch": "1533965157.679632000" }, { "udp_stream": 299, "frame_number": 33923, "display_filter": "frame.number == 33923", "timestamp_epoch": "1533965157.846245000" }, { "tcp_stream": 942, "frame_number": 34027, "display_filter": "frame.number == 34027", "timestamp_epoch": "1533965157.936377000" }, { "tcp_stream": 943, "frame_number": 34028, "display_filter": "frame.number == 34028", "timestamp_epoch": "1533965157.936486000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:49:08.662889+00:00" }, { "observable_id": "observable-0b1c758fb28c330e7f0867c0", "type": "domain", "value": "cm.g.doubleclick.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:45:13.189219+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:08.672936+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 66, "frame_number": 5083, "display_filter": "frame.number == 5083", "timestamp_epoch": "1533964555.923820000" }, { "udp_stream": 66, "frame_number": 5140, "display_filter": "frame.number == 5140", "timestamp_epoch": "1533964556.025417000" }, { "udp_stream": 362, "frame_number": 45976, "display_filter": "frame.number == 45976", "timestamp_epoch": "1533965789.422175000" }, { "udp_stream": 362, "frame_number": 46032, "display_filter": "frame.number == 46032", "timestamp_epoch": "1533965789.555893000" }, { "tcp_stream": 124, "frame_number": 5207, "display_filter": "frame.number == 5207", "timestamp_epoch": "1533964556.093107000" }, { "tcp_stream": 121, "frame_number": 5212, "display_filter": "frame.number == 5212", "timestamp_epoch": "1533964556.093986000" }, { "tcp_stream": 301, "frame_number": 11522, "display_filter": "frame.number == 11522", "timestamp_epoch": "1533964901.338831000" }, { "tcp_stream": 298, "frame_number": 11523, "display_filter": "frame.number == 11523", "timestamp_epoch": "1533964901.339056000" }, { "tcp_stream": 299, "frame_number": 11524, "display_filter": "frame.number == 11524", "timestamp_epoch": "1533964901.339078000" }, { "tcp_stream": 300, "frame_number": 11525, "display_filter": "frame.number == 11525", "timestamp_epoch": "1533964901.339204000" }, { "tcp_stream": 1211, "frame_number": 46067, "display_filter": "frame.number == 46067", "timestamp_epoch": "1533965789.689201000" }, { "tcp_stream": 1212, "frame_number": 46069, "display_filter": "frame.number == 46069", "timestamp_epoch": "1533965789.689556000" }, { "tcp_stream": 1213, "frame_number": 46073, "display_filter": "frame.number == 46073", "timestamp_epoch": "1533965789.693703000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:49:08.671080+00:00" }, { "observable_id": "observable-068a6da0bb79c5358c41de74", "type": "domain", "value": "cms.quantserve.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:49:08.678442+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:08.676821+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 231, "frame_number": 23547, "display_filter": "frame.number == 23547", "timestamp_epoch": "1533964997.685605000" }, { "udp_stream": 231, "frame_number": 23599, "display_filter": "frame.number == 23599", "timestamp_epoch": "1533964997.757167000" }, { "tcp_stream": 652, "frame_number": 23673, "display_filter": "frame.number == 23673", "timestamp_epoch": "1533964997.857707000" }, { "tcp_stream": 651, "frame_number": 23676, "display_filter": "frame.number == 23676", "timestamp_epoch": "1533964997.858143000" }, { "tcp_stream": 815, "frame_number": 30646, "display_filter": "frame.number == 30646", "timestamp_epoch": "1533965099.045323000" }, { "tcp_stream": 814, "frame_number": 30654, "display_filter": "frame.number == 30654", "timestamp_epoch": "1533965099.046221000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:49:08.674967+00:00" }, { "observable_id": "observable-46e299f63770703c45b1fe13", "type": "domain", "value": "code.createjs.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:49:09.418246+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:09.416051+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 132, "frame_number": 12096, "display_filter": "frame.number == 12096", "timestamp_epoch": "1533964901.899258000" }, { "udp_stream": 132, "frame_number": 12260, "display_filter": "frame.number == 12260", "timestamp_epoch": "1533964902.009546000" }, { "tcp_stream": 323, "frame_number": 12427, "display_filter": "frame.number == 12427", "timestamp_epoch": "1533964902.276965000" }, { "tcp_stream": 322, "frame_number": 12429, "display_filter": "frame.number == 12429", "timestamp_epoch": "1533964902.277117000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:49:09.413011+00:00" }, { "observable_id": "observable-bb30103ef150f09e844062d3", "type": "domain", "value": "comet.tass.ru", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 193, "frame_number": 44492, "display_filter": "frame.number == 44492", "timestamp_epoch": "1533965785.481508000" }, { "udp_stream": 193, "frame_number": 44698, "display_filter": "frame.number == 44698", "timestamp_epoch": "1533965786.043507000" }, { "tcp_stream": 1186, "frame_number": 44900, "display_filter": "frame.number == 44900", "timestamp_epoch": "1533965786.473054000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7bba686247a58a37aa55c593", "type": "domain", "value": "connect.facebook.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:45:14.006547+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:58.239371+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 342, "frame_number": 43646, "display_filter": "frame.number == 43646", "timestamp_epoch": "1533965783.030794000" }, { "udp_stream": 342, "frame_number": 43674, "display_filter": "frame.number == 43674", "timestamp_epoch": "1533965783.128458000" }, { "tcp_stream": 1151, "frame_number": 43690, "display_filter": "frame.number == 43690", "timestamp_epoch": "1533965783.175343000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:58.235982+00:00" }, { "observable_id": "observable-11b3d20f8a01d79ad42e0f41", "type": "domain", "value": "contextual.media.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 152, "frame_number": 14557, "display_filter": "frame.number == 14557", "timestamp_epoch": "1533964904.585739000" }, { "udp_stream": 152, "frame_number": 14656, "display_filter": "frame.number == 14656", "timestamp_epoch": "1533964904.683765000" }, { "tcp_stream": 407, "frame_number": 14772, "display_filter": "frame.number == 14772", "timestamp_epoch": "1533964904.749793000" }, { "tcp_stream": 408, "frame_number": 14781, "display_filter": "frame.number == 14781", "timestamp_epoch": "1533964904.752200000" }, { "tcp_stream": 849, "frame_number": 31660, "display_filter": "frame.number == 31660", "timestamp_epoch": "1533965100.791749000" }, { "tcp_stream": 850, "frame_number": 31661, "display_filter": "frame.number == 31661", "timestamp_epoch": "1533965100.791899000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1b0dd5551415606cbe457769", "type": "domain", "value": "cookie.brealtime.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 245, "frame_number": 26370, "display_filter": "frame.number == 26370", "timestamp_epoch": "1533965032.574941000" }, { "udp_stream": 245, "frame_number": 26408, "display_filter": "frame.number == 26408", "timestamp_epoch": "1533965032.676936000" }, { "tcp_stream": 700, "frame_number": 26466, "display_filter": "frame.number == 26466", "timestamp_epoch": "1533965032.790959000" }, { "tcp_stream": 701, "frame_number": 26469, "display_filter": "frame.number == 26469", "timestamp_epoch": "1533965032.792859000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2c0ea2d53f7116a86e70db76", "type": "domain", "value": "cookie.brealtime.com.cdn.cloudflare.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 245, "frame_number": 26408, "display_filter": "frame.number == 26408", "timestamp_epoch": "1533965032.676936000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-23afc23031aa020c2ceaffb3", "type": "domain", "value": "cookiesyncing-1395500543.us-east-1.elb.amazonaws.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 250, "frame_number": 26727, "display_filter": "frame.number == 26727", "timestamp_epoch": "1533965033.481280000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-675e39910228b5dfa2e4c4be", "type": "domain", "value": "cookiex.ngd.yahoo.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 85, "frame_number": 6262, "display_filter": "frame.number == 6262", "timestamp_epoch": "1533964560.225311000" }, { "udp_stream": 85, "frame_number": 6273, "display_filter": "frame.number == 6273", "timestamp_epoch": "1533964560.304978000" }, { "tcp_stream": 160, "frame_number": 6299, "display_filter": "frame.number == 6299", "timestamp_epoch": "1533964560.408414000" }, { "tcp_stream": 161, "frame_number": 6301, "display_filter": "frame.number == 6301", "timestamp_epoch": "1533964560.408600000" }, { "tcp_stream": 483, "frame_number": 16846, "display_filter": "frame.number == 16846", "timestamp_epoch": "1533964910.795788000" }, { "tcp_stream": 484, "frame_number": 16849, "display_filter": "frame.number == 16849", "timestamp_epoch": "1533964910.796568000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-984aee067a4f012bc805745f", "type": "domain", "value": "counter.yadro.ru", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 49, "frame_number": 3210, "display_filter": "frame.number == 3210", "timestamp_epoch": "1533964552.428838000" }, { "udp_stream": 49, "frame_number": 3296, "display_filter": "frame.number == 3296", "timestamp_epoch": "1533964552.626454000" }, { "udp_stream": 340, "frame_number": 43641, "display_filter": "frame.number == 43641", "timestamp_epoch": "1533965783.022652000" }, { "udp_stream": 340, "frame_number": 43654, "display_filter": "frame.number == 43654", "timestamp_epoch": "1533965783.076721000" }, { "tcp_stream": 1143, "frame_number": 43744, "display_filter": "frame.number == 43744", "timestamp_epoch": "1533965783.328334000" }, { "tcp_stream": 1144, "frame_number": 43748, "display_filter": "frame.number == 43748", "timestamp_epoch": "1533965783.334711000" }, { "tcp_stream": 83, "frame_number": 3529, "display_filter": "frame.number == 3529", "timestamp_epoch": "1533964552.955577000" }, { "tcp_stream": 82, "frame_number": 3536, "display_filter": "frame.number == 3536", "timestamp_epoch": "1533964552.957535000" }, { "tcp_stream": 209, "frame_number": 8485, "display_filter": "frame.number == 8485", "timestamp_epoch": "1533964898.334174000" }, { "tcp_stream": 208, "frame_number": 8497, "display_filter": "frame.number == 8497", "timestamp_epoch": "1533964898.346644000" } ], "roles": [ "dns-query", "http-host", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2349944df038289ddc008eb0", "type": "domain", "value": "crt.comodoca.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 120, "frame_number": 11334, "display_filter": "frame.number == 11334", "timestamp_epoch": "1533964901.171968000" }, { "udp_stream": 121, "frame_number": 11335, "display_filter": "frame.number == 11335", "timestamp_epoch": "1533964901.173416000" }, { "udp_stream": 121, "frame_number": 11428, "display_filter": "frame.number == 11428", "timestamp_epoch": "1533964901.270602000" }, { "udp_stream": 120, "frame_number": 11429, "display_filter": "frame.number == 11429", "timestamp_epoch": "1533964901.270707000" }, { "tcp_stream": 296, "frame_number": 11487, "display_filter": "frame.number == 11487", "timestamp_epoch": "1533964901.324527000" }, { "tcp_stream": 297, "frame_number": 11488, "display_filter": "frame.number == 11488", "timestamp_epoch": "1533964901.324607000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f54b1e1823352d1a1eb5d287", "type": "domain", "value": "crt.comodoca.com.cdn.cloudflare.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 121, "frame_number": 11428, "display_filter": "frame.number == 11428", "timestamp_epoch": "1533964901.270602000" }, { "udp_stream": 120, "frame_number": 11429, "display_filter": "frame.number == 11429", "timestamp_epoch": "1533964901.270707000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8191c7cc91a36f601f6d72cd", "type": "domain", "value": "cs.adingo.jp", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 304, "frame_number": 35495, "display_filter": "frame.number == 35495", "timestamp_epoch": "1533965160.271382000" }, { "udp_stream": 304, "frame_number": 35517, "display_filter": "frame.number == 35517", "timestamp_epoch": "1533965160.353225000" }, { "tcp_stream": 959, "frame_number": 35639, "display_filter": "frame.number == 35639", "timestamp_epoch": "1533965160.501178000" }, { "tcp_stream": 958, "frame_number": 35655, "display_filter": "frame.number == 35655", "timestamp_epoch": "1533965160.512260000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-01bc0161b78878e280ebfe87", "type": "domain", "value": "cs574.wpc.edgecastcdn.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 214, "frame_number": 20116, "display_filter": "frame.number == 20116", "timestamp_epoch": "1533964964.705871000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-07238b9b5823a2ddba1f7aff", "type": "domain", "value": "cs84.wac.edgecastcdn.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 204, "frame_number": 19335, "display_filter": "frame.number == 19335", "timestamp_epoch": "1533964961.815071000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-9fcbd8a9e74af65c74f74d50", "type": "domain", "value": "csi.gstatic.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 151, "frame_number": 14517, "display_filter": "frame.number == 14517", "timestamp_epoch": "1533964904.556113000" }, { "udp_stream": 151, "frame_number": 14626, "display_filter": "frame.number == 14626", "timestamp_epoch": "1533964904.641770000" }, { "tcp_stream": 400, "frame_number": 14869, "display_filter": "frame.number == 14869", "timestamp_epoch": "1533964904.839279000" }, { "tcp_stream": 399, "frame_number": 14870, "display_filter": "frame.number == 14870", "timestamp_epoch": "1533964904.839407000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f7f8934debb864d5857db0e2", "type": "domain", "value": "d3f7zc5bbfci5.cloudfront.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 72, "frame_number": 5857, "display_filter": "frame.number == 5857", "timestamp_epoch": "1533964559.422782000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a571e9fad414646fbe746f75", "type": "domain", "value": "d5p.de17a.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 243, "frame_number": 35499, "display_filter": "frame.number == 35499", "timestamp_epoch": "1533965160.272196000" }, { "udp_stream": 243, "frame_number": 35522, "display_filter": "frame.number == 35522", "timestamp_epoch": "1533965160.354549000" }, { "tcp_stream": 962, "frame_number": 35688, "display_filter": "frame.number == 35688", "timestamp_epoch": "1533965160.566666000" }, { "tcp_stream": 960, "frame_number": 35689, "display_filter": "frame.number == 35689", "timestamp_epoch": "1533965160.566812000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e49397f353a16eaec241c135", "type": "domain", "value": "da4pli3l5vc0d.cloudfront.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 213, "frame_number": 20088, "display_filter": "frame.number == 20088", "timestamp_epoch": "1533964964.561974000" }, { "udp_stream": 213, "frame_number": 20107, "display_filter": "frame.number == 20107", "timestamp_epoch": "1533964964.633293000" }, { "tcp_stream": 581, "frame_number": 20127, "display_filter": "frame.number == 20127", "timestamp_epoch": "1533964964.714903000" }, { "tcp_stream": 582, "frame_number": 20131, "display_filter": "frame.number == 20131", "timestamp_epoch": "1533964964.723599000" }, { "tcp_stream": 786, "frame_number": 28749, "display_filter": "frame.number == 28749", "timestamp_epoch": "1533965094.697438000" }, { "tcp_stream": 787, "frame_number": 28753, "display_filter": "frame.number == 28753", "timestamp_epoch": "1533965094.701744000" }, { "tcp_stream": 927, "frame_number": 33665, "display_filter": "frame.number == 33665", "timestamp_epoch": "1533965157.318244000" }, { "tcp_stream": 926, "frame_number": 33671, "display_filter": "frame.number == 33671", "timestamp_epoch": "1533965157.319578000" }, { "tcp_stream": 984, "frame_number": 37020, "display_filter": "frame.number == 37020", "timestamp_epoch": "1533965220.199143000" }, { "tcp_stream": 983, "frame_number": 37021, "display_filter": "frame.number == 37021", "timestamp_epoch": "1533965220.199145000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7d44eb5958550b1af1bf4f38", "type": "domain", "value": "delivery-us-west-1.openx.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 119, "frame_number": 11119, "display_filter": "frame.number == 11119", "timestamp_epoch": "1533964901.057490000" }, { "udp_stream": 119, "frame_number": 11261, "display_filter": "frame.number == 11261", "timestamp_epoch": "1533964901.134370000" }, { "tcp_stream": 291, "frame_number": 11389, "display_filter": "frame.number == 11389", "timestamp_epoch": "1533964901.234054000" }, { "tcp_stream": 290, "frame_number": 11391, "display_filter": "frame.number == 11391", "timestamp_epoch": "1533964901.234373000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3aab5fd9383dd7dd0efe87cf", "type": "domain", "value": "delivery.h.switchadhub.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 302, "frame_number": 35493, "display_filter": "frame.number == 35493", "timestamp_epoch": "1533965160.270758000" }, { "udp_stream": 302, "frame_number": 35521, "display_filter": "frame.number == 35521", "timestamp_epoch": "1533965160.354413000" }, { "tcp_stream": 961, "frame_number": 35583, "display_filter": "frame.number == 35583", "timestamp_epoch": "1533965160.404895000" }, { "tcp_stream": 964, "frame_number": 35587, "display_filter": "frame.number == 35587", "timestamp_epoch": "1533965160.424069000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-57144f135b27540fb905e6a0", "type": "domain", "value": "dh.serving-sys.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 261, "frame_number": 27305, "display_filter": "frame.number == 27305", "timestamp_epoch": "1533965035.353791000" }, { "udp_stream": 261, "frame_number": 27339, "display_filter": "frame.number == 27339", "timestamp_epoch": "1533965035.445254000" }, { "tcp_stream": 747, "frame_number": 27512, "display_filter": "frame.number == 27512", "timestamp_epoch": "1533965035.687150000" }, { "tcp_stream": 744, "frame_number": 27514, "display_filter": "frame.number == 27514", "timestamp_epoch": "1533965035.687423000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-15fda4888440cb6341a63462", "type": "domain", "value": "dis.criteo.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 167, "frame_number": 15982, "display_filter": "frame.number == 15982", "timestamp_epoch": "1533964908.334286000" }, { "udp_stream": 167, "frame_number": 15991, "display_filter": "frame.number == 15991", "timestamp_epoch": "1533964908.383676000" }, { "tcp_stream": 449, "frame_number": 16074, "display_filter": "frame.number == 16074", "timestamp_epoch": "1533964908.456604000" }, { "tcp_stream": 450, "frame_number": 16081, "display_filter": "frame.number == 16081", "timestamp_epoch": "1533964908.458723000" }, { "tcp_stream": 645, "frame_number": 23592, "display_filter": "frame.number == 23592", "timestamp_epoch": "1533964997.753641000" }, { "tcp_stream": 646, "frame_number": 23601, "display_filter": "frame.number == 23601", "timestamp_epoch": "1533964997.759410000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b2c8ba48117917e32ca40b63", "type": "domain", "value": "dmp-pixel.aolp-prd.public.aol.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 102, "frame_number": 8976, "display_filter": "frame.number == 8976", "timestamp_epoch": "1533964898.938935000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c59d0140ccf47ff5a187766b", "type": "domain", "value": "dmp.brand-display.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 225, "frame_number": 23095, "display_filter": "frame.number == 23095", "timestamp_epoch": "1533964996.653876000" }, { "udp_stream": 225, "frame_number": 23149, "display_filter": "frame.number == 23149", "timestamp_epoch": "1533964996.948203000" }, { "tcp_stream": 622, "frame_number": 23243, "display_filter": "frame.number == 23243", "timestamp_epoch": "1533964997.187628000" }, { "tcp_stream": 623, "frame_number": 23263, "display_filter": "frame.number == 23263", "timestamp_epoch": "1533964997.192337000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2809cf331a30704ba222b1d7", "type": "domain", "value": "dpm.demdex.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 173, "frame_number": 16523, "display_filter": "frame.number == 16523", "timestamp_epoch": "1533964909.665205000" }, { "udp_stream": 173, "frame_number": 16524, "display_filter": "frame.number == 16524", "timestamp_epoch": "1533964909.718959000" }, { "tcp_stream": 468, "frame_number": 16534, "display_filter": "frame.number == 16534", "timestamp_epoch": "1533964909.914087000" }, { "tcp_stream": 467, "frame_number": 16536, "display_filter": "frame.number == 16536", "timestamp_epoch": "1533964909.916198000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ad5003ef9f1e588efc65b737", "type": "domain", "value": "dsp.adfarm1.adition.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 301, "frame_number": 35492, "display_filter": "frame.number == 35492", "timestamp_epoch": "1533965160.270599000" }, { "udp_stream": 301, "frame_number": 35520, "display_filter": "frame.number == 35520", "timestamp_epoch": "1533965160.354275000" }, { "tcp_stream": 963, "frame_number": 35706, "display_filter": "frame.number == 35706", "timestamp_epoch": "1533965160.580828000" }, { "tcp_stream": 965, "frame_number": 35714, "display_filter": "frame.number == 35714", "timestamp_epoch": "1533965160.600800000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8646a5337888a87dad23dd8c", "type": "domain", "value": "dsp.adkernel.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 283, "frame_number": 31609, "display_filter": "frame.number == 31609", "timestamp_epoch": "1533965100.695251000" }, { "udp_stream": 283, "frame_number": 31670, "display_filter": "frame.number == 31670", "timestamp_epoch": "1533965100.795818000" }, { "tcp_stream": 858, "frame_number": 31835, "display_filter": "frame.number == 31835", "timestamp_epoch": "1533965100.980563000" }, { "tcp_stream": 860, "frame_number": 31838, "display_filter": "frame.number == 31838", "timestamp_epoch": "1533965100.980923000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d34ac1f2a7e7cf5d1ea80d22", "type": "domain", "value": "dsum-sec.casalemedia.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 256, "frame_number": 27296, "display_filter": "frame.number == 27296", "timestamp_epoch": "1533965035.302382000" }, { "udp_stream": 256, "frame_number": 27329, "display_filter": "frame.number == 27329", "timestamp_epoch": "1533965035.426932000" }, { "tcp_stream": 741, "frame_number": 27376, "display_filter": "frame.number == 27376", "timestamp_epoch": "1533965035.517921000" }, { "tcp_stream": 740, "frame_number": 27377, "display_filter": "frame.number == 27377", "timestamp_epoch": "1533965035.518005000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e1875a4ebf86af6a156c04e5", "type": "domain", "value": "dxedge-prod-lb-1585771072.us-west-2.elb.amazonaws.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 156, "frame_number": 14613, "display_filter": "frame.number == 14613", "timestamp_epoch": "1533964904.637787000" }, { "udp_stream": 222, "frame_number": 23033, "display_filter": "frame.number == 23033", "timestamp_epoch": "1533964996.474799000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e9e3fbf0c31897f0b325f0f2", "type": "domain", "value": "e.nexac.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 264, "frame_number": 27454, "display_filter": "frame.number == 27454", "timestamp_epoch": "1533965035.627357000" }, { "udp_stream": 264, "frame_number": 27522, "display_filter": "frame.number == 27522", "timestamp_epoch": "1533965035.690340000" }, { "tcp_stream": 754, "frame_number": 27635, "display_filter": "frame.number == 27635", "timestamp_epoch": "1533965035.790889000" }, { "tcp_stream": 759, "frame_number": 27640, "display_filter": "frame.number == 27640", "timestamp_epoch": "1533965035.799446000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-43f6b6cbc03ab8c8d6eb3b59", "type": "domain", "value": "e1.emxdgt.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 233, "frame_number": 23568, "display_filter": "frame.number == 23568", "timestamp_epoch": "1533964997.737064000" }, { "udp_stream": 233, "frame_number": 23633, "display_filter": "frame.number == 23633", "timestamp_epoch": "1533964997.811829000" }, { "tcp_stream": 657, "frame_number": 23754, "display_filter": "frame.number == 23754", "timestamp_epoch": "1533964997.960598000" }, { "tcp_stream": 656, "frame_number": 23762, "display_filter": "frame.number == 23762", "timestamp_epoch": "1533964997.972200000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3a87287f435353503defda2f", "type": "domain", "value": "eb2.3lift.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 259, "frame_number": 27303, "display_filter": "frame.number == 27303", "timestamp_epoch": "1533965035.335816000" }, { "udp_stream": 259, "frame_number": 27332, "display_filter": "frame.number == 27332", "timestamp_epoch": "1533965035.434545000" }, { "tcp_stream": 742, "frame_number": 27436, "display_filter": "frame.number == 27436", "timestamp_epoch": "1533965035.590273000" }, { "tcp_stream": 743, "frame_number": 27442, "display_filter": "frame.number == 27442", "timestamp_epoch": "1533965035.599216000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6e1a93f3a9fdaf9a0fae2a5e", "type": "domain", "value": "ebdr3.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 281, "frame_number": 31607, "display_filter": "frame.number == 31607", "timestamp_epoch": "1533965100.694974000" }, { "udp_stream": 281, "frame_number": 31703, "display_filter": "frame.number == 31703", "timestamp_epoch": "1533965100.814252000" }, { "tcp_stream": 869, "frame_number": 31819, "display_filter": "frame.number == 31819", "timestamp_epoch": "1533965100.951618000" }, { "tcp_stream": 868, "frame_number": 31826, "display_filter": "frame.number == 31826", "timestamp_epoch": "1533965100.952361000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4920e51a7821d3573eee5c87", "type": "domain", "value": "elb-aws-ca-clickdistrict-2095435364.us-west-1.elb.amazonaws.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 274, "frame_number": 30691, "display_filter": "frame.number == 30691", "timestamp_epoch": "1533965099.093757000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2004f81e88e2d4878108d5e9", "type": "domain", "value": "eus.rubiconproject.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 172, "frame_number": 16422, "display_filter": "frame.number == 16422", "timestamp_epoch": "1533964908.974972000" }, { "udp_stream": 172, "frame_number": 16445, "display_filter": "frame.number == 16445", "timestamp_epoch": "1533964909.104131000" }, { "tcp_stream": 465, "frame_number": 16464, "display_filter": "frame.number == 16464", "timestamp_epoch": "1533964909.174457000" }, { "tcp_stream": 466, "frame_number": 16466, "display_filter": "frame.number == 16466", "timestamp_epoch": "1533964909.174601000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1c964b2e7437cc190baeb13e", "type": "domain", "value": "f2.shared.global.fastly.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 279, "frame_number": 31673, "display_filter": "frame.number == 31673", "timestamp_epoch": "1533965100.796418000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-658b4ce6bf3e0568f425fc63", "type": "domain", "value": "fastlane-adv.rubiconproject.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 141, "frame_number": 13443, "display_filter": "frame.number == 13443", "timestamp_epoch": "1533964903.409461000" }, { "udp_stream": 141, "frame_number": 13494, "display_filter": "frame.number == 13494", "timestamp_epoch": "1533964903.481649000" }, { "tcp_stream": 349, "frame_number": 13560, "display_filter": "frame.number == 13560", "timestamp_epoch": "1533964903.549819000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ddecbd1fdb7799ecd88d52e5", "type": "domain", "value": "fo-fd-world-new.yax.gysm.yahoodns.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 81, "frame_number": 6113, "display_filter": "frame.number == 6113", "timestamp_epoch": "1533964559.840586000" }, { "udp_stream": 85, "frame_number": 6273, "display_filter": "frame.number == 6273", "timestamp_epoch": "1533964560.304978000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-86579a762a791beb58709c7b", "type": "domain", "value": "fonts.googleapis.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 41, "frame_number": 2269, "display_filter": "frame.number == 2269", "timestamp_epoch": "1533964549.231268000" }, { "udp_stream": 41, "frame_number": 2425, "display_filter": "frame.number == 2425", "timestamp_epoch": "1533964549.757857000" }, { "udp_stream": 354, "frame_number": 44597, "display_filter": "frame.number == 44597", "timestamp_epoch": "1533965785.837646000" }, { "udp_stream": 354, "frame_number": 44732, "display_filter": "frame.number == 44732", "timestamp_epoch": "1533965786.093172000" }, { "tcp_stream": 1190, "frame_number": 44836, "display_filter": "frame.number == 44836", "timestamp_epoch": "1533965786.409477000" }, { "tcp_stream": 1191, "frame_number": 44840, "display_filter": "frame.number == 44840", "timestamp_epoch": "1533965786.410078000" }, { "tcp_stream": 64, "frame_number": 2517, "display_filter": "frame.number == 2517", "timestamp_epoch": "1533964550.141655000" }, { "tcp_stream": 65, "frame_number": 2518, "display_filter": "frame.number == 2518", "timestamp_epoch": "1533964550.141657000" }, { "tcp_stream": 560, "frame_number": 19599, "display_filter": "frame.number == 19599", "timestamp_epoch": "1533964962.530305000" }, { "tcp_stream": 561, "frame_number": 19602, "display_filter": "frame.number == 19602", "timestamp_epoch": "1533964962.532060000" } ], "roles": [ "dns-query", "http-host", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-38d7323de0ab3caba05426f5", "type": "domain", "value": "fonts.gstatic.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 45, "frame_number": 3134, "display_filter": "frame.number == 3134", "timestamp_epoch": "1533964552.236123000" }, { "udp_stream": 45, "frame_number": 3196, "display_filter": "frame.number == 3196", "timestamp_epoch": "1533964552.405445000" }, { "udp_stream": 357, "frame_number": 45000, "display_filter": "frame.number == 45000", "timestamp_epoch": "1533965786.627493000" }, { "udp_stream": 357, "frame_number": 45116, "display_filter": "frame.number == 45116", "timestamp_epoch": "1533965786.910754000" }, { "tcp_stream": 1198, "frame_number": 45320, "display_filter": "frame.number == 45320", "timestamp_epoch": "1533965787.350306000" }, { "tcp_stream": 1197, "frame_number": 45321, "display_filter": "frame.number == 45321", "timestamp_epoch": "1533965787.350307000" }, { "tcp_stream": 74, "frame_number": 3264, "display_filter": "frame.number == 3264", "timestamp_epoch": "1533964552.477001000" }, { "tcp_stream": 75, "frame_number": 3266, "display_filter": "frame.number == 3266", "timestamp_epoch": "1533964552.477100000" }, { "tcp_stream": 73, "frame_number": 3267, "display_filter": "frame.number == 3267", "timestamp_epoch": "1533964552.477139000" }, { "tcp_stream": 129, "frame_number": 5477, "display_filter": "frame.number == 5477", "timestamp_epoch": "1533964556.949763000" } ], "roles": [ "dns-query", "http-host", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-eece0e6729adf5e30e6fe012", "type": "domain", "value": "g2.gumgum.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 145, "frame_number": 13493, "display_filter": "frame.number == 13493", "timestamp_epoch": "1533964903.481648000" }, { "udp_stream": 145, "frame_number": 13562, "display_filter": "frame.number == 13562", "timestamp_epoch": "1533964903.558314000" }, { "tcp_stream": 353, "frame_number": 13673, "display_filter": "frame.number == 13673", "timestamp_epoch": "1533964903.645216000" }, { "tcp_stream": 356, "frame_number": 13674, "display_filter": "frame.number == 13674", "timestamp_epoch": "1533964903.645497000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-bd2f38a015b83953b03d070e", "type": "domain", "value": "googleadapis.l.google.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 41, "frame_number": 2425, "display_filter": "frame.number == 2425", "timestamp_epoch": "1533964549.757857000" }, { "udp_stream": 140, "frame_number": 13400, "display_filter": "frame.number == 13400", "timestamp_epoch": "1533964903.310256000" }, { "udp_stream": 354, "frame_number": 44732, "display_filter": "frame.number == 44732", "timestamp_epoch": "1533965786.093172000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b46539f1c03a93270a904d89", "type": "domain", "value": "googleads.g.doubleclick.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 69, "frame_number": 5430, "display_filter": "frame.number == 5430", "timestamp_epoch": "1533964556.819517000" }, { "udp_stream": 69, "frame_number": 5441, "display_filter": "frame.number == 5441", "timestamp_epoch": "1533964556.880955000" }, { "udp_stream": 359, "frame_number": 45612, "display_filter": "frame.number == 45612", "timestamp_epoch": "1533965788.303184000" }, { "udp_stream": 359, "frame_number": 45830, "display_filter": "frame.number == 45830", "timestamp_epoch": "1533965789.081206000" }, { "tcp_stream": 131, "frame_number": 5484, "display_filter": "frame.number == 5484", "timestamp_epoch": "1533964556.953322000" }, { "tcp_stream": 130, "frame_number": 5489, "display_filter": "frame.number == 5489", "timestamp_epoch": "1533964556.954242000" }, { "tcp_stream": 247, "frame_number": 9665, "display_filter": "frame.number == 9665", "timestamp_epoch": "1533964899.587690000" }, { "tcp_stream": 246, "frame_number": 9674, "display_filter": "frame.number == 9674", "timestamp_epoch": "1533964899.588806000" }, { "tcp_stream": 252, "frame_number": 9694, "display_filter": "frame.number == 9694", "timestamp_epoch": "1533964899.600626000" }, { "tcp_stream": 251, "frame_number": 9710, "display_filter": "frame.number == 9710", "timestamp_epoch": "1533964899.602873000" }, { "tcp_stream": 268, "frame_number": 10385, "display_filter": "frame.number == 10385", "timestamp_epoch": "1533964900.268062000" }, { "tcp_stream": 904, "frame_number": 33061, "display_filter": "frame.number == 33061", "timestamp_epoch": "1533965136.994395000" }, { "tcp_stream": 905, "frame_number": 33063, "display_filter": "frame.number == 33063", "timestamp_epoch": "1533965136.995440000" }, { "tcp_stream": 914, "frame_number": 33252, "display_filter": "frame.number == 33252", "timestamp_epoch": "1533965137.379124000" }, { "tcp_stream": 1009, "frame_number": 38925, "display_filter": "frame.number == 38925", "timestamp_epoch": "1533965240.537262000" }, { "tcp_stream": 1010, "frame_number": 38933, "display_filter": "frame.number == 38933", "timestamp_epoch": "1533965240.538141000" }, { "tcp_stream": 1206, "frame_number": 45901, "display_filter": "frame.number == 45901", "timestamp_epoch": "1533965789.195222000" }, { "tcp_stream": 1205, "frame_number": 45903, "display_filter": "frame.number == 45903", "timestamp_epoch": "1533965789.195689000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1b26b832fe1e9f183525ec02", "type": "domain", "value": "googleads4.g.doubleclick.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 126, "frame_number": 11738, "display_filter": "frame.number == 11738", "timestamp_epoch": "1533964901.548766000" }, { "udp_stream": 126, "frame_number": 11931, "display_filter": "frame.number == 11931", "timestamp_epoch": "1533964901.698739000" }, { "tcp_stream": 309, "frame_number": 11970, "display_filter": "frame.number == 11970", "timestamp_epoch": "1533964901.775522000" }, { "tcp_stream": 310, "frame_number": 11971, "display_filter": "frame.number == 11971", "timestamp_epoch": "1533964901.775654000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b09ed558f364542f73f3dd3a", "type": "domain", "value": "googleapis.l.google.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 30, "frame_number": 611, "display_filter": "frame.number == 611", "timestamp_epoch": "1533964545.651017000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-349ba8af8e4678c63ef80e72", "type": "domain", "value": "gstaticadssl.l.google.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 45, "frame_number": 3196, "display_filter": "frame.number == 3196", "timestamp_epoch": "1533964552.405445000" }, { "udp_stream": 357, "frame_number": 45116, "display_filter": "frame.number == 45116", "timestamp_epoch": "1533965786.910754000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5223a166b2911bd817f53dfa", "type": "domain", "value": "hb-api-usa02.omnitagjs.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 146, "frame_number": 13566, "display_filter": "frame.number == 13566", "timestamp_epoch": "1533964903.560435000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-65b759360ae29738d045a03a", "type": "domain", "value": "hb-api.omnitagjs.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 146, "frame_number": 13502, "display_filter": "frame.number == 13502", "timestamp_epoch": "1533964903.485569000" }, { "udp_stream": 146, "frame_number": 13566, "display_filter": "frame.number == 13566", "timestamp_epoch": "1533964903.560435000" }, { "tcp_stream": 357, "frame_number": 13770, "display_filter": "frame.number == 13770", "timestamp_epoch": "1533964903.717409000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-514fe42a5d35ec702e480d03", "type": "domain", "value": "hbevents.1rx.io", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 162, "frame_number": 15389, "display_filter": "frame.number == 15389", "timestamp_epoch": "1533964906.550970000" }, { "udp_stream": 162, "frame_number": 15556, "display_filter": "frame.number == 15556", "timestamp_epoch": "1533964906.746311000" }, { "tcp_stream": 425, "frame_number": 15602, "display_filter": "frame.number == 15602", "timestamp_epoch": "1533964906.851735000" }, { "tcp_stream": 426, "frame_number": 15603, "display_filter": "frame.number == 15603", "timestamp_epoch": "1533964906.851959000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b33a85bc3e0787a16f8d4549", "type": "domain", "value": "i.w55c.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 156, "frame_number": 14568, "display_filter": "frame.number == 14568", "timestamp_epoch": "1533964904.596445000" }, { "udp_stream": 156, "frame_number": 14613, "display_filter": "frame.number == 14613", "timestamp_epoch": "1533964904.637787000" }, { "tcp_stream": 398, "frame_number": 14728, "display_filter": "frame.number == 14728", "timestamp_epoch": "1533964904.713278000" }, { "tcp_stream": 397, "frame_number": 14729, "display_filter": "frame.number == 14729", "timestamp_epoch": "1533964904.713386000" }, { "tcp_stream": 631, "frame_number": 23315, "display_filter": "frame.number == 23315", "timestamp_epoch": "1533964997.317123000" }, { "tcp_stream": 630, "frame_number": 23316, "display_filter": "frame.number == 23316", "timestamp_epoch": "1533964997.317150000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a2ed7083552acda83b518aaf", "type": "domain", "value": "i.ytimg.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 71, "frame_number": 5681, "display_filter": "frame.number == 5681", "timestamp_epoch": "1533964558.620590000" }, { "udp_stream": 71, "frame_number": 5698, "display_filter": "frame.number == 5698", "timestamp_epoch": "1533964558.771373000" }, { "tcp_stream": 135, "frame_number": 5705, "display_filter": "frame.number == 5705", "timestamp_epoch": "1533964558.825936000" }, { "tcp_stream": 134, "frame_number": 5707, "display_filter": "frame.number == 5707", "timestamp_epoch": "1533964558.827148000" }, { "tcp_stream": 282, "frame_number": 10697, "display_filter": "frame.number == 10697", "timestamp_epoch": "1533964900.710385000" }, { "tcp_stream": 283, "frame_number": 10699, "display_filter": "frame.number == 10699", "timestamp_epoch": "1533964900.710596000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-89c54be412aee44309eb93a3", "type": "domain", "value": "ib.adnxs.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 100, "frame_number": 8912, "display_filter": "frame.number == 8912", "timestamp_epoch": "1533964898.855179000" }, { "udp_stream": 100, "frame_number": 8956, "display_filter": "frame.number == 8956", "timestamp_epoch": "1533964898.930148000" }, { "tcp_stream": 235, "frame_number": 9015, "display_filter": "frame.number == 9015", "timestamp_epoch": "1533964898.995291000" }, { "tcp_stream": 232, "frame_number": 9029, "display_filter": "frame.number == 9029", "timestamp_epoch": "1533964898.996896000" }, { "tcp_stream": 524, "frame_number": 18640, "display_filter": "frame.number == 18640", "timestamp_epoch": "1533964959.508962000" }, { "tcp_stream": 523, "frame_number": 18646, "display_filter": "frame.number == 18646", "timestamp_epoch": "1533964959.510081000" }, { "tcp_stream": 534, "frame_number": 18749, "display_filter": "frame.number == 18749", "timestamp_epoch": "1533964959.984935000" }, { "tcp_stream": 533, "frame_number": 18750, "display_filter": "frame.number == 18750", "timestamp_epoch": "1533964959.985057000" }, { "tcp_stream": 602, "frame_number": 21957, "display_filter": "frame.number == 21957", "timestamp_epoch": "1533964980.047151000" }, { "tcp_stream": 601, "frame_number": 21958, "display_filter": "frame.number == 21958", "timestamp_epoch": "1533964980.047155000" }, { "tcp_stream": 626, "frame_number": 23283, "display_filter": "frame.number == 23283", "timestamp_epoch": "1533964997.231021000" }, { "tcp_stream": 627, "frame_number": 23285, "display_filter": "frame.number == 23285", "timestamp_epoch": "1533964997.231199000" }, { "tcp_stream": 680, "frame_number": 24416, "display_filter": "frame.number == 24416", "timestamp_epoch": "1533965015.155537000" }, { "tcp_stream": 679, "frame_number": 24418, "display_filter": "frame.number == 24418", "timestamp_epoch": "1533965015.155692000" }, { "tcp_stream": 729, "frame_number": 27185, "display_filter": "frame.number == 27185", "timestamp_epoch": "1533965034.923961000" }, { "tcp_stream": 730, "frame_number": 27186, "display_filter": "frame.number == 27186", "timestamp_epoch": "1533965034.924117000" }, { "tcp_stream": 733, "frame_number": 27212, "display_filter": "frame.number == 27212", "timestamp_epoch": "1533965034.983960000" }, { "tcp_stream": 778, "frame_number": 28211, "display_filter": "frame.number == 28211", "timestamp_epoch": "1533965055.159104000" }, { "tcp_stream": 777, "frame_number": 28213, "display_filter": "frame.number == 28213", "timestamp_epoch": "1533965055.159396000" }, { "tcp_stream": 780, "frame_number": 28461, "display_filter": "frame.number == 28461", "timestamp_epoch": "1533965075.835447000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5145251affaaf1b062a1eb95", "type": "domain", "value": "id.rlcdn.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 150, "frame_number": 14516, "display_filter": "frame.number == 14516", "timestamp_epoch": "1533964904.554032000" }, { "udp_stream": 150, "frame_number": 14614, "display_filter": "frame.number == 14614", "timestamp_epoch": "1533964904.637907000" }, { "tcp_stream": 396, "frame_number": 14725, "display_filter": "frame.number == 14725", "timestamp_epoch": "1533964904.712726000" }, { "tcp_stream": 395, "frame_number": 14726, "display_filter": "frame.number == 14726", "timestamp_epoch": "1533964904.712920000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1375f5fd187dd6cce6d501b9", "type": "domain", "value": "idpix.media6degrees.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 192, "frame_number": 18474, "display_filter": "frame.number == 18474", "timestamp_epoch": "1533964959.055539000" }, { "udp_stream": 192, "frame_number": 18626, "display_filter": "frame.number == 18626", "timestamp_epoch": "1533964959.502753000" }, { "tcp_stream": 530, "frame_number": 18738, "display_filter": "frame.number == 18738", "timestamp_epoch": "1533964959.945476000" }, { "tcp_stream": 529, "frame_number": 18740, "display_filter": "frame.number == 18740", "timestamp_epoch": "1533964959.945828000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f7a0961eb7f7f7a37f03ab3e", "type": "domain", "value": "idsync-ext-weight-2.rlcdn.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 190, "frame_number": 18568, "display_filter": "frame.number == 18568", "timestamp_epoch": "1533964959.365164000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7dd1dfd5662aa187f805d9d0", "type": "domain", "value": "idsync.rlcdn.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 190, "frame_number": 18440, "display_filter": "frame.number == 18440", "timestamp_epoch": "1533964959.043665000" }, { "udp_stream": 190, "frame_number": 18568, "display_filter": "frame.number == 18568", "timestamp_epoch": "1533964959.365164000" }, { "tcp_stream": 526, "frame_number": 18695, "display_filter": "frame.number == 18695", "timestamp_epoch": "1533964959.750246000" }, { "tcp_stream": 525, "frame_number": 18696, "display_filter": "frame.number == 18696", "timestamp_epoch": "1533964959.750247000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e3ddf83be5fed8b14c4f0529", "type": "domain", "value": "iecvlist.microsoft.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 86, "frame_number": 6512, "display_filter": "frame.number == 6512", "timestamp_epoch": "1533964574.365606000" }, { "udp_stream": 86, "frame_number": 6513, "display_filter": "frame.number == 6513", "timestamp_epoch": "1533964574.365861000" }, { "udp_stream": 366, "frame_number": 46918, "display_filter": "frame.number == 46918", "timestamp_epoch": "1533965798.576687000" }, { "udp_stream": 366, "frame_number": 46919, "display_filter": "frame.number == 46919", "timestamp_epoch": "1533965798.750795000" }, { "tcp_stream": 165, "frame_number": 6520, "display_filter": "frame.number == 6520", "timestamp_epoch": "1533964574.443493000" }, { "tcp_stream": 164, "frame_number": 6522, "display_filter": "frame.number == 6522", "timestamp_epoch": "1533964574.443681000" }, { "tcp_stream": 1230, "frame_number": 46926, "display_filter": "frame.number == 46926", "timestamp_epoch": "1533965798.889723000" }, { "tcp_stream": 1229, "frame_number": 46927, "display_filter": "frame.number == 46927", "timestamp_epoch": "1533965798.889852000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-97e45d9ecdbff80ce6d5aa31", "type": "domain", "value": "image2.pubmatic.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 128, "frame_number": 11954, "display_filter": "frame.number == 11954", "timestamp_epoch": "1533964901.706900000" }, { "udp_stream": 128, "frame_number": 11978, "display_filter": "frame.number == 11978", "timestamp_epoch": "1533964901.783846000" }, { "tcp_stream": 314, "frame_number": 12042, "display_filter": "frame.number == 12042", "timestamp_epoch": "1533964901.843881000" }, { "tcp_stream": 315, "frame_number": 12044, "display_filter": "frame.number == 12044", "timestamp_epoch": "1533964901.844190000" }, { "tcp_stream": 697, "frame_number": 26444, "display_filter": "frame.number == 26444", "timestamp_epoch": "1533965032.721529000" }, { "tcp_stream": 696, "frame_number": 26449, "display_filter": "frame.number == 26449", "timestamp_epoch": "1533965032.722110000" }, { "tcp_stream": 875, "frame_number": 32100, "display_filter": "frame.number == 32100", "timestamp_epoch": "1533965101.564817000" }, { "tcp_stream": 874, "frame_number": 32102, "display_filter": "frame.number == 32102", "timestamp_epoch": "1533965101.569346000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-86d83f83c0069987d4c0d1bb", "type": "domain", "value": "image4.pubmatic.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 171, "frame_number": 16362, "display_filter": "frame.number == 16362", "timestamp_epoch": "1533964908.826784000" }, { "udp_stream": 171, "frame_number": 16389, "display_filter": "frame.number == 16389", "timestamp_epoch": "1533964908.885044000" }, { "tcp_stream": 463, "frame_number": 16412, "display_filter": "frame.number == 16412", "timestamp_epoch": "1533964908.961212000" }, { "tcp_stream": 464, "frame_number": 16413, "display_filter": "frame.number == 16413", "timestamp_epoch": "1533964908.961417000" }, { "tcp_stream": 948, "frame_number": 34889, "display_filter": "frame.number == 34889", "timestamp_epoch": "1533965159.091676000" }, { "tcp_stream": 949, "frame_number": 34891, "display_filter": "frame.number == 34891", "timestamp_epoch": "1533965159.091883000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7a395a985e651af891743b2d", "type": "domain", "value": "image6.pubmatic.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 165, "frame_number": 15919, "display_filter": "frame.number == 15919", "timestamp_epoch": "1533964907.947302000" }, { "udp_stream": 165, "frame_number": 15930, "display_filter": "frame.number == 15930", "timestamp_epoch": "1533964908.051426000" }, { "tcp_stream": 437, "frame_number": 15937, "display_filter": "frame.number == 15937", "timestamp_epoch": "1533964908.117624000" }, { "tcp_stream": 438, "frame_number": 15938, "display_filter": "frame.number == 15938", "timestamp_epoch": "1533964908.117625000" }, { "tcp_stream": 808, "frame_number": 29818, "display_filter": "frame.number == 29818", "timestamp_epoch": "1533965097.616749000" }, { "tcp_stream": 809, "frame_number": 29835, "display_filter": "frame.number == 29835", "timestamp_epoch": "1533965097.623442000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e96bd415eef27a6b07ef4c69", "type": "domain", "value": "images.outbrainimg.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 147, "frame_number": 13640, "display_filter": "frame.number == 13640", "timestamp_epoch": "1533964903.629499000" }, { "udp_stream": 147, "frame_number": 13794, "display_filter": "frame.number == 13794", "timestamp_epoch": "1533964903.730026000" }, { "tcp_stream": 363, "frame_number": 13925, "display_filter": "frame.number == 13925", "timestamp_epoch": "1533964903.796988000" }, { "tcp_stream": 362, "frame_number": 13929, "display_filter": "frame.number == 13929", "timestamp_epoch": "1533964903.798419000" }, { "tcp_stream": 364, "frame_number": 13938, "display_filter": "frame.number == 13938", "timestamp_epoch": "1533964903.810237000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-57df2292eaf71c1c9f231364", "type": "domain", "value": "images9.engageya.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 110, "frame_number": 10576, "display_filter": "frame.number == 10576", "timestamp_epoch": "1533964900.522209000" }, { "udp_stream": 110, "frame_number": 10626, "display_filter": "frame.number == 10626", "timestamp_epoch": "1533964900.625516000" }, { "tcp_stream": 275, "frame_number": 10651, "display_filter": "frame.number == 10651", "timestamp_epoch": "1533964900.685939000" }, { "tcp_stream": 279, "frame_number": 10657, "display_filter": "frame.number == 10657", "timestamp_epoch": "1533964900.688301000" }, { "tcp_stream": 276, "frame_number": 10659, "display_filter": "frame.number == 10659", "timestamp_epoch": "1533964900.688509000" }, { "tcp_stream": 278, "frame_number": 10661, "display_filter": "frame.number == 10661", "timestamp_epoch": "1533964900.688758000" }, { "tcp_stream": 277, "frame_number": 10663, "display_filter": "frame.number == 10663", "timestamp_epoch": "1533964900.688850000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8e23daf2a60b8358a3ec4c2b", "type": "domain", "value": "imasdk.googleapis.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 140, "frame_number": 13322, "display_filter": "frame.number == 13322", "timestamp_epoch": "1533964903.228307000" }, { "udp_stream": 140, "frame_number": 13400, "display_filter": "frame.number == 13400", "timestamp_epoch": "1533964903.310256000" }, { "tcp_stream": 344, "frame_number": 13439, "display_filter": "frame.number == 13439", "timestamp_epoch": "1533964903.380407000" }, { "tcp_stream": 343, "frame_number": 13441, "display_filter": "frame.number == 13441", "timestamp_epoch": "1533964903.383586000" }, { "tcp_stream": 495, "frame_number": 17509, "display_filter": "frame.number == 17509", "timestamp_epoch": "1533964956.619349000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7f65675196997f6bd9df7e6a", "type": "domain", "value": "isatap.localdomain", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 3, "frame_number": 6, "display_filter": "frame.number == 6", "timestamp_epoch": "1533964508.833900000" }, { "udp_stream": 3, "frame_number": 7, "display_filter": "frame.number == 7", "timestamp_epoch": "1533964508.834117000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-73767dc6c15c5c6af99169e2", "type": "domain", "value": "jadserve.postrelease.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 262, "frame_number": 27306, "display_filter": "frame.number == 27306", "timestamp_epoch": "1533965035.354027000" }, { "udp_stream": 262, "frame_number": 27340, "display_filter": "frame.number == 27340", "timestamp_epoch": "1533965035.445360000" }, { "tcp_stream": 745, "frame_number": 27389, "display_filter": "frame.number == 27389", "timestamp_epoch": "1533965035.528115000" }, { "tcp_stream": 746, "frame_number": 27390, "display_filter": "frame.number == 27390", "timestamp_epoch": "1533965035.528277000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-af825af7e0b2aad0ea5d230a", "type": "domain", "value": "jadserve.postrelease.com.akadns.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 262, "frame_number": 27340, "display_filter": "frame.number == 27340", "timestamp_epoch": "1533965035.445360000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e7629a85258e6d7181e0b5ca", "type": "domain", "value": "launcher.spot.im", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 90, "frame_number": 7484, "display_filter": "frame.number == 7484", "timestamp_epoch": "1533964897.219566000" }, { "udp_stream": 90, "frame_number": 7515, "display_filter": "frame.number == 7515", "timestamp_epoch": "1533964897.312123000" }, { "tcp_stream": 195, "frame_number": 7552, "display_filter": "frame.number == 7552", "timestamp_epoch": "1533964897.403131000" }, { "tcp_stream": 194, "frame_number": 7554, "display_filter": "frame.number == 7554", "timestamp_epoch": "1533964897.403225000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0119b6813c2ffccdb1512e66", "type": "domain", "value": "lax1-ib.adnxs.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 202, "frame_number": 19273, "display_filter": "frame.number == 19273", "timestamp_epoch": "1533964961.687478000" }, { "udp_stream": 202, "frame_number": 19300, "display_filter": "frame.number == 19300", "timestamp_epoch": "1533964961.756585000" }, { "tcp_stream": 552, "frame_number": 19336, "display_filter": "frame.number == 19336", "timestamp_epoch": "1533964961.815273000" }, { "tcp_stream": 553, "frame_number": 19342, "display_filter": "frame.number == 19342", "timestamp_epoch": "1533964961.831082000" }, { "tcp_stream": 604, "frame_number": 22871, "display_filter": "frame.number == 22871", "timestamp_epoch": "1533964994.530205000" }, { "tcp_stream": 605, "frame_number": 22875, "display_filter": "frame.number == 22875", "timestamp_epoch": "1533964994.535341000" }, { "tcp_stream": 686, "frame_number": 26228, "display_filter": "frame.number == 26228", "timestamp_epoch": "1533965030.656483000" }, { "tcp_stream": 687, "frame_number": 26229, "display_filter": "frame.number == 26229", "timestamp_epoch": "1533965030.656484000" }, { "tcp_stream": 790, "frame_number": 28758, "display_filter": "frame.number == 28758", "timestamp_epoch": "1533965094.736269000" }, { "tcp_stream": 791, "frame_number": 28761, "display_filter": "frame.number == 28761", "timestamp_epoch": "1533965094.736604000" }, { "tcp_stream": 925, "frame_number": 33597, "display_filter": "frame.number == 33597", "timestamp_epoch": "1533965155.480314000" }, { "tcp_stream": 924, "frame_number": 33601, "display_filter": "frame.number == 33601", "timestamp_epoch": "1533965155.481900000" }, { "tcp_stream": 1029, "frame_number": 39311, "display_filter": "frame.number == 39311", "timestamp_epoch": "1533965246.774368000" }, { "tcp_stream": 1028, "frame_number": 39313, "display_filter": "frame.number == 39313", "timestamp_epoch": "1533965246.774457000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-dcb34b89c642f47f20d50613", "type": "domain", "value": "load77.exelator.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 221, "frame_number": 20905, "display_filter": "frame.number == 20905", "timestamp_epoch": "1533964966.935817000" }, { "udp_stream": 221, "frame_number": 21150, "display_filter": "frame.number == 21150", "timestamp_epoch": "1533964967.906377000" }, { "tcp_stream": 600, "frame_number": 21428, "display_filter": "frame.number == 21428", "timestamp_epoch": "1533964968.672694000" }, { "tcp_stream": 599, "frame_number": 21430, "display_filter": "frame.number == 21430", "timestamp_epoch": "1533964968.673327000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-da4d673ee98ecb9679f298a8", "type": "domain", "value": "loadm.exelator.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 216, "frame_number": 20180, "display_filter": "frame.number == 20180", "timestamp_epoch": "1533964964.890981000" }, { "udp_stream": 216, "frame_number": 20234, "display_filter": "frame.number == 20234", "timestamp_epoch": "1533964965.013702000" }, { "tcp_stream": 591, "frame_number": 20299, "display_filter": "frame.number == 20299", "timestamp_epoch": "1533964965.249476000" }, { "tcp_stream": 592, "frame_number": 20300, "display_filter": "frame.number == 20300", "timestamp_epoch": "1533964965.249688000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f159deab208209c078c32e02", "type": "domain", "value": "m.adnxs.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 210, "frame_number": 19905, "display_filter": "frame.number == 19905", "timestamp_epoch": "1533964963.453564000" }, { "udp_stream": 210, "frame_number": 19910, "display_filter": "frame.number == 19910", "timestamp_epoch": "1533964963.540458000" }, { "tcp_stream": 573, "frame_number": 19919, "display_filter": "frame.number == 19919", "timestamp_epoch": "1533964963.590918000" }, { "tcp_stream": 572, "frame_number": 19920, "display_filter": "frame.number == 19920", "timestamp_epoch": "1533964963.591094000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6336d79044375aad2294587a", "type": "domain", "value": "magnetic.t.domdex.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 154, "frame_number": 14564, "display_filter": "frame.number == 14564", "timestamp_epoch": "1533964904.594862000" }, { "udp_stream": 154, "frame_number": 14640, "display_filter": "frame.number == 14640", "timestamp_epoch": "1533964904.663956000" }, { "udp_stream": 364, "frame_number": 46027, "display_filter": "frame.number == 46027", "timestamp_epoch": "1533965789.539672000" }, { "udp_stream": 364, "frame_number": 46080, "display_filter": "frame.number == 46080", "timestamp_epoch": "1533965789.714227000" }, { "tcp_stream": 402, "frame_number": 14742, "display_filter": "frame.number == 14742", "timestamp_epoch": "1533964904.728998000" }, { "tcp_stream": 401, "frame_number": 14744, "display_filter": "frame.number == 14744", "timestamp_epoch": "1533964904.729235000" }, { "tcp_stream": 613, "frame_number": 23022, "display_filter": "frame.number == 23022", "timestamp_epoch": "1533964996.447720000" }, { "tcp_stream": 612, "frame_number": 23025, "display_filter": "frame.number == 23025", "timestamp_epoch": "1533964996.448180000" }, { "tcp_stream": 813, "frame_number": 30621, "display_filter": "frame.number == 30621", "timestamp_epoch": "1533965099.024703000" }, { "tcp_stream": 812, "frame_number": 30623, "display_filter": "frame.number == 30623", "timestamp_epoch": "1533965099.024779000" }, { "tcp_stream": 1220, "frame_number": 46125, "display_filter": "frame.number == 46125", "timestamp_epoch": "1533965789.789220000" }, { "tcp_stream": 1221, "frame_number": 46126, "display_filter": "frame.number == 46126", "timestamp_epoch": "1533965789.789332000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-74bedc0e2316ce1a8d1e7df9", "type": "domain", "value": "match-243508202.us-west-2.elb.amazonaws.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 65, "frame_number": 5141, "display_filter": "frame.number == 5141", "timestamp_epoch": "1533964556.025527000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-359f394d8016d5670c1f3e7a", "type": "domain", "value": "match-us-east-1.sharethrough.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 280, "frame_number": 31704, "display_filter": "frame.number == 31704", "timestamp_epoch": "1533965100.817951000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-eb53093dcd92781a0e540110", "type": "domain", "value": "match.adsrvr.org", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 65, "frame_number": 5080, "display_filter": "frame.number == 5080", "timestamp_epoch": "1533964555.922018000" }, { "udp_stream": 65, "frame_number": 5141, "display_filter": "frame.number == 5141", "timestamp_epoch": "1533964556.025527000" }, { "tcp_stream": 120, "frame_number": 5245, "display_filter": "frame.number == 5245", "timestamp_epoch": "1533964556.112608000" }, { "tcp_stream": 119, "frame_number": 5246, "display_filter": "frame.number == 5246", "timestamp_epoch": "1533964556.112610000" }, { "tcp_stream": 444, "frame_number": 16022, "display_filter": "frame.number == 16022", "timestamp_epoch": "1533964908.405170000" }, { "tcp_stream": 443, "frame_number": 16026, "display_filter": "frame.number == 16026", "timestamp_epoch": "1533964908.405722000" }, { "tcp_stream": 805, "frame_number": 29830, "display_filter": "frame.number == 29830", "timestamp_epoch": "1533965097.622965000" }, { "tcp_stream": 804, "frame_number": 29833, "display_filter": "frame.number == 29833", "timestamp_epoch": "1533965097.623193000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-88f77ee88a86b19f6eaad083", "type": "domain", "value": "match.basebanner.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 191, "frame_number": 18461, "display_filter": "frame.number == 18461", "timestamp_epoch": "1533964959.050612000" }, { "udp_stream": 191, "frame_number": 18574, "display_filter": "frame.number == 18574", "timestamp_epoch": "1533964959.368247000" }, { "tcp_stream": 527, "frame_number": 18677, "display_filter": "frame.number == 18677", "timestamp_epoch": "1533964959.691383000" }, { "tcp_stream": 528, "frame_number": 18685, "display_filter": "frame.number == 18685", "timestamp_epoch": "1533964959.704203000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7d0bd35cd5022e15a011493d", "type": "domain", "value": "match.bnmla.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 278, "frame_number": 30496, "display_filter": "frame.number == 30496", "timestamp_epoch": "1533965098.787226000" }, { "udp_stream": 278, "frame_number": 30782, "display_filter": "frame.number == 30782", "timestamp_epoch": "1533965099.269249000" }, { "tcp_stream": 836, "frame_number": 31209, "display_filter": "frame.number == 31209", "timestamp_epoch": "1533965100.029072000" }, { "tcp_stream": 837, "frame_number": 31211, "display_filter": "frame.number == 31211", "timestamp_epoch": "1533965100.029197000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f41c4713ec6474ceb8ec1e60", "type": "domain", "value": "match.prod.bidr.io", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 244, "frame_number": 26359, "display_filter": "frame.number == 26359", "timestamp_epoch": "1533965032.570113000" }, { "udp_stream": 244, "frame_number": 26411, "display_filter": "frame.number == 26411", "timestamp_epoch": "1533965032.677118000" }, { "tcp_stream": 699, "frame_number": 26470, "display_filter": "frame.number == 26470", "timestamp_epoch": "1533965032.792962000" }, { "tcp_stream": 698, "frame_number": 26472, "display_filter": "frame.number == 26472", "timestamp_epoch": "1533965032.793141000" }, { "tcp_stream": 956, "frame_number": 35547, "display_filter": "frame.number == 35547", "timestamp_epoch": "1533965160.371639000" }, { "tcp_stream": 957, "frame_number": 35548, "display_filter": "frame.number == 35548", "timestamp_epoch": "1533965160.371822000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-04a87f3a5336e92f3c7df38f", "type": "domain", "value": "match.rundsp.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 277, "frame_number": 30493, "display_filter": "frame.number == 30493", "timestamp_epoch": "1533965098.783956000" }, { "udp_stream": 277, "frame_number": 30810, "display_filter": "frame.number == 30810", "timestamp_epoch": "1533965099.289135000" }, { "tcp_stream": 840, "frame_number": 31175, "display_filter": "frame.number == 31175", "timestamp_epoch": "1533965100.006057000" }, { "tcp_stream": 841, "frame_number": 31192, "display_filter": "frame.number == 31192", "timestamp_epoch": "1533965100.009068000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-adf208c36a5d05a6594f3a86", "type": "domain", "value": "match.sharethrough.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 280, "frame_number": 31606, "display_filter": "frame.number == 31606", "timestamp_epoch": "1533965100.694552000" }, { "udp_stream": 280, "frame_number": 31704, "display_filter": "frame.number == 31704", "timestamp_epoch": "1533965100.817951000" }, { "tcp_stream": 871, "frame_number": 31846, "display_filter": "frame.number == 31846", "timestamp_epoch": "1533965101.016609000" }, { "tcp_stream": 870, "frame_number": 31847, "display_filter": "frame.number == 31847", "timestamp_epoch": "1533965101.016612000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3753d237f7a2c54466a3efa6", "type": "domain", "value": "match.taboola.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 287, "frame_number": 32116, "display_filter": "frame.number == 32116", "timestamp_epoch": "1533965101.584554000" }, { "udp_stream": 287, "frame_number": 32144, "display_filter": "frame.number == 32144", "timestamp_epoch": "1533965101.694508000" }, { "tcp_stream": 876, "frame_number": 32170, "display_filter": "frame.number == 32170", "timestamp_epoch": "1533965101.852145000" }, { "tcp_stream": 877, "frame_number": 32174, "display_filter": "frame.number == 32174", "timestamp_epoch": "1533965101.879907000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-09c49e3a6fe2b30ae2ee8c37", "type": "domain", "value": "matchuswest-922949909.us-west-1.elb.amazonaws.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 277, "frame_number": 30810, "display_filter": "frame.number == 30810", "timestamp_epoch": "1533965099.289135000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-28d9eb110d5f47f41712aebf", "type": "domain", "value": "mc.yandex.ru", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 52, "frame_number": 3216, "display_filter": "frame.number == 3216", "timestamp_epoch": "1533964552.432630000" }, { "udp_stream": 52, "frame_number": 3310, "display_filter": "frame.number == 3310", "timestamp_epoch": "1533964552.683616000" }, { "udp_stream": 344, "frame_number": 43677, "display_filter": "frame.number == 43677", "timestamp_epoch": "1533965783.159102000" }, { "udp_stream": 344, "frame_number": 43729, "display_filter": "frame.number == 43729", "timestamp_epoch": "1533965783.276443000" }, { "tcp_stream": 87, "frame_number": 3558, "display_filter": "frame.number == 3558", "timestamp_epoch": "1533964552.967445000" }, { "tcp_stream": 86, "frame_number": 3561, "display_filter": "frame.number == 3561", "timestamp_epoch": "1533964552.967829000" }, { "tcp_stream": 184, "frame_number": 7420, "display_filter": "frame.number == 7420", "timestamp_epoch": "1533964896.798333000" }, { "tcp_stream": 185, "frame_number": 7422, "display_filter": "frame.number == 7422", "timestamp_epoch": "1533964896.798517000" }, { "tcp_stream": 1153, "frame_number": 43935, "display_filter": "frame.number == 43935", "timestamp_epoch": "1533965783.795303000" }, { "tcp_stream": 1154, "frame_number": 43937, "display_filter": "frame.number == 43937", "timestamp_epoch": "1533965783.795464000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-12942ee8a3001f755940b2ea", "type": "domain", "value": "melia.sp1.convertro.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 205, "frame_number": 19606, "display_filter": "frame.number == 19606", "timestamp_epoch": "1533964962.543898000" }, { "udp_stream": 205, "frame_number": 19619, "display_filter": "frame.number == 19619", "timestamp_epoch": "1533964962.605621000" }, { "tcp_stream": 563, "frame_number": 19632, "display_filter": "frame.number == 19632", "timestamp_epoch": "1533964962.734007000" }, { "tcp_stream": 562, "frame_number": 19633, "display_filter": "frame.number == 19633", "timestamp_epoch": "1533964962.734030000" }, { "tcp_stream": 760, "frame_number": 27686, "display_filter": "frame.number == 27686", "timestamp_epoch": "1533965035.849773000" }, { "tcp_stream": 761, "frame_number": 27687, "display_filter": "frame.number == 27687", "timestamp_epoch": "1533965035.849996000" }, { "tcp_stream": 973, "frame_number": 35831, "display_filter": "frame.number == 35831", "timestamp_epoch": "1533965160.970333000" }, { "tcp_stream": 972, "frame_number": 35832, "display_filter": "frame.number == 35832", "timestamp_epoch": "1533965160.970589000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c311fbc6050e92138c0fbee1", "type": "domain", "value": "mixi.media", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 91, "frame_number": 7800, "display_filter": "frame.number == 7800", "timestamp_epoch": "1533964897.662014000" }, { "udp_stream": 91, "frame_number": 8116, "display_filter": "frame.number == 8116", "timestamp_epoch": "1533964897.941119000" }, { "tcp_stream": 205, "frame_number": 8405, "display_filter": "frame.number == 8405", "timestamp_epoch": "1533964898.230941000" }, { "tcp_stream": 204, "frame_number": 8421, "display_filter": "frame.number == 8421", "timestamp_epoch": "1533964898.251259000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0c7cc89688ed279ae185f0b8", "type": "domain", "value": "mixi1-1.s1.mixi.space", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 103, "frame_number": 9470, "display_filter": "frame.number == 9470", "timestamp_epoch": "1533964899.377567000" }, { "udp_stream": 104, "frame_number": 9471, "display_filter": "frame.number == 9471", "timestamp_epoch": "1533964899.377655000" }, { "udp_stream": 131, "frame_number": 12208, "display_filter": "frame.number == 12208", "timestamp_epoch": "1533964901.980409000" }, { "udp_stream": 130, "frame_number": 12212, "display_filter": "frame.number == 12212", "timestamp_epoch": "1533964901.981250000" }, { "udp_stream": 134, "frame_number": 12763, "display_filter": "frame.number == 12763", "timestamp_epoch": "1533964902.706045000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-93946d4a7081431aa283a3c3", "type": "domain", "value": "ml314.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 215, "frame_number": 20177, "display_filter": "frame.number == 20177", "timestamp_epoch": "1533964964.882716000" }, { "udp_stream": 215, "frame_number": 20229, "display_filter": "frame.number == 20229", "timestamp_epoch": "1533964965.012616000" }, { "tcp_stream": 589, "frame_number": 20302, "display_filter": "frame.number == 20302", "timestamp_epoch": "1533964965.250141000" }, { "tcp_stream": 590, "frame_number": 20343, "display_filter": "frame.number == 20343", "timestamp_epoch": "1533964965.302580000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b819e7d36432906e1cf8cf51", "type": "domain", "value": "mm.melia.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 200, "frame_number": 19245, "display_filter": "frame.number == 19245", "timestamp_epoch": "1533964961.545252000" }, { "udp_stream": 200, "frame_number": 19258, "display_filter": "frame.number == 19258", "timestamp_epoch": "1533964961.633523000" }, { "tcp_stream": 550, "frame_number": 19358, "display_filter": "frame.number == 19358", "timestamp_epoch": "1533964961.845258000" }, { "tcp_stream": 551, "frame_number": 19359, "display_filter": "frame.number == 19359", "timestamp_epoch": "1533964961.845259000" }, { "tcp_stream": 727, "frame_number": 27200, "display_filter": "frame.number == 27200", "timestamp_epoch": "1533965034.944923000" }, { "tcp_stream": 728, "frame_number": 27202, "display_filter": "frame.number == 27202", "timestamp_epoch": "1533965034.944925000" }, { "tcp_stream": 950, "frame_number": 35467, "display_filter": "frame.number == 35467", "timestamp_epoch": "1533965160.181369000" }, { "tcp_stream": 951, "frame_number": 35471, "display_filter": "frame.number == 35471", "timestamp_epoch": "1533965160.192710000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1aeb95bd8b22199bf627019f", "type": "domain", "value": "na-eb2.3lift.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 259, "frame_number": 27332, "display_filter": "frame.number == 27332", "timestamp_epoch": "1533965035.434545000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-534e5322c4e3bf3e9c43e998", "type": "domain", "value": "net.finam.ru", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 123, "frame_number": 11426, "display_filter": "frame.number == 11426", "timestamp_epoch": "1533964901.269111000" }, { "udp_stream": 123, "frame_number": 11477, "display_filter": "frame.number == 11477", "timestamp_epoch": "1533964901.323587000" }, { "tcp_stream": 303, "frame_number": 11850, "display_filter": "frame.number == 11850", "timestamp_epoch": "1533964901.594524000" }, { "tcp_stream": 302, "frame_number": 11854, "display_filter": "frame.number == 11854", "timestamp_epoch": "1533964901.598920000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e59311c08fb20b8c0af51d4d", "type": "domain", "value": "odb.outbrain.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 138, "frame_number": 13204, "display_filter": "frame.number == 13204", "timestamp_epoch": "1533964903.157823000" }, { "udp_stream": 138, "frame_number": 13349, "display_filter": "frame.number == 13349", "timestamp_epoch": "1533964903.242983000" }, { "tcp_stream": 339, "frame_number": 13419, "display_filter": "frame.number == 13419", "timestamp_epoch": "1533964903.334955000" }, { "tcp_stream": 340, "frame_number": 13422, "display_filter": "frame.number == 13422", "timestamp_epoch": "1533964903.335215000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2286e451a5b01f61f73e18cb", "type": "domain", "value": "odr-712357372.us-east-1.elb.amazonaws.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 207, "frame_number": 19702, "display_filter": "frame.number == 19702", "timestamp_epoch": "1533964962.896098000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4eb7c861cb1a62f848425159", "type": "domain", "value": "odr.mookie1.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 207, "frame_number": 19653, "display_filter": "frame.number == 19653", "timestamp_epoch": "1533964962.787255000" }, { "udp_stream": 207, "frame_number": 19702, "display_filter": "frame.number == 19702", "timestamp_epoch": "1533964962.896098000" }, { "tcp_stream": 566, "frame_number": 19804, "display_filter": "frame.number == 19804", "timestamp_epoch": "1533964963.040445000" }, { "tcp_stream": 567, "frame_number": 19805, "display_filter": "frame.number == 19805", "timestamp_epoch": "1533964963.041725000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5bec042dcab7d47937579369", "type": "domain", "value": "optimized-by.rubiconproject.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 158, "frame_number": 14636, "display_filter": "frame.number == 14636", "timestamp_epoch": "1533964904.647012000" }, { "udp_stream": 158, "frame_number": 14749, "display_filter": "frame.number == 14749", "timestamp_epoch": "1533964904.736366000" }, { "tcp_stream": 414, "frame_number": 14819, "display_filter": "frame.number == 14819", "timestamp_epoch": "1533964904.795068000" }, { "tcp_stream": 413, "frame_number": 14821, "display_filter": "frame.number == 14821", "timestamp_epoch": "1533964904.795277000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f60eac8385134cf667ac67e0", "type": "domain", "value": "ox.pxl.ace.advertising.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 79, "frame_number": 5856, "display_filter": "frame.number == 5856", "timestamp_epoch": "1533964559.411813000" }, { "udp_stream": 79, "frame_number": 5893, "display_filter": "frame.number == 5893", "timestamp_epoch": "1533964559.525559000" }, { "tcp_stream": 150, "frame_number": 5940, "display_filter": "frame.number == 5940", "timestamp_epoch": "1533964559.589148000" }, { "tcp_stream": 151, "frame_number": 5950, "display_filter": "frame.number == 5950", "timestamp_epoch": "1533964559.594136000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a99a0437f98e5c3179056703", "type": "domain", "value": "oxp.mxptint.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 153, "frame_number": 14558, "display_filter": "frame.number == 14558", "timestamp_epoch": "1533964904.586500000" }, { "udp_stream": 153, "frame_number": 14611, "display_filter": "frame.number == 14611", "timestamp_epoch": "1533964904.637605000" }, { "tcp_stream": 394, "frame_number": 14741, "display_filter": "frame.number == 14741", "timestamp_epoch": "1533964904.728872000" }, { "tcp_stream": 393, "frame_number": 14752, "display_filter": "frame.number == 14752", "timestamp_epoch": "1533964904.737397000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-911ae72f190fa32e3838772e", "type": "domain", "value": "p.adsymptotic.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 166, "frame_number": 15967, "display_filter": "frame.number == 15967", "timestamp_epoch": "1533964908.323614000" }, { "udp_stream": 166, "frame_number": 16032, "display_filter": "frame.number == 16032", "timestamp_epoch": "1533964908.406611000" }, { "tcp_stream": 454, "frame_number": 16152, "display_filter": "frame.number == 16152", "timestamp_epoch": "1533964908.533771000" }, { "tcp_stream": 453, "frame_number": 16164, "display_filter": "frame.number == 16164", "timestamp_epoch": "1533964908.543183000" }, { "tcp_stream": 826, "frame_number": 30836, "display_filter": "frame.number == 30836", "timestamp_epoch": "1533965099.324080000" }, { "tcp_stream": 827, "frame_number": 30855, "display_filter": "frame.number == 30855", "timestamp_epoch": "1533965099.357388000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-457ed152df621ea4a3e38a52", "type": "domain", "value": "p.rfihub.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 78, "frame_number": 5855, "display_filter": "frame.number == 5855", "timestamp_epoch": "1533964559.411454000" }, { "udp_stream": 78, "frame_number": 6294, "display_filter": "frame.number == 6294", "timestamp_epoch": "1533964560.407087000" }, { "udp_stream": 78, "frame_number": 6313, "display_filter": "frame.number == 6313", "timestamp_epoch": "1533964560.553014000" }, { "tcp_stream": 162, "frame_number": 6340, "display_filter": "frame.number == 6340", "timestamp_epoch": "1533964560.688711000" }, { "tcp_stream": 163, "frame_number": 6344, "display_filter": "frame.number == 6344", "timestamp_epoch": "1533964560.711802000" }, { "tcp_stream": 441, "frame_number": 16084, "display_filter": "frame.number == 16084", "timestamp_epoch": "1533964908.459084000" }, { "tcp_stream": 442, "frame_number": 16086, "display_filter": "frame.number == 16086", "timestamp_epoch": "1533964908.459668000" }, { "tcp_stream": 648, "frame_number": 23675, "display_filter": "frame.number == 23675", "timestamp_epoch": "1533964997.858092000" }, { "tcp_stream": 647, "frame_number": 23677, "display_filter": "frame.number == 23677", "timestamp_epoch": "1533964997.858310000" }, { "tcp_stream": 709, "frame_number": 26748, "display_filter": "frame.number == 26748", "timestamp_epoch": "1533965033.510056000" }, { "tcp_stream": 710, "frame_number": 26749, "display_filter": "frame.number == 26749", "timestamp_epoch": "1533965033.510057000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ec433021fab82f7eec1a615b", "type": "domain", "value": "p.skimresources.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 220, "frame_number": 20585, "display_filter": "frame.number == 20585", "timestamp_epoch": "1533964965.733767000" }, { "udp_stream": 220, "frame_number": 20725, "display_filter": "frame.number == 20725", "timestamp_epoch": "1533964966.306264000" }, { "tcp_stream": 597, "frame_number": 20975, "display_filter": "frame.number == 20975", "timestamp_epoch": "1533964967.208417000" }, { "tcp_stream": 598, "frame_number": 20976, "display_filter": "frame.number == 20976", "timestamp_epoch": "1533964967.208418000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8767b61498be41398234f1f1", "type": "domain", "value": "pagead-googlehosted.l.google.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 60, "frame_number": 4936, "display_filter": "frame.number == 4936", "timestamp_epoch": "1533964555.714019000" }, { "udp_stream": 347, "frame_number": 44193, "display_filter": "frame.number == 44193", "timestamp_epoch": "1533965784.401633000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a7bd74ce76c0a15332c145f7", "type": "domain", "value": "pagead.l.doubleclick.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 66, "frame_number": 5140, "display_filter": "frame.number == 5140", "timestamp_epoch": "1533964556.025417000" }, { "udp_stream": 126, "frame_number": 11931, "display_filter": "frame.number == 11931", "timestamp_epoch": "1533964901.698739000" }, { "udp_stream": 177, "frame_number": 16951, "display_filter": "frame.number == 16951", "timestamp_epoch": "1533964912.917076000" }, { "udp_stream": 362, "frame_number": 46032, "display_filter": "frame.number == 46032", "timestamp_epoch": "1533965789.555893000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a8e6105d884d048675107ba0", "type": "domain", "value": "pagead2.googlesyndication.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 106, "frame_number": 9409, "display_filter": "frame.number == 9409", "timestamp_epoch": "1533964899.325470000" }, { "udp_stream": 106, "frame_number": 9637, "display_filter": "frame.number == 9637", "timestamp_epoch": "1533964899.569932000" }, { "udp_stream": 353, "frame_number": 44401, "display_filter": "frame.number == 44401", "timestamp_epoch": "1533965785.103477000" }, { "udp_stream": 353, "frame_number": 44701, "display_filter": "frame.number == 44701", "timestamp_epoch": "1533965786.043701000" }, { "tcp_stream": 1187, "frame_number": 44800, "display_filter": "frame.number == 44800", "timestamp_epoch": "1533965786.356599000" }, { "tcp_stream": 259, "frame_number": 9803, "display_filter": "frame.number == 9803", "timestamp_epoch": "1533964899.642217000" }, { "tcp_stream": 260, "frame_number": 9805, "display_filter": "frame.number == 9805", "timestamp_epoch": "1533964899.642445000" }, { "tcp_stream": 261, "frame_number": 9811, "display_filter": "frame.number == 9811", "timestamp_epoch": "1533964899.643460000" }, { "tcp_stream": 574, "frame_number": 19951, "display_filter": "frame.number == 19951", "timestamp_epoch": "1533964963.672103000" }, { "tcp_stream": 575, "frame_number": 19955, "display_filter": "frame.number == 19955", "timestamp_epoch": "1533964963.688975000" }, { "tcp_stream": 576, "frame_number": 19970, "display_filter": "frame.number == 19970", "timestamp_epoch": "1533964963.731363000" }, { "tcp_stream": 1202, "frame_number": 45662, "display_filter": "frame.number == 45662", "timestamp_epoch": "1533965788.445447000" }, { "tcp_stream": 1203, "frame_number": 45828, "display_filter": "frame.number == 45828", "timestamp_epoch": "1533965789.057761000" }, { "tcp_stream": 1204, "frame_number": 45833, "display_filter": "frame.number == 45833", "timestamp_epoch": "1533965789.082723000" }, { "tcp_stream": 1209, "frame_number": 45920, "display_filter": "frame.number == 45920", "timestamp_epoch": "1533965789.225632000" } ], "roles": [ "dns-query", "http-host", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7e1de8f72f455b172072f6d3", "type": "domain", "value": "pagead46.l.doubleclick.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 43, "frame_number": 3185, "display_filter": "frame.number == 3185", "timestamp_epoch": "1533964552.354010000" }, { "udp_stream": 53, "frame_number": 3925, "display_filter": "frame.number == 3925", "timestamp_epoch": "1533964553.575811000" }, { "udp_stream": 69, "frame_number": 5441, "display_filter": "frame.number == 5441", "timestamp_epoch": "1533964556.880955000" }, { "udp_stream": 106, "frame_number": 9637, "display_filter": "frame.number == 9637", "timestamp_epoch": "1533964899.569932000" }, { "udp_stream": 336, "frame_number": 43648, "display_filter": "frame.number == 43648", "timestamp_epoch": "1533965783.044158000" }, { "udp_stream": 345, "frame_number": 43840, "display_filter": "frame.number == 43840", "timestamp_epoch": "1533965783.630277000" }, { "udp_stream": 353, "frame_number": 44701, "display_filter": "frame.number == 44701", "timestamp_epoch": "1533965786.043701000" }, { "udp_stream": 359, "frame_number": 45830, "display_filter": "frame.number == 45830", "timestamp_epoch": "1533965789.081206000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5bcfcb58e4282b617d917004", "type": "domain", "value": "partnerad.l.doubleclick.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 54, "frame_number": 3927, "display_filter": "frame.number == 3927", "timestamp_epoch": "1533964553.575840000" }, { "udp_stream": 183, "frame_number": 18111, "display_filter": "frame.number == 18111", "timestamp_epoch": "1533964958.070258000" }, { "udp_stream": 346, "frame_number": 44008, "display_filter": "frame.number == 44008", "timestamp_epoch": "1533965783.935554000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ed51281a4ed1677ae452db3b", "type": "domain", "value": "partners-1732315393.us-east-1.elb.amazonaws.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 258, "frame_number": 27323, "display_filter": "frame.number == 27323", "timestamp_epoch": "1533965035.406624000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0f88359f0c8d541f876d4814", "type": "domain", "value": "perf-token.rubiconproject.net.akadns.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 174, "frame_number": 16558, "display_filter": "frame.number == 16558", "timestamp_epoch": "1533964910.093175000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-dfd1a09ab149f5dd57d0e665", "type": "domain", "value": "petrov2018-pc.sputnikhouse.org", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 22, "frame_number": 374, "display_filter": "frame.number == 374", "timestamp_epoch": "1533964517.089613000" }, { "udp_stream": 22, "frame_number": 375, "display_filter": "frame.number == 375", "timestamp_epoch": "1533964517.089954000" }, { "udp_stream": 314, "frame_number": 39653, "display_filter": "frame.number == 39653", "timestamp_epoch": "1533965410.182850000" }, { "udp_stream": 314, "frame_number": 39654, "display_filter": "frame.number == 39654", "timestamp_epoch": "1533965410.183053000" }, { "udp_stream": 316, "frame_number": 39657, "display_filter": "frame.number == 39657", "timestamp_epoch": "1533965410.185413000" }, { "udp_stream": 316, "frame_number": 39658, "display_filter": "frame.number == 39658", "timestamp_epoch": "1533965410.185581000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ad039a0ce30356e0612d5434", "type": "domain", "value": "phototass1.cdnvideo.ru", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 324, "frame_number": 40130, "display_filter": "frame.number == 40130", "timestamp_epoch": "1533965770.287434000" }, { "udp_stream": 324, "frame_number": 40193, "display_filter": "frame.number == 40193", "timestamp_epoch": "1533965770.483961000" }, { "tcp_stream": 1079, "frame_number": 40292, "display_filter": "frame.number == 40292", "timestamp_epoch": "1533965770.800076000" }, { "tcp_stream": 1080, "frame_number": 40306, "display_filter": "frame.number == 40306", "timestamp_epoch": "1533965770.800953000" }, { "tcp_stream": 1082, "frame_number": 40309, "display_filter": "frame.number == 40309", "timestamp_epoch": "1533965770.801360000" }, { "tcp_stream": 1081, "frame_number": 40310, "display_filter": "frame.number == 40310", "timestamp_epoch": "1533965770.801362000" }, { "tcp_stream": 1078, "frame_number": 40312, "display_filter": "frame.number == 40312", "timestamp_epoch": "1533965770.801500000" }, { "tcp_stream": 1083, "frame_number": 40315, "display_filter": "frame.number == 40315", "timestamp_epoch": "1533965770.802257000" }, { "tcp_stream": 1114, "frame_number": 40914, "display_filter": "frame.number == 40914", "timestamp_epoch": "1533965773.665198000" }, { "tcp_stream": 1225, "frame_number": 46559, "display_filter": "frame.number == 46559", "timestamp_epoch": "1533965791.712865000" }, { "tcp_stream": 1224, "frame_number": 46560, "display_filter": "frame.number == 46560", "timestamp_epoch": "1533965791.712866000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-99e3aa0a6d7432906d701cb1", "type": "domain", "value": "phototass2.cdnvideo.ru", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 329, "frame_number": 40137, "display_filter": "frame.number == 40137", "timestamp_epoch": "1533965770.291819000" }, { "udp_stream": 329, "frame_number": 40243, "display_filter": "frame.number == 40243", "timestamp_epoch": "1533965770.575466000" }, { "tcp_stream": 1113, "frame_number": 40353, "display_filter": "frame.number == 40353", "timestamp_epoch": "1533965770.815158000" }, { "tcp_stream": 1112, "frame_number": 40364, "display_filter": "frame.number == 40364", "timestamp_epoch": "1533965770.816261000" }, { "tcp_stream": 1109, "frame_number": 40375, "display_filter": "frame.number == 40375", "timestamp_epoch": "1533965770.817366000" }, { "tcp_stream": 1108, "frame_number": 40385, "display_filter": "frame.number == 40385", "timestamp_epoch": "1533965770.819837000" }, { "tcp_stream": 1111, "frame_number": 40387, "display_filter": "frame.number == 40387", "timestamp_epoch": "1533965770.819971000" }, { "tcp_stream": 1110, "frame_number": 40395, "display_filter": "frame.number == 40395", "timestamp_epoch": "1533965770.822836000" }, { "tcp_stream": 1222, "frame_number": 46510, "display_filter": "frame.number == 46510", "timestamp_epoch": "1533965791.526188000" }, { "tcp_stream": 1223, "frame_number": 46514, "display_filter": "frame.number == 46514", "timestamp_epoch": "1533965791.527564000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a385b7f9b9a7316f71e6052a", "type": "domain", "value": "phototass3.cdnvideo.ru", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 328, "frame_number": 40134, "display_filter": "frame.number == 40134", "timestamp_epoch": "1533965770.290547000" }, { "udp_stream": 328, "frame_number": 40224, "display_filter": "frame.number == 40224", "timestamp_epoch": "1533965770.569362000" }, { "tcp_stream": 1092, "frame_number": 40373, "display_filter": "frame.number == 40373", "timestamp_epoch": "1533965770.817168000" }, { "tcp_stream": 1091, "frame_number": 40406, "display_filter": "frame.number == 40406", "timestamp_epoch": "1533965770.823673000" }, { "tcp_stream": 1094, "frame_number": 40409, "display_filter": "frame.number == 40409", "timestamp_epoch": "1533965770.823885000" }, { "tcp_stream": 1099, "frame_number": 40428, "display_filter": "frame.number == 40428", "timestamp_epoch": "1533965770.853344000" }, { "tcp_stream": 1103, "frame_number": 40443, "display_filter": "frame.number == 40443", "timestamp_epoch": "1533965770.857708000" }, { "tcp_stream": 1104, "frame_number": 40461, "display_filter": "frame.number == 40461", "timestamp_epoch": "1533965770.869297000" }, { "tcp_stream": 1117, "frame_number": 40960, "display_filter": "frame.number == 40960", "timestamp_epoch": "1533965773.747852000" }, { "tcp_stream": 1119, "frame_number": 40965, "display_filter": "frame.number == 40965", "timestamp_epoch": "1533965773.748243000" }, { "tcp_stream": 1124, "frame_number": 41160, "display_filter": "frame.number == 41160", "timestamp_epoch": "1533965772.399229000" }, { "tcp_stream": 1126, "frame_number": 41164, "display_filter": "frame.number == 41164", "timestamp_epoch": "1533965772.399573000" }, { "tcp_stream": 1127, "frame_number": 41306, "display_filter": "frame.number == 41306", "timestamp_epoch": "1533965772.815075000" }, { "tcp_stream": 1182, "frame_number": 44816, "display_filter": "frame.number == 44816", "timestamp_epoch": "1533965786.361520000" }, { "tcp_stream": 1183, "frame_number": 44820, "display_filter": "frame.number == 44820", "timestamp_epoch": "1533965786.361841000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1e0c9a0e45afb8a73414521d", "type": "domain", "value": "phototass4.cdnvideo.ru", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 326, "frame_number": 40132, "display_filter": "frame.number == 40132", "timestamp_epoch": "1533965770.289792000" }, { "udp_stream": 326, "frame_number": 40222, "display_filter": "frame.number == 40222", "timestamp_epoch": "1533965770.569135000" }, { "tcp_stream": 1090, "frame_number": 40370, "display_filter": "frame.number == 40370", "timestamp_epoch": "1533965770.816625000" }, { "tcp_stream": 1093, "frame_number": 40389, "display_filter": "frame.number == 40389", "timestamp_epoch": "1533965770.820237000" }, { "tcp_stream": 1095, "frame_number": 40415, "display_filter": "frame.number == 40415", "timestamp_epoch": "1533965770.825183000" }, { "tcp_stream": 1096, "frame_number": 40417, "display_filter": "frame.number == 40417", "timestamp_epoch": "1533965770.825184000" }, { "tcp_stream": 1100, "frame_number": 40426, "display_filter": "frame.number == 40426", "timestamp_epoch": "1533965770.853341000" }, { "tcp_stream": 1102, "frame_number": 40435, "display_filter": "frame.number == 40435", "timestamp_epoch": "1533965770.856913000" }, { "tcp_stream": 1121, "frame_number": 40953, "display_filter": "frame.number == 40953", "timestamp_epoch": "1533965773.747076000" }, { "tcp_stream": 1120, "frame_number": 40963, "display_filter": "frame.number == 40963", "timestamp_epoch": "1533965773.747990000" }, { "tcp_stream": 1123, "frame_number": 41110, "display_filter": "frame.number == 41110", "timestamp_epoch": "1533965774.062728000" }, { "tcp_stream": 1122, "frame_number": 41124, "display_filter": "frame.number == 41124", "timestamp_epoch": "1533965774.074652000" }, { "tcp_stream": 1128, "frame_number": 41308, "display_filter": "frame.number == 41308", "timestamp_epoch": "1533965772.815243000" }, { "tcp_stream": 1129, "frame_number": 41316, "display_filter": "frame.number == 41316", "timestamp_epoch": "1533965772.824220000" }, { "tcp_stream": 1180, "frame_number": 44814, "display_filter": "frame.number == 44814", "timestamp_epoch": "1533965786.361271000" }, { "tcp_stream": 1181, "frame_number": 44822, "display_filter": "frame.number == 44822", "timestamp_epoch": "1533965786.362580000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-16f3647d79427cf0605b99b0", "type": "domain", "value": "ping.chartbeat.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 82, "frame_number": 6127, "display_filter": "frame.number == 6127", "timestamp_epoch": "1533964559.866175000" }, { "udp_stream": 82, "frame_number": 6148, "display_filter": "frame.number == 6148", "timestamp_epoch": "1533964559.906110000" }, { "tcp_stream": 156, "frame_number": 6210, "display_filter": "frame.number == 6210", "timestamp_epoch": "1533964560.054258000" }, { "tcp_stream": 157, "frame_number": 6214, "display_filter": "frame.number == 6214", "timestamp_epoch": "1533964560.058896000" }, { "tcp_stream": 176, "frame_number": 7174, "display_filter": "frame.number == 7174", "timestamp_epoch": "1533964739.950773000" }, { "tcp_stream": 175, "frame_number": 7180, "display_filter": "frame.number == 7180", "timestamp_epoch": "1533964739.962159000" }, { "tcp_stream": 180, "frame_number": 7347, "display_filter": "frame.number == 7347", "timestamp_epoch": "1533964875.352644000" }, { "tcp_stream": 181, "frame_number": 7349, "display_filter": "frame.number == 7349", "timestamp_epoch": "1533964875.352768000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f5443057148f474bea8261c0", "type": "domain", "value": "pippio.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 218, "frame_number": 20280, "display_filter": "frame.number == 20280", "timestamp_epoch": "1533964965.146026000" }, { "udp_stream": 218, "frame_number": 20323, "display_filter": "frame.number == 20323", "timestamp_epoch": "1533964965.297460000" }, { "tcp_stream": 594, "frame_number": 20386, "display_filter": "frame.number == 20386", "timestamp_epoch": "1533964965.380525000" }, { "tcp_stream": 593, "frame_number": 20387, "display_filter": "frame.number == 20387", "timestamp_epoch": "1533964965.380735000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-473fc2880296de7bbdab3891", "type": "domain", "value": "pix.impdesk.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 251, "frame_number": 26701, "display_filter": "frame.number == 26701", "timestamp_epoch": "1533965033.402780000" }, { "udp_stream": 251, "frame_number": 26729, "display_filter": "frame.number == 26729", "timestamp_epoch": "1533965033.481704000" }, { "tcp_stream": 711, "frame_number": 26756, "display_filter": "frame.number == 26756", "timestamp_epoch": "1533965033.528947000" }, { "tcp_stream": 712, "frame_number": 26757, "display_filter": "frame.number == 26757", "timestamp_epoch": "1533965033.528949000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1862b8ed5bec246b3f4729bc", "type": "domain", "value": "pix.spot.im", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 148, "frame_number": 14316, "display_filter": "frame.number == 14316", "timestamp_epoch": "1533964904.262876000" }, { "udp_stream": 148, "frame_number": 14376, "display_filter": "frame.number == 14376", "timestamp_epoch": "1533964904.333194000" }, { "tcp_stream": 378, "frame_number": 14459, "display_filter": "frame.number == 14459", "timestamp_epoch": "1533964904.454417000" }, { "tcp_stream": 379, "frame_number": 14465, "display_filter": "frame.number == 14465", "timestamp_epoch": "1533964904.473391000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-301a347df53c17bd6cff0433", "type": "domain", "value": "pixel-a.sitescout.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 77, "frame_number": 5866, "display_filter": "frame.number == 5866", "timestamp_epoch": "1533964559.464580000" }, { "udp_stream": 228, "frame_number": 23250, "display_filter": "frame.number == 23250", "timestamp_epoch": "1533964997.189399000" }, { "udp_stream": 228, "frame_number": 23321, "display_filter": "frame.number == 23321", "timestamp_epoch": "1533964997.328339000" }, { "tcp_stream": 641, "frame_number": 23404, "display_filter": "frame.number == 23404", "timestamp_epoch": "1533964997.416681000" }, { "tcp_stream": 640, "frame_number": 23406, "display_filter": "frame.number == 23406", "timestamp_epoch": "1533964997.416898000" } ], "roles": [ "dns-cname", "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f51422c41bd3b907dc23493d", "type": "domain", "value": "pixel-origin.mathtag.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 61, "frame_number": 5120, "display_filter": "frame.number == 5120", "timestamp_epoch": "1533964555.984165000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7c02a893df3a2137c581d763", "type": "domain", "value": "pixel-sc2.adsymptotic.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 288, "frame_number": 32216, "display_filter": "frame.number == 32216", "timestamp_epoch": "1533965102.093914000" }, { "udp_stream": 288, "frame_number": 32219, "display_filter": "frame.number == 32219", "timestamp_epoch": "1533965102.184319000" }, { "tcp_stream": 878, "frame_number": 32226, "display_filter": "frame.number == 32226", "timestamp_epoch": "1533965102.240261000" }, { "tcp_stream": 879, "frame_number": 32227, "display_filter": "frame.number == 32227", "timestamp_epoch": "1533965102.240348000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-04273b1ed743f442b2a7aa0a", "type": "domain", "value": "pixel-sync.sitescout.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 77, "frame_number": 5854, "display_filter": "frame.number == 5854", "timestamp_epoch": "1533964559.409750000" }, { "udp_stream": 77, "frame_number": 5866, "display_filter": "frame.number == 5866", "timestamp_epoch": "1533964559.464580000" }, { "tcp_stream": 145, "frame_number": 5900, "display_filter": "frame.number == 5900", "timestamp_epoch": "1533964559.530894000" }, { "tcp_stream": 144, "frame_number": 5901, "display_filter": "frame.number == 5901", "timestamp_epoch": "1533964559.530984000" }, { "tcp_stream": 521, "frame_number": 18582, "display_filter": "frame.number == 18582", "timestamp_epoch": "1533964959.371649000" }, { "tcp_stream": 522, "frame_number": 18584, "display_filter": "frame.number == 18584", "timestamp_epoch": "1533964959.371752000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-92bfb54320330c5bad6bebba", "type": "domain", "value": "pixel-us-east.rubiconproject.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 196, "frame_number": 18671, "display_filter": "frame.number == 18671", "timestamp_epoch": "1533964959.616289000" }, { "udp_stream": 196, "frame_number": 18786, "display_filter": "frame.number == 18786", "timestamp_epoch": "1533964960.049215000" }, { "tcp_stream": 539, "frame_number": 18914, "display_filter": "frame.number == 18914", "timestamp_epoch": "1533964960.219733000" }, { "tcp_stream": 540, "frame_number": 18935, "display_filter": "frame.number == 18935", "timestamp_epoch": "1533964960.247858000" }, { "tcp_stream": 810, "frame_number": 30257, "display_filter": "frame.number == 30257", "timestamp_epoch": "1533965098.377029000" }, { "tcp_stream": 811, "frame_number": 30258, "display_filter": "frame.number == 30258", "timestamp_epoch": "1533965098.377030000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b997abc0b05b7a562321ba67", "type": "domain", "value": "pixel-us-east.rubiconproject.net.akadns.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 196, "frame_number": 18786, "display_filter": "frame.number == 18786", "timestamp_epoch": "1533964960.049215000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0b8996a7c95e2b06e026b2c3", "type": "domain", "value": "pixel.advertising.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 102, "frame_number": 8916, "display_filter": "frame.number == 8916", "timestamp_epoch": "1533964898.857493000" }, { "udp_stream": 102, "frame_number": 8976, "display_filter": "frame.number == 8976", "timestamp_epoch": "1533964898.938935000" }, { "tcp_stream": 241, "frame_number": 9013, "display_filter": "frame.number == 9013", "timestamp_epoch": "1533964898.995095000" }, { "tcp_stream": 240, "frame_number": 9028, "display_filter": "frame.number == 9028", "timestamp_epoch": "1533964898.996894000" }, { "tcp_stream": 807, "frame_number": 29803, "display_filter": "frame.number == 29803", "timestamp_epoch": "1533965097.615870000" }, { "tcp_stream": 806, "frame_number": 29810, "display_filter": "frame.number == 29810", "timestamp_epoch": "1533965097.616243000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-df3b20173a6d44e545e69bf4", "type": "domain", "value": "pixel.quantserve.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 98, "frame_number": 8910, "display_filter": "frame.number == 8910", "timestamp_epoch": "1533964898.853770000" }, { "udp_stream": 98, "frame_number": 8958, "display_filter": "frame.number == 8958", "timestamp_epoch": "1533964898.930359000" }, { "tcp_stream": 231, "frame_number": 9041, "display_filter": "frame.number == 9041", "timestamp_epoch": "1533964899.006328000" }, { "tcp_stream": 230, "frame_number": 9045, "display_filter": "frame.number == 9045", "timestamp_epoch": "1533964899.006696000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8d2a1ba9cf1336a35b3deec6", "type": "domain", "value": "pixel.rubiconproject.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 175, "frame_number": 16557, "display_filter": "frame.number == 16557", "timestamp_epoch": "1533964910.070782000" }, { "udp_stream": 175, "frame_number": 16602, "display_filter": "frame.number == 16602", "timestamp_epoch": "1533964910.201908000" }, { "tcp_stream": 472, "frame_number": 16630, "display_filter": "frame.number == 16630", "timestamp_epoch": "1533964910.249486000" }, { "tcp_stream": 473, "frame_number": 16633, "display_filter": "frame.number == 16633", "timestamp_epoch": "1533964910.249866000" }, { "tcp_stream": 474, "frame_number": 16637, "display_filter": "frame.number == 16637", "timestamp_epoch": "1533964910.251487000" }, { "tcp_stream": 475, "frame_number": 16643, "display_filter": "frame.number == 16643", "timestamp_epoch": "1533964910.254776000" }, { "tcp_stream": 476, "frame_number": 16644, "display_filter": "frame.number == 16644", "timestamp_epoch": "1533964910.255157000" }, { "tcp_stream": 642, "frame_number": 23558, "display_filter": "frame.number == 23558", "timestamp_epoch": "1533964997.703961000" }, { "tcp_stream": 643, "frame_number": 23559, "display_filter": "frame.number == 23559", "timestamp_epoch": "1533964997.704063000" }, { "tcp_stream": 644, "frame_number": 23590, "display_filter": "frame.number == 23590", "timestamp_epoch": "1533964997.751001000" }, { "tcp_stream": 649, "frame_number": 23627, "display_filter": "frame.number == 23627", "timestamp_epoch": "1533964997.805395000" }, { "tcp_stream": 650, "frame_number": 23660, "display_filter": "frame.number == 23660", "timestamp_epoch": "1533964997.843178000" }, { "tcp_stream": 653, "frame_number": 23664, "display_filter": "frame.number == 23664", "timestamp_epoch": "1533964997.845875000" }, { "tcp_stream": 846, "frame_number": 31586, "display_filter": "frame.number == 31586", "timestamp_epoch": "1533965100.689701000" }, { "tcp_stream": 845, "frame_number": 31588, "display_filter": "frame.number == 31588", "timestamp_epoch": "1533965100.689703000" }, { "tcp_stream": 847, "frame_number": 31601, "display_filter": "frame.number == 31601", "timestamp_epoch": "1533965100.693842000" }, { "tcp_stream": 848, "frame_number": 31602, "display_filter": "frame.number == 31602", "timestamp_epoch": "1533965100.693894000" }, { "tcp_stream": 851, "frame_number": 31667, "display_filter": "frame.number == 31667", "timestamp_epoch": "1533965100.795642000" }, { "tcp_stream": 855, "frame_number": 31697, "display_filter": "frame.number == 31697", "timestamp_epoch": "1533965100.808279000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4694891b72b0db6cd56f734e", "type": "domain", "value": "pixel.rubiconproject.net.akadns.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 175, "frame_number": 16602, "display_filter": "frame.number == 16602", "timestamp_epoch": "1533964910.201908000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5b6ce2b9b56197124f139a25", "type": "domain", "value": "pixel.sitescout.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 80, "frame_number": 6060, "display_filter": "frame.number == 6060", "timestamp_epoch": "1533964559.747861000" }, { "udp_stream": 80, "frame_number": 6137, "display_filter": "frame.number == 6137", "timestamp_epoch": "1533964559.872487000" }, { "tcp_stream": 154, "frame_number": 6163, "display_filter": "frame.number == 6163", "timestamp_epoch": "1533964559.928446000" }, { "tcp_stream": 155, "frame_number": 6165, "display_filter": "frame.number == 6165", "timestamp_epoch": "1533964559.928564000" }, { "tcp_stream": 542, "frame_number": 18904, "display_filter": "frame.number == 18904", "timestamp_epoch": "1533964960.217591000" }, { "tcp_stream": 541, "frame_number": 18908, "display_filter": "frame.number == 18908", "timestamp_epoch": "1533964960.218196000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b39ddba5a08e5303b6cc8064", "type": "domain", "value": "pixel.tapad.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 211, "frame_number": 20027, "display_filter": "frame.number == 20027", "timestamp_epoch": "1533964964.071735000" }, { "udp_stream": 211, "frame_number": 20032, "display_filter": "frame.number == 20032", "timestamp_epoch": "1533964964.154372000" }, { "tcp_stream": 577, "frame_number": 20039, "display_filter": "frame.number == 20039", "timestamp_epoch": "1533964964.213934000" }, { "tcp_stream": 578, "frame_number": 20045, "display_filter": "frame.number == 20045", "timestamp_epoch": "1533964964.263207000" }, { "tcp_stream": 843, "frame_number": 31583, "display_filter": "frame.number == 31583", "timestamp_epoch": "1533965100.689333000" }, { "tcp_stream": 844, "frame_number": 31585, "display_filter": "frame.number == 31585", "timestamp_epoch": "1533965100.689530000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b9abdd413cce01685a02612e", "type": "domain", "value": "pixeltrack.eyeviewads.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 254, "frame_number": 26990, "display_filter": "frame.number == 26990", "timestamp_epoch": "1533965034.039742000" }, { "udp_stream": 254, "frame_number": 27021, "display_filter": "frame.number == 27021", "timestamp_epoch": "1533965034.135661000" }, { "tcp_stream": 725, "frame_number": 27059, "display_filter": "frame.number == 27059", "timestamp_epoch": "1533965034.290246000" }, { "tcp_stream": 726, "frame_number": 27065, "display_filter": "frame.number == 27065", "timestamp_epoch": "1533965034.293084000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3a48bae8cb7731092b62319d", "type": "domain", "value": "platform.twitter.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 343, "frame_number": 43647, "display_filter": "frame.number == 43647", "timestamp_epoch": "1533965783.031263000" }, { "udp_stream": 343, "frame_number": 43671, "display_filter": "frame.number == 43671", "timestamp_epoch": "1533965783.112888000" }, { "tcp_stream": 1150, "frame_number": 43698, "display_filter": "frame.number == 43698", "timestamp_epoch": "1533965783.176462000" }, { "tcp_stream": 1163, "frame_number": 44150, "display_filter": "frame.number == 44150", "timestamp_epoch": "1533965784.337315000" } ], "roles": [ "dns-query", "http-host", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-348543086827afd346122484", "type": "domain", "value": "pm.w55c.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 222, "frame_number": 22986, "display_filter": "frame.number == 22986", "timestamp_epoch": "1533964996.335466000" }, { "udp_stream": 222, "frame_number": 23033, "display_filter": "frame.number == 23033", "timestamp_epoch": "1533964996.474799000" }, { "tcp_stream": 619, "frame_number": 23062, "display_filter": "frame.number == 23062", "timestamp_epoch": "1533964996.584481000" }, { "tcp_stream": 618, "frame_number": 23069, "display_filter": "frame.number == 23069", "timestamp_epoch": "1533964996.585577000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-627c334137ed87675a3ef4bb", "type": "domain", "value": "pmp.mxptint.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 224, "frame_number": 22988, "display_filter": "frame.number == 22988", "timestamp_epoch": "1533964996.338424000" }, { "udp_stream": 224, "frame_number": 23034, "display_filter": "frame.number == 23034", "timestamp_epoch": "1533964996.474895000" }, { "tcp_stream": 616, "frame_number": 23080, "display_filter": "frame.number == 23080", "timestamp_epoch": "1533964996.591113000" }, { "tcp_stream": 617, "frame_number": 23084, "display_filter": "frame.number == 23084", "timestamp_epoch": "1533964996.603708000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8d8cc838440243cbb68b4280", "type": "domain", "value": "pool.tokyo.iponweb.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 120, "frame_number": 23682, "display_filter": "frame.number == 23682", "timestamp_epoch": "1533964997.887170000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f2d3174c71c159ee60e29404", "type": "domain", "value": "pop.yandex.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 87, "frame_number": 6566, "display_filter": "frame.number == 6566", "timestamp_epoch": "1533964577.036284000" }, { "udp_stream": 87, "frame_number": 6567, "display_filter": "frame.number == 6567", "timestamp_epoch": "1533964577.203660000" }, { "udp_stream": 318, "frame_number": 39813, "display_filter": "frame.number == 39813", "timestamp_epoch": "1533965567.110094000" }, { "udp_stream": 318, "frame_number": 39814, "display_filter": "frame.number == 39814", "timestamp_epoch": "1533965567.514714000" }, { "tcp_stream": 166, "frame_number": 6571, "display_filter": "frame.number == 6571", "timestamp_epoch": "1533964577.639943000" }, { "tcp_stream": 177, "frame_number": 7200, "display_filter": "frame.number == 7200", "timestamp_epoch": "1533964761.191924000" }, { "tcp_stream": 1056, "frame_number": 39818, "display_filter": "frame.number == 39818", "timestamp_epoch": "1533965567.875578000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b8ebc93e8e7620bb9f25020a", "type": "domain", "value": "pop.yandex.ru", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 87, "frame_number": 6567, "display_filter": "frame.number == 6567", "timestamp_epoch": "1533964577.203660000" }, { "udp_stream": 318, "frame_number": 39814, "display_filter": "frame.number == 39814", "timestamp_epoch": "1533965567.514714000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7e786227c2c45979014fe7d4", "type": "domain", "value": "pp.lp4.io", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 29, "frame_number": 593, "display_filter": "frame.number == 593", "timestamp_epoch": "1533964545.560553000" }, { "udp_stream": 29, "frame_number": 605, "display_filter": "frame.number == 605", "timestamp_epoch": "1533964545.630742000" }, { "tcp_stream": 43, "frame_number": 712, "display_filter": "frame.number == 712", "timestamp_epoch": "1533964545.855496000" }, { "tcp_stream": 44, "frame_number": 730, "display_filter": "frame.number == 730", "timestamp_epoch": "1533964545.873598000" }, { "tcp_stream": 136, "frame_number": 5919, "display_filter": "frame.number == 5919", "timestamp_epoch": "1533964559.550519000" }, { "tcp_stream": 137, "frame_number": 5922, "display_filter": "frame.number == 5922", "timestamp_epoch": "1533964559.550786000" }, { "tcp_stream": 170, "frame_number": 6690, "display_filter": "frame.number == 6690", "timestamp_epoch": "1533964622.291023000" }, { "tcp_stream": 171, "frame_number": 6691, "display_filter": "frame.number == 6691", "timestamp_epoch": "1533964622.291025000" }, { "tcp_stream": 173, "frame_number": 7136, "display_filter": "frame.number == 7136", "timestamp_epoch": "1533964682.159024000" }, { "tcp_stream": 174, "frame_number": 7140, "display_filter": "frame.number == 7140", "timestamp_epoch": "1533964682.167350000" }, { "tcp_stream": 183, "frame_number": 7378, "display_filter": "frame.number == 7378", "timestamp_epoch": "1533964894.375662000" }, { "tcp_stream": 182, "frame_number": 7382, "display_filter": "frame.number == 7382", "timestamp_epoch": "1533964894.376436000" }, { "tcp_stream": 1022, "frame_number": 39177, "display_filter": "frame.number == 39177", "timestamp_epoch": "1533965245.889150000" }, { "tcp_stream": 1023, "frame_number": 39181, "display_filter": "frame.number == 39181", "timestamp_epoch": "1533965245.895481000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b898229e3cd130c5431c097f", "type": "domain", "value": "pr-bh.ybp.gysm.yahoodns.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 64, "frame_number": 5121, "display_filter": "frame.number == 5121", "timestamp_epoch": "1533964555.984478000" }, { "udp_stream": 363, "frame_number": 46038, "display_filter": "frame.number == 46038", "timestamp_epoch": "1533965789.567878000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a126fe54f8ce5682702972b1", "type": "domain", "value": "pr-bh.ybp.yahoo.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 64, "frame_number": 5079, "display_filter": "frame.number == 5079", "timestamp_epoch": "1533964555.921841000" }, { "udp_stream": 64, "frame_number": 5121, "display_filter": "frame.number == 5121", "timestamp_epoch": "1533964555.984478000" }, { "udp_stream": 363, "frame_number": 45993, "display_filter": "frame.number == 45993", "timestamp_epoch": "1533965789.443122000" }, { "udp_stream": 363, "frame_number": 46038, "display_filter": "frame.number == 46038", "timestamp_epoch": "1533965789.567878000" }, { "tcp_stream": 117, "frame_number": 5184, "display_filter": "frame.number == 5184", "timestamp_epoch": "1533964556.077465000" }, { "tcp_stream": 118, "frame_number": 5188, "display_filter": "frame.number == 5188", "timestamp_epoch": "1533964556.079603000" }, { "tcp_stream": 477, "frame_number": 16736, "display_filter": "frame.number == 16736", "timestamp_epoch": "1533964910.417681000" }, { "tcp_stream": 478, "frame_number": 16749, "display_filter": "frame.number == 16749", "timestamp_epoch": "1533964910.427951000" }, { "tcp_stream": 751, "frame_number": 27559, "display_filter": "frame.number == 27559", "timestamp_epoch": "1533965035.723614000" }, { "tcp_stream": 750, "frame_number": 27560, "display_filter": "frame.number == 27560", "timestamp_epoch": "1533965035.723615000" }, { "tcp_stream": 937, "frame_number": 33914, "display_filter": "frame.number == 33914", "timestamp_epoch": "1533965157.843657000" }, { "tcp_stream": 936, "frame_number": 33921, "display_filter": "frame.number == 33921", "timestamp_epoch": "1533965157.844645000" }, { "tcp_stream": 1215, "frame_number": 46091, "display_filter": "frame.number == 46091", "timestamp_epoch": "1533965789.730636000" }, { "tcp_stream": 1214, "frame_number": 46092, "display_filter": "frame.number == 46092", "timestamp_epoch": "1533965789.730637000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-657cb93836feea7bb029313f", "type": "domain", "value": "pre-usermatch.targeting.unrulymedia.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 306, "frame_number": 35497, "display_filter": "frame.number == 35497", "timestamp_epoch": "1533965160.271885000" }, { "udp_stream": 306, "frame_number": 35556, "display_filter": "frame.number == 35556", "timestamp_epoch": "1533965160.381946000" }, { "tcp_stream": 970, "frame_number": 35635, "display_filter": "frame.number == 35635", "timestamp_epoch": "1533965160.493902000" }, { "tcp_stream": 971, "frame_number": 35643, "display_filter": "frame.number == 35643", "timestamp_epoch": "1533965160.503041000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d2661cb38f1da2ae0a68e1bb", "type": "domain", "value": "prod-dem-collector-elb-611025824.eu-west-1.elb.amazonaws.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 73, "frame_number": 5860, "display_filter": "frame.number == 5860", "timestamp_epoch": "1533964559.445991000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0127f71438fb6619bbed9b83", "type": "domain", "value": "prod.appnexus.map.fastly.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 201, "frame_number": 19305, "display_filter": "frame.number == 19305", "timestamp_epoch": "1533964961.766961000" }, { "udp_stream": 226, "frame_number": 23216, "display_filter": "frame.number == 23216", "timestamp_epoch": "1533964997.081499000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-aa25b6613b43f9145a8e76c9", "type": "domain", "value": "prod.contextweb.map.fastlylb.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 246, "frame_number": 26420, "display_filter": "frame.number == 26420", "timestamp_epoch": "1533965032.696494000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-beaab0e8c5b53356aaba3247", "type": "domain", "value": "prod.outbrain.map.fastlylb.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 138, "frame_number": 13349, "display_filter": "frame.number == 13349", "timestamp_epoch": "1533964903.242983000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0fdc17515adbf7a03fec3559", "type": "domain", "value": "prod.y-medialink.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 263, "frame_number": 27451, "display_filter": "frame.number == 27451", "timestamp_epoch": "1533965035.621107000" }, { "udp_stream": 263, "frame_number": 27526, "display_filter": "frame.number == 27526", "timestamp_epoch": "1533965035.690931000" }, { "tcp_stream": 758, "frame_number": 27621, "display_filter": "frame.number == 27621", "timestamp_epoch": "1533965035.782912000" }, { "tcp_stream": 757, "frame_number": 27626, "display_filter": "frame.number == 27626", "timestamp_epoch": "1533965035.783476000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6047aaca5aa5c37fe84a2c19", "type": "domain", "value": "pubads.g.doubleclick.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 183, "frame_number": 18026, "display_filter": "frame.number == 18026", "timestamp_epoch": "1533964957.807117000" }, { "udp_stream": 183, "frame_number": 18111, "display_filter": "frame.number == 18111", "timestamp_epoch": "1533964958.070258000" }, { "tcp_stream": 504, "frame_number": 18134, "display_filter": "frame.number == 18134", "timestamp_epoch": "1533964958.132879000" }, { "tcp_stream": 505, "frame_number": 18135, "display_filter": "frame.number == 18135", "timestamp_epoch": "1533964958.133287000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d013560856fc443728361e54", "type": "domain", "value": "pubmatic-match.dotomi.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 168, "frame_number": 15985, "display_filter": "frame.number == 15985", "timestamp_epoch": "1533964908.336781000" }, { "udp_stream": 168, "frame_number": 16039, "display_filter": "frame.number == 16039", "timestamp_epoch": "1533964908.424347000" }, { "tcp_stream": 455, "frame_number": 16105, "display_filter": "frame.number == 16105", "timestamp_epoch": "1533964908.481382000" }, { "tcp_stream": 456, "frame_number": 16106, "display_filter": "frame.number == 16106", "timestamp_epoch": "1533964908.481558000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-036721e5f9c08e95b177f8a9", "type": "domain", "value": "pubmatic2waycm-atl.netmng.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 169, "frame_number": 15986, "display_filter": "frame.number == 15986", "timestamp_epoch": "1533964908.338567000" }, { "udp_stream": 169, "frame_number": 16028, "display_filter": "frame.number == 16028", "timestamp_epoch": "1533964908.406114000" }, { "tcp_stream": 452, "frame_number": 16166, "display_filter": "frame.number == 16166", "timestamp_epoch": "1533964908.543281000" }, { "tcp_stream": 451, "frame_number": 16176, "display_filter": "frame.number == 16176", "timestamp_epoch": "1533964908.544102000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1200c1fbdccafee93c257673", "type": "domain", "value": "px-us-ca.adhigh.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 223, "frame_number": 23086, "display_filter": "frame.number == 23086", "timestamp_epoch": "1533964996.618558000" }, { "udp_stream": 361, "frame_number": 46077, "display_filter": "frame.number == 46077", "timestamp_epoch": "1533965789.700898000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e46806fd32691487e29a329d", "type": "domain", "value": "px.adhigh.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 223, "frame_number": 22987, "display_filter": "frame.number == 22987", "timestamp_epoch": "1533964996.337677000" }, { "udp_stream": 223, "frame_number": 23086, "display_filter": "frame.number == 23086", "timestamp_epoch": "1533964996.618558000" }, { "udp_stream": 361, "frame_number": 45975, "display_filter": "frame.number == 45975", "timestamp_epoch": "1533965789.421325000" }, { "udp_stream": 361, "frame_number": 46077, "display_filter": "frame.number == 46077", "timestamp_epoch": "1533965789.700898000" }, { "tcp_stream": 621, "frame_number": 23116, "display_filter": "frame.number == 23116", "timestamp_epoch": "1533964996.711933000" }, { "tcp_stream": 620, "frame_number": 23118, "display_filter": "frame.number == 23118", "timestamp_epoch": "1533964996.712394000" }, { "tcp_stream": 1218, "frame_number": 46103, "display_filter": "frame.number == 46103", "timestamp_epoch": "1533965789.758127000" }, { "tcp_stream": 1219, "frame_number": 46108, "display_filter": "frame.number == 46108", "timestamp_epoch": "1533965789.759136000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7aa890a1dfa0523f7d51e3fb", "type": "domain", "value": "px.moatads.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 133, "frame_number": 12552, "display_filter": "frame.number == 12552", "timestamp_epoch": "1533964902.453057000" }, { "udp_stream": 133, "frame_number": 12591, "display_filter": "frame.number == 12591", "timestamp_epoch": "1533964902.539371000" }, { "tcp_stream": 324, "frame_number": 12638, "display_filter": "frame.number == 12638", "timestamp_epoch": "1533964902.589662000" }, { "tcp_stream": 325, "frame_number": 12671, "display_filter": "frame.number == 12671", "timestamp_epoch": "1533964902.643109000" }, { "tcp_stream": 1032, "frame_number": 39345, "display_filter": "frame.number == 39345", "timestamp_epoch": "1533965247.222636000" }, { "tcp_stream": 1031, "frame_number": 39348, "display_filter": "frame.number == 39348", "timestamp_epoch": "1533965247.223208000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-423c8b70620caaedf99c3a90", "type": "domain", "value": "px.owneriq.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 243, "frame_number": 26358, "display_filter": "frame.number == 26358", "timestamp_epoch": "1533965032.569139000" }, { "udp_stream": 243, "frame_number": 26414, "display_filter": "frame.number == 26414", "timestamp_epoch": "1533965032.677681000" }, { "tcp_stream": 702, "frame_number": 26473, "display_filter": "frame.number == 26473", "timestamp_epoch": "1533965032.793305000" }, { "tcp_stream": 703, "frame_number": 26475, "display_filter": "frame.number == 26475", "timestamp_epoch": "1533965032.793308000" }, { "tcp_stream": 852, "frame_number": 31651, "display_filter": "frame.number == 31651", "timestamp_epoch": "1533965100.791005000" }, { "tcp_stream": 853, "frame_number": 31666, "display_filter": "frame.number == 31666", "timestamp_epoch": "1533965100.795540000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1d279e8d30452581de430ff3", "type": "domain", "value": "px.powerlinks.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 273, "frame_number": 30390, "display_filter": "frame.number == 30390", "timestamp_epoch": "1533965098.616151000" }, { "udp_stream": 273, "frame_number": 30652, "display_filter": "frame.number == 30652", "timestamp_epoch": "1533965099.045919000" }, { "tcp_stream": 830, "frame_number": 31064, "display_filter": "frame.number == 31064", "timestamp_epoch": "1533965099.788712000" }, { "tcp_stream": 831, "frame_number": 31065, "display_filter": "frame.number == 31065", "timestamp_epoch": "1533965099.788714000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2453d50bb7e4e17ef4c75e82", "type": "domain", "value": "pxl.connexity.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 268, "frame_number": 27462, "display_filter": "frame.number == 27462", "timestamp_epoch": "1533965035.643053000" }, { "udp_stream": 268, "frame_number": 27576, "display_filter": "frame.number == 27576", "timestamp_epoch": "1533965035.747687000" }, { "tcp_stream": 769, "frame_number": 27669, "display_filter": "frame.number == 27669", "timestamp_epoch": "1533965035.841137000" }, { "tcp_stream": 768, "frame_number": 27677, "display_filter": "frame.number == 27677", "timestamp_epoch": "1533965035.846302000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c4fb16c91ff7cd18c93ad7e3", "type": "domain", "value": "qcx.quantserve.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 142, "frame_number": 13463, "display_filter": "frame.number == 13463", "timestamp_epoch": "1533964903.459819000" }, { "udp_stream": 142, "frame_number": 13537, "display_filter": "frame.number == 13537", "timestamp_epoch": "1533964903.535108000" }, { "tcp_stream": 352, "frame_number": 13611, "display_filter": "frame.number == 13611", "timestamp_epoch": "1533964903.595117000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-85b74252da91721d4e1fa8f6", "type": "domain", "value": "r.nexac.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 239, "frame_number": 24026, "display_filter": "frame.number == 24026", "timestamp_epoch": "1533964999.378273000" }, { "udp_stream": 239, "frame_number": 24037, "display_filter": "frame.number == 24037", "timestamp_epoch": "1533964999.457617000" }, { "tcp_stream": 668, "frame_number": 24069, "display_filter": "frame.number == 24069", "timestamp_epoch": "1533964999.556954000" }, { "tcp_stream": 669, "frame_number": 24070, "display_filter": "frame.number == 24070", "timestamp_epoch": "1533964999.557035000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4ffac87c81591710ab6d3e1c", "type": "domain", "value": "r53x.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:58.246401+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:58.244167+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 89, "frame_number": 7256, "display_filter": "frame.number == 7256", "timestamp_epoch": "1533964849.660908000" }, { "udp_stream": 89, "frame_number": 7259, "display_filter": "frame.number == 7259", "timestamp_epoch": "1533964850.053278000" }, { "tcp_stream": 178, "frame_number": 7263, "display_filter": "frame.number == 7263", "timestamp_epoch": "1533964850.464296000" }, { "tcp_stream": 179, "frame_number": 7277, "display_filter": "frame.number == 7277", "timestamp_epoch": "1533964857.855860000" }, { "tcp_stream": 179, "frame_number": 7280, "display_filter": "frame.number == 7280", "timestamp_epoch": "1533964858.738093000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:58.241918+00:00" }, { "observable_id": "observable-fbe494ec6ac0c31dc67925bf", "type": "domain", "value": "rbp.mxptint.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 230, "frame_number": 23262, "display_filter": "frame.number == 23262", "timestamp_epoch": "1533964997.192053000" }, { "udp_stream": 230, "frame_number": 23300, "display_filter": "frame.number == 23300", "timestamp_epoch": "1533964997.294014000" }, { "tcp_stream": 637, "frame_number": 23394, "display_filter": "frame.number == 23394", "timestamp_epoch": "1533964997.397872000" }, { "tcp_stream": 636, "frame_number": 23395, "display_filter": "frame.number == 23395", "timestamp_epoch": "1533964997.397874000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ee54ca12a257766bcf294ef1", "type": "domain", "value": "recs.engageya.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 96, "frame_number": 8579, "display_filter": "frame.number == 8579", "timestamp_epoch": "1533964898.482071000" }, { "udp_stream": 96, "frame_number": 8628, "display_filter": "frame.number == 8628", "timestamp_epoch": "1533964898.548203000" }, { "tcp_stream": 224, "frame_number": 8801, "display_filter": "frame.number == 8801", "timestamp_epoch": "1533964898.751838000" }, { "tcp_stream": 223, "frame_number": 8805, "display_filter": "frame.number == 8805", "timestamp_epoch": "1533964898.752738000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f3a959fcb6569669910e9947", "type": "domain", "value": "relap.io", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 365, "frame_number": 46366, "display_filter": "frame.number == 46366", "timestamp_epoch": "1533965791.000009000" }, { "udp_stream": 365, "frame_number": 46422, "display_filter": "frame.number == 46422", "timestamp_epoch": "1533965791.276701000" }, { "tcp_stream": 1226, "frame_number": 46565, "display_filter": "frame.number == 46565", "timestamp_epoch": "1533965791.718122000" }, { "tcp_stream": 1227, "frame_number": 46571, "display_filter": "frame.number == 46571", "timestamp_epoch": "1533965791.730140000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-65618a4c15665225c61e52c0", "type": "domain", "value": "rp.gwallet.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 253, "frame_number": 26769, "display_filter": "frame.number == 26769", "timestamp_epoch": "1533965033.590617000" }, { "udp_stream": 253, "frame_number": 26821, "display_filter": "frame.number == 26821", "timestamp_epoch": "1533965033.693499000" }, { "tcp_stream": 722, "frame_number": 26878, "display_filter": "frame.number == 26878", "timestamp_epoch": "1533965033.770456000" }, { "tcp_stream": 721, "frame_number": 26880, "display_filter": "frame.number == 26880", "timestamp_epoch": "1533965033.771149000" }, { "tcp_stream": 935, "frame_number": 33905, "display_filter": "frame.number == 33905", "timestamp_epoch": "1533965157.828358000" }, { "tcp_stream": 934, "frame_number": 33906, "display_filter": "frame.number == 33906", "timestamp_epoch": "1533965157.828453000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c6e3119a491151bff31bce5c", "type": "domain", "value": "rs-lb-b.lkqd.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 157, "frame_number": 14679, "display_filter": "frame.number == 14679", "timestamp_epoch": "1533964904.689217000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f601a2cb548db8cb2a783507", "type": "domain", "value": "rtax.criteo.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 338, "frame_number": 43639, "display_filter": "frame.number == 43639", "timestamp_epoch": "1533965783.004773000" }, { "udp_stream": 338, "frame_number": 43659, "display_filter": "frame.number == 43659", "timestamp_epoch": "1533965783.084459000" }, { "tcp_stream": 1146, "frame_number": 43682, "display_filter": "frame.number == 43682", "timestamp_epoch": "1533965783.173153000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7da06e59cac063e4b6369bc4", "type": "domain", "value": "rtb-csync.smartadserver.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 265, "frame_number": 27457, "display_filter": "frame.number == 27457", "timestamp_epoch": "1533965035.633952000" }, { "udp_stream": 265, "frame_number": 27532, "display_filter": "frame.number == 27532", "timestamp_epoch": "1533965035.693277000" }, { "tcp_stream": 755, "frame_number": 27777, "display_filter": "frame.number == 27777", "timestamp_epoch": "1533965035.957742000" }, { "tcp_stream": 756, "frame_number": 27789, "display_filter": "frame.number == 27789", "timestamp_epoch": "1533965035.964944000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-237c2cef576f2649250ea083", "type": "domain", "value": "rtb.adentifi.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 300, "frame_number": 33846, "display_filter": "frame.number == 33846", "timestamp_epoch": "1533965157.683154000" }, { "udp_stream": 300, "frame_number": 33970, "display_filter": "frame.number == 33970", "timestamp_epoch": "1533965157.910445000" }, { "tcp_stream": 945, "frame_number": 34262, "display_filter": "frame.number == 34262", "timestamp_epoch": "1533965158.190158000" }, { "tcp_stream": 944, "frame_number": 34270, "display_filter": "frame.number == 34270", "timestamp_epoch": "1533965158.203148000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7f8ecbd1ac90287c017557a9", "type": "domain", "value": "rtb.adgrx.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 276, "frame_number": 30803, "display_filter": "frame.number == 30803", "timestamp_epoch": "1533965099.278838000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-02a8995e9e12e950ec006c1c", "type": "domain", "value": "rtb.gumgum.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 155, "frame_number": 14565, "display_filter": "frame.number == 14565", "timestamp_epoch": "1533964904.595064000" }, { "udp_stream": 155, "frame_number": 14641, "display_filter": "frame.number == 14641", "timestamp_epoch": "1533964904.664048000" }, { "tcp_stream": 403, "frame_number": 14758, "display_filter": "frame.number == 14758", "timestamp_epoch": "1533964904.744354000" }, { "tcp_stream": 404, "frame_number": 14783, "display_filter": "frame.number == 14783", "timestamp_epoch": "1533964904.753223000" }, { "tcp_stream": 615, "frame_number": 23038, "display_filter": "frame.number == 23038", "timestamp_epoch": "1533964996.476011000" }, { "tcp_stream": 614, "frame_number": 23044, "display_filter": "frame.number == 23044", "timestamp_epoch": "1533964996.477767000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8863f98a7a5584496b653990", "type": "domain", "value": "rtb.openx.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 76, "frame_number": 5853, "display_filter": "frame.number == 5853", "timestamp_epoch": "1533964559.407270000" }, { "udp_stream": 76, "frame_number": 5871, "display_filter": "frame.number == 5871", "timestamp_epoch": "1533964559.485487000" }, { "tcp_stream": 146, "frame_number": 5917, "display_filter": "frame.number == 5917", "timestamp_epoch": "1533964559.549991000" }, { "tcp_stream": 148, "frame_number": 5923, "display_filter": "frame.number == 5923", "timestamp_epoch": "1533964559.550920000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6a273ea72e2d1b6277c76baa", "type": "domain", "value": "rtb0.doubleverify.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 295, "frame_number": 32944, "display_filter": "frame.number == 32944", "timestamp_epoch": "1533965136.578793000" }, { "udp_stream": 295, "frame_number": 32962, "display_filter": "frame.number == 32962", "timestamp_epoch": "1533965136.678702000" }, { "tcp_stream": 900, "frame_number": 32982, "display_filter": "frame.number == 32982", "timestamp_epoch": "1533965136.734297000" }, { "tcp_stream": 901, "frame_number": 32984, "display_filter": "frame.number == 32984", "timestamp_epoch": "1533965136.734621000" }, { "tcp_stream": 1000, "frame_number": 38774, "display_filter": "frame.number == 38774", "timestamp_epoch": "1533965239.837286000" }, { "tcp_stream": 1001, "frame_number": 38778, "display_filter": "frame.number == 38778", "timestamp_epoch": "1533965239.842811000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0ea340e5a86e188e0b49e2ba", "type": "domain", "value": "rtr.innovid.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 290, "frame_number": 32699, "display_filter": "frame.number == 32699", "timestamp_epoch": "1533965134.785276000" }, { "udp_stream": 290, "frame_number": 32701, "display_filter": "frame.number == 32701", "timestamp_epoch": "1533965134.862529000" }, { "tcp_stream": 891, "frame_number": 32710, "display_filter": "frame.number == 32710", "timestamp_epoch": "1533965134.952080000" }, { "tcp_stream": 890, "frame_number": 32711, "display_filter": "frame.number == 32711", "timestamp_epoch": "1533965134.952249000" }, { "tcp_stream": 996, "frame_number": 38738, "display_filter": "frame.number == 38738", "timestamp_epoch": "1533965239.228582000" }, { "tcp_stream": 997, "frame_number": 38739, "display_filter": "frame.number == 38739", "timestamp_epoch": "1533965239.228584000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3e0c356a220d1f0120c885fb", "type": "domain", "value": "rub.pxl.ace.advertising.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 229, "frame_number": 23251, "display_filter": "frame.number == 23251", "timestamp_epoch": "1533964997.190207000" }, { "udp_stream": 229, "frame_number": 23322, "display_filter": "frame.number == 23322", "timestamp_epoch": "1533964997.328492000" }, { "tcp_stream": 638, "frame_number": 23410, "display_filter": "frame.number == 23410", "timestamp_epoch": "1533964997.417319000" }, { "tcp_stream": 639, "frame_number": 23411, "display_filter": "frame.number == 23411", "timestamp_epoch": "1533964997.417469000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-28fbb95e7fbbc42a23b96719", "type": "domain", "value": "rubicon-match.dotomi.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 249, "frame_number": 26699, "display_filter": "frame.number == 26699", "timestamp_epoch": "1533965033.401595000" }, { "udp_stream": 249, "frame_number": 26802, "display_filter": "frame.number == 26802", "timestamp_epoch": "1533965033.625618000" }, { "tcp_stream": 719, "frame_number": 26857, "display_filter": "frame.number == 26857", "timestamp_epoch": "1533965033.755397000" }, { "tcp_stream": 720, "frame_number": 26858, "display_filter": "frame.number == 26858", "timestamp_epoch": "1533965033.755512000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-020bfa234b9f3cefb3b7ea83", "type": "domain", "value": "rum-collector-2.pingdom.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 73, "frame_number": 5846, "display_filter": "frame.number == 5846", "timestamp_epoch": "1533964559.371843000" }, { "udp_stream": 73, "frame_number": 5860, "display_filter": "frame.number == 5860", "timestamp_epoch": "1533964559.445991000" }, { "tcp_stream": 140, "frame_number": 5996, "display_filter": "frame.number == 5996", "timestamp_epoch": "1533964559.652325000" }, { "tcp_stream": 141, "frame_number": 5998, "display_filter": "frame.number == 5998", "timestamp_epoch": "1533964559.652692000" }, { "tcp_stream": 383, "frame_number": 14633, "display_filter": "frame.number == 14633", "timestamp_epoch": "1533964904.646300000" }, { "tcp_stream": 382, "frame_number": 14638, "display_filter": "frame.number == 14638", "timestamp_epoch": "1533964904.647172000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-915e90fca04876fbb1627083", "type": "domain", "value": "rum-collector.pingdom.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 74, "frame_number": 5847, "display_filter": "frame.number == 5847", "timestamp_epoch": "1533964559.373718000" }, { "udp_stream": 74, "frame_number": 5863, "display_filter": "frame.number == 5863", "timestamp_epoch": "1533964559.449101000" }, { "tcp_stream": 142, "frame_number": 5883, "display_filter": "frame.number == 5883", "timestamp_epoch": "1533964559.508584000" }, { "tcp_stream": 143, "frame_number": 5891, "display_filter": "frame.number == 5891", "timestamp_epoch": "1533964559.512892000" }, { "tcp_stream": 385, "frame_number": 14493, "display_filter": "frame.number == 14493", "timestamp_epoch": "1533964904.506379000" }, { "tcp_stream": 384, "frame_number": 14499, "display_filter": "frame.number == 14499", "timestamp_epoch": "1533964904.513679000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-45e78d89921aeaaab0f10b80", "type": "domain", "value": "rum-static.pingdom.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 42, "frame_number": 3056, "display_filter": "frame.number == 3056", "timestamp_epoch": "1533964551.845979000" }, { "udp_stream": 42, "frame_number": 3180, "display_filter": "frame.number == 3180", "timestamp_epoch": "1533964552.350754000" }, { "tcp_stream": 66, "frame_number": 3236, "display_filter": "frame.number == 3236", "timestamp_epoch": "1533964552.452729000" }, { "tcp_stream": 67, "frame_number": 3244, "display_filter": "frame.number == 3244", "timestamp_epoch": "1533964552.457149000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-40d7913fa415047f0de38360", "type": "domain", "value": "ruptly-d.openx.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 31, "frame_number": 595, "display_filter": "frame.number == 595", "timestamp_epoch": "1533964545.575227000" }, { "udp_stream": 31, "frame_number": 617, "display_filter": "frame.number == 617", "timestamp_epoch": "1533964545.677779000" }, { "tcp_stream": 51, "frame_number": 651, "display_filter": "frame.number == 651", "timestamp_epoch": "1533964545.746485000" }, { "tcp_stream": 52, "frame_number": 659, "display_filter": "frame.number == 659", "timestamp_epoch": "1533964545.748147000" }, { "tcp_stream": 108, "frame_number": 4626, "display_filter": "frame.number == 4626", "timestamp_epoch": "1533964555.042529000" }, { "tcp_stream": 107, "frame_number": 4629, "display_filter": "frame.number == 4629", "timestamp_epoch": "1533964555.043031000" }, { "tcp_stream": 199, "frame_number": 7944, "display_filter": "frame.number == 7944", "timestamp_epoch": "1533964897.818985000" }, { "tcp_stream": 198, "frame_number": 7946, "display_filter": "frame.number == 7946", "timestamp_epoch": "1533964897.819227000" }, { "tcp_stream": 227, "frame_number": 8747, "display_filter": "frame.number == 8747", "timestamp_epoch": "1533964898.710746000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5c78f52c22c49b1611a1a88c", "type": "domain", "value": "s-static.innovid.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 291, "frame_number": 32735, "display_filter": "frame.number == 32735", "timestamp_epoch": "1533965135.331791000" }, { "udp_stream": 291, "frame_number": 32736, "display_filter": "frame.number == 32736", "timestamp_epoch": "1533965135.439362000" }, { "tcp_stream": 892, "frame_number": 32745, "display_filter": "frame.number == 32745", "timestamp_epoch": "1533965135.491616000" }, { "tcp_stream": 893, "frame_number": 32747, "display_filter": "frame.number == 32747", "timestamp_epoch": "1533965135.491714000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f87c37af5eb886e787990dcb", "type": "domain", "value": "s.amazon-adsystem.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 101, "frame_number": 8913, "display_filter": "frame.number == 8913", "timestamp_epoch": "1533964898.856145000" }, { "udp_stream": 101, "frame_number": 8957, "display_filter": "frame.number == 8957", "timestamp_epoch": "1533964898.930358000" }, { "tcp_stream": 234, "frame_number": 9086, "display_filter": "frame.number == 9086", "timestamp_epoch": "1533964899.055405000" }, { "tcp_stream": 233, "frame_number": 9088, "display_filter": "frame.number == 9088", "timestamp_epoch": "1533964899.055718000" }, { "tcp_stream": 544, "frame_number": 19098, "display_filter": "frame.number == 19098", "timestamp_epoch": "1533964960.618687000" }, { "tcp_stream": 543, "frame_number": 19101, "display_filter": "frame.number == 19101", "timestamp_epoch": "1533964960.619057000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-fe3df222de8acea991a5fb40", "type": "domain", "value": "s.gycs.b.yahoodns.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 194, "frame_number": 18742, "display_filter": "frame.number == 18742", "timestamp_epoch": "1533964959.980701000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-cb643c32a406f574d576366c", "type": "domain", "value": "s.innovid.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 293, "frame_number": 32839, "display_filter": "frame.number == 32839", "timestamp_epoch": "1533965136.010238000" }, { "udp_stream": 293, "frame_number": 32841, "display_filter": "frame.number == 32841", "timestamp_epoch": "1533965136.087192000" }, { "tcp_stream": 894, "frame_number": 32878, "display_filter": "frame.number == 32878", "timestamp_epoch": "1533965136.227907000" }, { "tcp_stream": 895, "frame_number": 32880, "display_filter": "frame.number == 32880", "timestamp_epoch": "1533965136.228296000" }, { "tcp_stream": 999, "frame_number": 38768, "display_filter": "frame.number == 38768", "timestamp_epoch": "1533965239.786732000" }, { "tcp_stream": 998, "frame_number": 38770, "display_filter": "frame.number == 38770", "timestamp_epoch": "1533965239.786944000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-22739733a5ff64406b6cef0b", "type": "domain", "value": "s.thebrighttag.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 260, "frame_number": 27304, "display_filter": "frame.number == 27304", "timestamp_epoch": "1533965035.353563000" }, { "udp_stream": 260, "frame_number": 27324, "display_filter": "frame.number == 27324", "timestamp_epoch": "1533965035.406855000" }, { "tcp_stream": 738, "frame_number": 27366, "display_filter": "frame.number == 27366", "timestamp_epoch": "1533965035.499245000" }, { "tcp_stream": 739, "frame_number": 27369, "display_filter": "frame.number == 27369", "timestamp_epoch": "1533965035.499724000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1df8d2aec8b6709f8fe2484e", "type": "domain", "value": "s.ytimg.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 356, "frame_number": 44989, "display_filter": "frame.number == 44989", "timestamp_epoch": "1533965786.599954000" }, { "udp_stream": 356, "frame_number": 45110, "display_filter": "frame.number == 45110", "timestamp_epoch": "1533965786.890742000" }, { "tcp_stream": 1195, "frame_number": 45296, "display_filter": "frame.number == 45296", "timestamp_epoch": "1533965787.326751000" }, { "tcp_stream": 1196, "frame_number": 45308, "display_filter": "frame.number == 45308", "timestamp_epoch": "1533965787.331292000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2df3f21d97039ad62e2a4343", "type": "domain", "value": "s0-2mdn-net.l.google.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 116, "frame_number": 10721, "display_filter": "frame.number == 10721", "timestamp_epoch": "1533964900.718497000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b4c3b0aceb29fffbb1f1ebd9", "type": "domain", "value": "s0.2mdn.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 116, "frame_number": 10635, "display_filter": "frame.number == 10635", "timestamp_epoch": "1533964900.651992000" }, { "udp_stream": 116, "frame_number": 10721, "display_filter": "frame.number == 10721", "timestamp_epoch": "1533964900.718497000" }, { "tcp_stream": 287, "frame_number": 10810, "display_filter": "frame.number == 10810", "timestamp_epoch": "1533964900.776539000" }, { "tcp_stream": 286, "frame_number": 10811, "display_filter": "frame.number == 10811", "timestamp_epoch": "1533964900.777020000" }, { "tcp_stream": 496, "frame_number": 17525, "display_filter": "frame.number == 17525", "timestamp_epoch": "1533964956.631645000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-429583988cd0cd07c1c2c693", "type": "domain", "value": "s2.adform.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 198, "frame_number": 19141, "display_filter": "frame.number == 19141", "timestamp_epoch": "1533964960.729475000" }, { "udp_stream": 198, "frame_number": 19168, "display_filter": "frame.number == 19168", "timestamp_epoch": "1533964960.869060000" }, { "tcp_stream": 547, "frame_number": 19173, "display_filter": "frame.number == 19173", "timestamp_epoch": "1533964960.919412000" }, { "tcp_stream": 548, "frame_number": 19177, "display_filter": "frame.number == 19177", "timestamp_epoch": "1533964960.930591000" }, { "tcp_stream": 953, "frame_number": 35507, "display_filter": "frame.number == 35507", "timestamp_epoch": "1533965160.284050000" }, { "tcp_stream": 952, "frame_number": 35509, "display_filter": "frame.number == 35509", "timestamp_epoch": "1533965160.284262000" }, { "tcp_stream": 1024, "frame_number": 39169, "display_filter": "frame.number == 39169", "timestamp_epoch": "1533965245.870184000" }, { "tcp_stream": 1025, "frame_number": 39173, "display_filter": "frame.number == 39173", "timestamp_epoch": "1533965245.872744000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ff81727a35b8413b6a99dc70", "type": "domain", "value": "saxp.zedo.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 129, "frame_number": 11983, "display_filter": "frame.number == 11983", "timestamp_epoch": "1533964901.806285000" }, { "udp_stream": 129, "frame_number": 12104, "display_filter": "frame.number == 12104", "timestamp_epoch": "1533964901.906766000" }, { "tcp_stream": 317, "frame_number": 12192, "display_filter": "frame.number == 12192", "timestamp_epoch": "1533964901.975102000" }, { "tcp_stream": 316, "frame_number": 12204, "display_filter": "frame.number == 12204", "timestamp_epoch": "1533964901.978717000" }, { "tcp_stream": 488, "frame_number": 17163, "display_filter": "frame.number == 17163", "timestamp_epoch": "1533964954.907270000" }, { "tcp_stream": 487, "frame_number": 17164, "display_filter": "frame.number == 17164", "timestamp_epoch": "1533964954.907271000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2c913dd76e2486223bad87ba", "type": "domain", "value": "sb.scorecardresearch.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 47, "frame_number": 3208, "display_filter": "frame.number == 3208", "timestamp_epoch": "1533964552.424918000" }, { "udp_stream": 47, "frame_number": 3334, "display_filter": "frame.number == 3334", "timestamp_epoch": "1533964552.716941000" }, { "tcp_stream": 91, "frame_number": 3496, "display_filter": "frame.number == 3496", "timestamp_epoch": "1533964552.884239000" }, { "tcp_stream": 90, "frame_number": 3504, "display_filter": "frame.number == 3504", "timestamp_epoch": "1533964552.885100000" }, { "tcp_stream": 212, "frame_number": 8415, "display_filter": "frame.number == 8415", "timestamp_epoch": "1533964898.250583000" }, { "tcp_stream": 213, "frame_number": 8419, "display_filter": "frame.number == 8419", "timestamp_epoch": "1533964898.250855000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-487178ef06d4aef29afe849e", "type": "domain", "value": "scontent.xx.fbcdn.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 342, "frame_number": 43674, "display_filter": "frame.number == 43674", "timestamp_epoch": "1533965783.128458000" }, { "udp_stream": 348, "frame_number": 44214, "display_filter": "frame.number == 44214", "timestamp_epoch": "1533965784.461656000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-06294fd4cceddd09616df55e", "type": "domain", "value": "secure-assets.rubiconproject.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 188, "frame_number": 18172, "display_filter": "frame.number == 18172", "timestamp_epoch": "1533964958.356489000" }, { "udp_stream": 188, "frame_number": 18210, "display_filter": "frame.number == 18210", "timestamp_epoch": "1533964958.485955000" }, { "tcp_stream": 516, "frame_number": 18246, "display_filter": "frame.number == 18246", "timestamp_epoch": "1533964958.557671000" }, { "tcp_stream": 515, "frame_number": 18248, "display_filter": "frame.number == 18248", "timestamp_epoch": "1533964958.557673000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-03a0c05ea51d08a8bdc0d39f", "type": "domain", "value": "secure.adnxs.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 184, "frame_number": 18164, "display_filter": "frame.number == 18164", "timestamp_epoch": "1533964958.349333000" }, { "udp_stream": 184, "frame_number": 18186, "display_filter": "frame.number == 18186", "timestamp_epoch": "1533964958.450245000" }, { "tcp_stream": 510, "frame_number": 18224, "display_filter": "frame.number == 18224", "timestamp_epoch": "1533964958.517047000" }, { "tcp_stream": 511, "frame_number": 18227, "display_filter": "frame.number == 18227", "timestamp_epoch": "1533964958.517518000" }, { "tcp_stream": 606, "frame_number": 22932, "display_filter": "frame.number == 22932", "timestamp_epoch": "1533964996.122063000" }, { "tcp_stream": 607, "frame_number": 22934, "display_filter": "frame.number == 22934", "timestamp_epoch": "1533964996.122233000" }, { "tcp_stream": 688, "frame_number": 26303, "display_filter": "frame.number == 26303", "timestamp_epoch": "1533965032.363879000" }, { "tcp_stream": 689, "frame_number": 26306, "display_filter": "frame.number == 26306", "timestamp_epoch": "1533965032.364251000" }, { "tcp_stream": 797, "frame_number": 29805, "display_filter": "frame.number == 29805", "timestamp_epoch": "1533965097.616034000" }, { "tcp_stream": 796, "frame_number": 29815, "display_filter": "frame.number == 29815", "timestamp_epoch": "1533965097.616746000" }, { "tcp_stream": 930, "frame_number": 33738, "display_filter": "frame.number == 33738", "timestamp_epoch": "1533965157.462503000" }, { "tcp_stream": 931, "frame_number": 33739, "display_filter": "frame.number == 33739", "timestamp_epoch": "1533965157.462612000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-9d396da74c91a84e4005ab93", "type": "domain", "value": "securepubads.g.doubleclick.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 54, "frame_number": 3793, "display_filter": "frame.number == 3793", "timestamp_epoch": "1533964553.386066000" }, { "udp_stream": 54, "frame_number": 3927, "display_filter": "frame.number == 3927", "timestamp_epoch": "1533964553.575840000" }, { "udp_stream": 346, "frame_number": 43899, "display_filter": "frame.number == 43899", "timestamp_epoch": "1533965783.771120000" }, { "udp_stream": 346, "frame_number": 44008, "display_filter": "frame.number == 44008", "timestamp_epoch": "1533965783.935554000" }, { "tcp_stream": 101, "frame_number": 4033, "display_filter": "frame.number == 4033", "timestamp_epoch": "1533964553.663008000" }, { "tcp_stream": 102, "frame_number": 4037, "display_filter": "frame.number == 4037", "timestamp_epoch": "1533964553.663428000" }, { "tcp_stream": 225, "frame_number": 8727, "display_filter": "frame.number == 8727", "timestamp_epoch": "1533964898.704460000" }, { "tcp_stream": 226, "frame_number": 8729, "display_filter": "frame.number == 8729", "timestamp_epoch": "1533964898.704490000" }, { "tcp_stream": 250, "frame_number": 9672, "display_filter": "frame.number == 9672", "timestamp_epoch": "1533964899.588524000" }, { "tcp_stream": 253, "frame_number": 9712, "display_filter": "frame.number == 9712", "timestamp_epoch": "1533964899.603389000" }, { "tcp_stream": 1162, "frame_number": 44040, "display_filter": "frame.number == 44040", "timestamp_epoch": "1533965784.020377000" }, { "tcp_stream": 1159, "frame_number": 44058, "display_filter": "frame.number == 44058", "timestamp_epoch": "1533965784.025460000" }, { "tcp_stream": 1158, "frame_number": 44060, "display_filter": "frame.number == 44060", "timestamp_epoch": "1533965784.025677000" }, { "tcp_stream": 1157, "frame_number": 44061, "display_filter": "frame.number == 44061", "timestamp_epoch": "1533965784.025785000" }, { "tcp_stream": 1161, "frame_number": 44063, "display_filter": "frame.number == 44063", "timestamp_epoch": "1533965784.025864000" }, { "tcp_stream": 1160, "frame_number": 44065, "display_filter": "frame.number == 44065", "timestamp_epoch": "1533965784.025952000" }, { "tcp_stream": 1164, "frame_number": 44265, "display_filter": "frame.number == 44265", "timestamp_epoch": "1533965784.616928000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8c7480a1e7bbc936e8367546", "type": "domain", "value": "simage2.pubmatic.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 170, "frame_number": 16023, "display_filter": "frame.number == 16023", "timestamp_epoch": "1533964908.405443000" }, { "udp_stream": 170, "frame_number": 16092, "display_filter": "frame.number == 16092", "timestamp_epoch": "1533964908.469322000" }, { "tcp_stream": 457, "frame_number": 16175, "display_filter": "frame.number == 16175", "timestamp_epoch": "1533964908.544073000" }, { "tcp_stream": 458, "frame_number": 16177, "display_filter": "frame.number == 16177", "timestamp_epoch": "1533964908.544241000" }, { "tcp_stream": 459, "frame_number": 16248, "display_filter": "frame.number == 16248", "timestamp_epoch": "1533964908.650930000" }, { "tcp_stream": 461, "frame_number": 16357, "display_filter": "frame.number == 16357", "timestamp_epoch": "1533964908.823331000" }, { "tcp_stream": 460, "frame_number": 16359, "display_filter": "frame.number == 16359", "timestamp_epoch": "1533964908.823497000" }, { "tcp_stream": 462, "frame_number": 16375, "display_filter": "frame.number == 16375", "timestamp_epoch": "1533964908.839064000" }, { "tcp_stream": 708, "frame_number": 26676, "display_filter": "frame.number == 26676", "timestamp_epoch": "1533965033.341346000" }, { "tcp_stream": 824, "frame_number": 30791, "display_filter": "frame.number == 30791", "timestamp_epoch": "1533965099.271843000" }, { "tcp_stream": 825, "frame_number": 30797, "display_filter": "frame.number == 30797", "timestamp_epoch": "1533965099.273256000" }, { "tcp_stream": 854, "frame_number": 31701, "display_filter": "frame.number == 31701", "timestamp_epoch": "1533965100.810915000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c541e06dd8fdccadd046d445", "type": "domain", "value": "simage4.pubmatic.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 176, "frame_number": 16707, "display_filter": "frame.number == 16707", "timestamp_epoch": "1533964910.343517000" }, { "udp_stream": 176, "frame_number": 16722, "display_filter": "frame.number == 16722", "timestamp_epoch": "1533964910.397514000" }, { "tcp_stream": 481, "frame_number": 16757, "display_filter": "frame.number == 16757", "timestamp_epoch": "1533964910.464401000" }, { "tcp_stream": 482, "frame_number": 16759, "display_filter": "frame.number == 16759", "timestamp_epoch": "1533964910.464624000" }, { "tcp_stream": 856, "frame_number": 31729, "display_filter": "frame.number == 31729", "timestamp_epoch": "1533965100.860099000" }, { "tcp_stream": 857, "frame_number": 31774, "display_filter": "frame.number == 31774", "timestamp_epoch": "1533965100.889903000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a66177e6ad5bf9afeabc8af0", "type": "domain", "value": "small-video.edgecast.syn-cdn.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 214, "frame_number": 20089, "display_filter": "frame.number == 20089", "timestamp_epoch": "1533964964.568163000" }, { "udp_stream": 214, "frame_number": 20116, "display_filter": "frame.number == 20116", "timestamp_epoch": "1533964964.705871000" }, { "tcp_stream": 583, "frame_number": 20139, "display_filter": "frame.number == 20139", "timestamp_epoch": "1533964964.765035000" }, { "tcp_stream": 584, "frame_number": 20140, "display_filter": "frame.number == 20140", "timestamp_epoch": "1533964964.765162000" }, { "tcp_stream": 682, "frame_number": 24588, "display_filter": "frame.number == 24588", "timestamp_epoch": "1533965020.346497000" }, { "tcp_stream": 683, "frame_number": 24589, "display_filter": "frame.number == 24589", "timestamp_epoch": "1533965020.346498000" }, { "tcp_stream": 788, "frame_number": 28739, "display_filter": "frame.number == 28739", "timestamp_epoch": "1533965094.680368000" }, { "tcp_stream": 789, "frame_number": 28740, "display_filter": "frame.number == 28740", "timestamp_epoch": "1533965094.680431000" }, { "tcp_stream": 929, "frame_number": 33675, "display_filter": "frame.number == 33675", "timestamp_epoch": "1533965157.342011000" }, { "tcp_stream": 928, "frame_number": 33683, "display_filter": "frame.number == 33683", "timestamp_epoch": "1533965157.342873000" }, { "tcp_stream": 985, "frame_number": 37134, "display_filter": "frame.number == 37134", "timestamp_epoch": "1533965226.489331000" }, { "tcp_stream": 986, "frame_number": 37135, "display_filter": "frame.number == 37135", "timestamp_epoch": "1533965226.489332000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-905f3038f62260632373b4b7", "type": "domain", "value": "smi2.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 124, "frame_number": 11427, "display_filter": "frame.number == 11427", "timestamp_epoch": "1533964901.269376000" }, { "udp_stream": 123, "frame_number": 11477, "display_filter": "frame.number == 11477", "timestamp_epoch": "1533964901.323587000" }, { "udp_stream": 124, "frame_number": 11530, "display_filter": "frame.number == 11530", "timestamp_epoch": "1533964901.340738000" }, { "tcp_stream": 304, "frame_number": 11837, "display_filter": "frame.number == 11837", "timestamp_epoch": "1533964901.592161000" }, { "tcp_stream": 305, "frame_number": 11855, "display_filter": "frame.number == 11855", "timestamp_epoch": "1533964901.598922000" } ], "roles": [ "dns-cname", "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1c52ff59ffc1a921dafa4d9c", "type": "domain", "value": "smi2.ru", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 122, "frame_number": 11425, "display_filter": "frame.number == 11425", "timestamp_epoch": "1533964901.268836000" }, { "udp_stream": 122, "frame_number": 11789, "display_filter": "frame.number == 11789", "timestamp_epoch": "1533964901.574246000" }, { "tcp_stream": 307, "frame_number": 12000, "display_filter": "frame.number == 12000", "timestamp_epoch": "1533964901.816031000" }, { "tcp_stream": 306, "frame_number": 12008, "display_filter": "frame.number == 12008", "timestamp_epoch": "1533964901.819747000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-639421cdbb4a7ac54093323c", "type": "domain", "value": "smtp.yandex.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 88, "frame_number": 7088, "display_filter": "frame.number == 7088", "timestamp_epoch": "1533964677.171851000" }, { "udp_stream": 88, "frame_number": 7089, "display_filter": "frame.number == 7089", "timestamp_epoch": "1533964677.421170000" }, { "udp_stream": 319, "frame_number": 39903, "display_filter": "frame.number == 39903", "timestamp_epoch": "1533965605.526057000" }, { "udp_stream": 319, "frame_number": 39904, "display_filter": "frame.number == 39904", "timestamp_epoch": "1533965605.965885000" }, { "tcp_stream": 172, "frame_number": 7093, "display_filter": "frame.number == 7093", "timestamp_epoch": "1533964677.699779000" }, { "tcp_stream": 1059, "frame_number": 39908, "display_filter": "frame.number == 39908", "timestamp_epoch": "1533965606.395386000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c46be5a4c6b196d790545a89", "type": "domain", "value": "smtp.yandex.ru", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 88, "frame_number": 7089, "display_filter": "frame.number == 7089", "timestamp_epoch": "1533964677.421170000" }, { "udp_stream": 319, "frame_number": 39904, "display_filter": "frame.number == 39904", "timestamp_epoch": "1533965605.965885000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-fd3c7b24950abe944721a113", "type": "domain", "value": "sputnikhouse-dc.sputnikhouse.org", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 6, "frame_number": 15, "display_filter": "frame.number == 15", "timestamp_epoch": "1533964509.084305000" }, { "udp_stream": 6, "frame_number": 16, "display_filter": "frame.number == 16", "timestamp_epoch": "1533964509.084490000" }, { "udp_stream": 21, "frame_number": 334, "display_filter": "frame.number == 334", "timestamp_epoch": "1533964517.018976000" }, { "udp_stream": 21, "frame_number": 335, "display_filter": "frame.number == 335", "timestamp_epoch": "1533964517.019178000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f21185fc200c9a6eef3b0a3a", "type": "domain", "value": "sputnikhouse.org", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:49:00.339668+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:00.335254+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 23, "frame_number": 376, "display_filter": "frame.number == 376", "timestamp_epoch": "1533964517.090941000" }, { "udp_stream": 23, "frame_number": 377, "display_filter": "frame.number == 377", "timestamp_epoch": "1533964517.092165000" }, { "udp_stream": 315, "frame_number": 39655, "display_filter": "frame.number == 39655", "timestamp_epoch": "1533965410.183603000" }, { "udp_stream": 315, "frame_number": 39656, "display_filter": "frame.number == 39656", "timestamp_epoch": "1533965410.184627000" }, { "udp_stream": 317, "frame_number": 39659, "display_filter": "frame.number == 39659", "timestamp_epoch": "1533965410.186117000" }, { "udp_stream": 317, "frame_number": 39660, "display_filter": "frame.number == 39660", "timestamp_epoch": "1533965410.186527000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:49:00.329591+00:00" }, { "observable_id": "observable-e970649f782d9ce881145170", "type": "domain", "value": "ss3.zedo.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 114, "frame_number": 10605, "display_filter": "frame.number == 10605", "timestamp_epoch": "1533964900.561105000" }, { "udp_stream": 114, "frame_number": 10640, "display_filter": "frame.number == 10640", "timestamp_epoch": "1533964900.661382000" }, { "tcp_stream": 284, "frame_number": 10687, "display_filter": "frame.number == 10687", "timestamp_epoch": "1533964900.709018000" }, { "tcp_stream": 285, "frame_number": 10717, "display_filter": "frame.number == 10717", "timestamp_epoch": "1533964900.716816000" }, { "tcp_stream": 336, "frame_number": 13104, "display_filter": "frame.number == 13104", "timestamp_epoch": "1533964903.067416000" }, { "tcp_stream": 386, "frame_number": 14590, "display_filter": "frame.number == 14590", "timestamp_epoch": "1533964904.627776000" }, { "tcp_stream": 389, "frame_number": 14606, "display_filter": "frame.number == 14606", "timestamp_epoch": "1533964904.635702000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-65034a4ec011119eb75abb1b", "type": "domain", "value": "ssl.cdn.marphezis.com.c.footprint.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 107, "frame_number": 9794, "display_filter": "frame.number == 9794", "timestamp_epoch": "1533964899.640925000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-15b9d82a9c8a53e806f88827", "type": "domain", "value": "ssl.trustwave.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 67, "frame_number": 5349, "display_filter": "frame.number == 5349", "timestamp_epoch": "1533964556.352409000" }, { "udp_stream": 68, "frame_number": 5350, "display_filter": "frame.number == 5350", "timestamp_epoch": "1533964556.353582000" }, { "udp_stream": 68, "frame_number": 5371, "display_filter": "frame.number == 5371", "timestamp_epoch": "1533964556.454915000" }, { "udp_stream": 67, "frame_number": 5372, "display_filter": "frame.number == 5372", "timestamp_epoch": "1533964556.455020000" }, { "tcp_stream": 127, "frame_number": 5383, "display_filter": "frame.number == 5383", "timestamp_epoch": "1533964556.494073000" }, { "tcp_stream": 128, "frame_number": 5387, "display_filter": "frame.number == 5387", "timestamp_epoch": "1533964556.515882000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ce1fd16a4cfab56f335ee427", "type": "domain", "value": "stags.bluekai.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 127, "frame_number": 11860, "display_filter": "frame.number == 11860", "timestamp_epoch": "1533964901.603537000" }, { "udp_stream": 127, "frame_number": 11957, "display_filter": "frame.number == 11957", "timestamp_epoch": "1533964901.767352000" }, { "tcp_stream": 312, "frame_number": 12022, "display_filter": "frame.number == 12022", "timestamp_epoch": "1533964901.828960000" }, { "tcp_stream": 313, "frame_number": 12023, "display_filter": "frame.number == 12023", "timestamp_epoch": "1533964901.829056000" }, { "tcp_stream": 752, "frame_number": 27530, "display_filter": "frame.number == 27530", "timestamp_epoch": "1533965035.693095000" }, { "tcp_stream": 753, "frame_number": 27540, "display_filter": "frame.number == 27540", "timestamp_epoch": "1533965035.697280000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5efb2c47f38bcae101ac79f4", "type": "domain", "value": "stat.media", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 105, "frame_number": 9226, "display_filter": "frame.number == 9226", "timestamp_epoch": "1533964899.129114000" }, { "udp_stream": 105, "frame_number": 9340, "display_filter": "frame.number == 9340", "timestamp_epoch": "1533964899.269568000" }, { "tcp_stream": 244, "frame_number": 9758, "display_filter": "frame.number == 9758", "timestamp_epoch": "1533964899.626749000" }, { "tcp_stream": 245, "frame_number": 9775, "display_filter": "frame.number == 9775", "timestamp_epoch": "1533964899.632814000" }, { "tcp_stream": 1030, "frame_number": 39352, "display_filter": "frame.number == 39352", "timestamp_epoch": "1533965247.228409000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6258a03ac4ea72d0d9f1272f", "type": "domain", "value": "static-doubleclick-net.l.google.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 70, "frame_number": 5456, "display_filter": "frame.number == 5456", "timestamp_epoch": "1533964556.909758000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-71119eac0fa72837c91c31f6", "type": "domain", "value": "static.chartbeat.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 72, "frame_number": 5845, "display_filter": "frame.number == 5845", "timestamp_epoch": "1533964559.338775000" }, { "udp_stream": 72, "frame_number": 5857, "display_filter": "frame.number == 5857", "timestamp_epoch": "1533964559.422782000" }, { "tcp_stream": 138, "frame_number": 5881, "display_filter": "frame.number == 5881", "timestamp_epoch": "1533964559.508438000" }, { "tcp_stream": 139, "frame_number": 5887, "display_filter": "frame.number == 5887", "timestamp_epoch": "1533964559.509117000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-22d785f45d8af228c076c4f3", "type": "domain", "value": "static.criteo.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 161, "frame_number": 15268, "display_filter": "frame.number == 15268", "timestamp_epoch": "1533964906.418364000" }, { "udp_stream": 161, "frame_number": 15402, "display_filter": "frame.number == 15402", "timestamp_epoch": "1533964906.564513000" }, { "tcp_stream": 423, "frame_number": 15565, "display_filter": "frame.number == 15565", "timestamp_epoch": "1533964906.748908000" }, { "tcp_stream": 424, "frame_number": 15569, "display_filter": "frame.number == 15569", "timestamp_epoch": "1533964906.750692000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-de6d640b8c40ffea9be0bb7e", "type": "domain", "value": "static.doubleclick.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 70, "frame_number": 5433, "display_filter": "frame.number == 5433", "timestamp_epoch": "1533964556.839610000" }, { "udp_stream": 70, "frame_number": 5456, "display_filter": "frame.number == 5456", "timestamp_epoch": "1533964556.909758000" }, { "tcp_stream": 132, "frame_number": 5541, "display_filter": "frame.number == 5541", "timestamp_epoch": "1533964557.014836000" }, { "tcp_stream": 133, "frame_number": 5551, "display_filter": "frame.number == 5551", "timestamp_epoch": "1533964557.021044000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-baeaa698b6eecdba87b814e7", "type": "domain", "value": "static.mixi.media", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 103, "frame_number": 9215, "display_filter": "frame.number == 9215", "timestamp_epoch": "1533964899.117813000" }, { "udp_stream": 103, "frame_number": 9470, "display_filter": "frame.number == 9470", "timestamp_epoch": "1533964899.377567000" }, { "tcp_stream": 257, "frame_number": 9724, "display_filter": "frame.number == 9724", "timestamp_epoch": "1533964899.606021000" }, { "tcp_stream": 255, "frame_number": 9735, "display_filter": "frame.number == 9735", "timestamp_epoch": "1533964899.613515000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d46353b238dfea541613e838", "type": "domain", "value": "static2.mixi.media", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 131, "frame_number": 12058, "display_filter": "frame.number == 12058", "timestamp_epoch": "1533964901.857130000" }, { "udp_stream": 131, "frame_number": 12208, "display_filter": "frame.number == 12208", "timestamp_epoch": "1533964901.980409000" }, { "tcp_stream": 318, "frame_number": 12443, "display_filter": "frame.number == 12443", "timestamp_epoch": "1533964902.281194000" }, { "tcp_stream": 319, "frame_number": 12455, "display_filter": "frame.number == 12455", "timestamp_epoch": "1533964902.286395000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d841dc4fba998a511800844e", "type": "domain", "value": "static4.mixi.media", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 130, "frame_number": 12052, "display_filter": "frame.number == 12052", "timestamp_epoch": "1533964901.855110000" }, { "udp_stream": 130, "frame_number": 12212, "display_filter": "frame.number == 12212", "timestamp_epoch": "1533964901.981250000" }, { "tcp_stream": 321, "frame_number": 12437, "display_filter": "frame.number == 12437", "timestamp_epoch": "1533964902.280038000" }, { "tcp_stream": 320, "frame_number": 12477, "display_filter": "frame.number == 12477", "timestamp_epoch": "1533964902.313628000" }, { "tcp_stream": 326, "frame_number": 12727, "display_filter": "frame.number == 12727", "timestamp_epoch": "1533964902.689619000" }, { "tcp_stream": 327, "frame_number": 12751, "display_filter": "frame.number == 12751", "timestamp_epoch": "1533964902.700649000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0260b6f9624747d3f21c6bdd", "type": "domain", "value": "static5.mixi.media", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 134, "frame_number": 12649, "display_filter": "frame.number == 12649", "timestamp_epoch": "1533964902.596451000" }, { "udp_stream": 134, "frame_number": 12763, "display_filter": "frame.number == 12763", "timestamp_epoch": "1533964902.706045000" }, { "tcp_stream": 328, "frame_number": 12824, "display_filter": "frame.number == 12824", "timestamp_epoch": "1533964902.792686000" }, { "tcp_stream": 329, "frame_number": 12847, "display_filter": "frame.number == 12847", "timestamp_epoch": "1533964902.811465000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-52c9f4f1fd3cceb704a7fb8c", "type": "domain", "value": "staticxx.facebook.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:46:55.130563+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:58.424653+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 348, "frame_number": 44116, "display_filter": "frame.number == 44116", "timestamp_epoch": "1533965784.194344000" }, { "udp_stream": 348, "frame_number": 44214, "display_filter": "frame.number == 44214", "timestamp_epoch": "1533965784.461656000" }, { "tcp_stream": 1168, "frame_number": 44338, "display_filter": "frame.number == 44338", "timestamp_epoch": "1533965784.993306000" }, { "tcp_stream": 1169, "frame_number": 44341, "display_filter": "frame.number == 44341", "timestamp_epoch": "1533965784.994092000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:58.420275+00:00" }, { "observable_id": "observable-e3af2e201ccd463d8408bdc2", "type": "domain", "value": "stats.g.doubleclick.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 57, "frame_number": 4243, "display_filter": "frame.number == 4243", "timestamp_epoch": "1533964554.012005000" }, { "udp_stream": 57, "frame_number": 4326, "display_filter": "frame.number == 4326", "timestamp_epoch": "1533964554.232211000" }, { "udp_stream": 355, "frame_number": 44973, "display_filter": "frame.number == 44973", "timestamp_epoch": "1533965786.582537000" }, { "udp_stream": 355, "frame_number": 45074, "display_filter": "frame.number == 45074", "timestamp_epoch": "1533965786.808030000" }, { "tcp_stream": 105, "frame_number": 4404, "display_filter": "frame.number == 4404", "timestamp_epoch": "1533964554.396779000" }, { "tcp_stream": 106, "frame_number": 4412, "display_filter": "frame.number == 4412", "timestamp_epoch": "1533964554.397822000" }, { "tcp_stream": 219, "frame_number": 8691, "display_filter": "frame.number == 8691", "timestamp_epoch": "1533964898.653579000" }, { "tcp_stream": 220, "frame_number": 8693, "display_filter": "frame.number == 8693", "timestamp_epoch": "1533964898.654114000" }, { "tcp_stream": 1193, "frame_number": 45285, "display_filter": "frame.number == 45285", "timestamp_epoch": "1533965787.316948000" }, { "tcp_stream": 1194, "frame_number": 45288, "display_filter": "frame.number == 45288", "timestamp_epoch": "1533965787.317460000" }, { "tcp_stream": 1199, "frame_number": 45475, "display_filter": "frame.number == 45475", "timestamp_epoch": "1533965787.976322000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6dca5138dbb3f442ea4f11ea", "type": "domain", "value": "stats.l.doubleclick.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 57, "frame_number": 4326, "display_filter": "frame.number == 4326", "timestamp_epoch": "1533964554.232211000" }, { "udp_stream": 355, "frame_number": 45074, "display_filter": "frame.number == 45074", "timestamp_epoch": "1533965786.808030000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6830bd86bf151cf528592b13", "type": "domain", "value": "su.addthis.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 238, "frame_number": 24025, "display_filter": "frame.number == 24025", "timestamp_epoch": "1533964999.378086000" }, { "udp_stream": 238, "frame_number": 24043, "display_filter": "frame.number == 24043", "timestamp_epoch": "1533964999.497119000" }, { "tcp_stream": 672, "frame_number": 24083, "display_filter": "frame.number == 24083", "timestamp_epoch": "1533964999.565656000" }, { "tcp_stream": 673, "frame_number": 24088, "display_filter": "frame.number == 24088", "timestamp_epoch": "1533964999.566369000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-60ab8cb6148eddf58a42d90f", "type": "domain", "value": "synacor.autoplay-plugins.static-origin.syn-cdn.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 219, "frame_number": 20426, "display_filter": "frame.number == 20426", "timestamp_epoch": "1533964965.457165000" }, { "udp_stream": 219, "frame_number": 20551, "display_filter": "frame.number == 20551", "timestamp_epoch": "1533964965.682355000" }, { "tcp_stream": 595, "frame_number": 20746, "display_filter": "frame.number == 20746", "timestamp_epoch": "1533964966.367680000" }, { "tcp_stream": 596, "frame_number": 20749, "display_filter": "frame.number == 20749", "timestamp_epoch": "1533964966.368072000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4d8b31486e214b8b299baecb", "type": "domain", "value": "sync-tm.everesttech.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 63, "frame_number": 5078, "display_filter": "frame.number == 5078", "timestamp_epoch": "1533964555.920668000" }, { "udp_stream": 63, "frame_number": 5155, "display_filter": "frame.number == 5155", "timestamp_epoch": "1533964556.031163000" }, { "tcp_stream": 125, "frame_number": 5214, "display_filter": "frame.number == 5214", "timestamp_epoch": "1533964556.094107000" }, { "tcp_stream": 126, "frame_number": 5218, "display_filter": "frame.number == 5218", "timestamp_epoch": "1533964556.094443000" }, { "tcp_stream": 446, "frame_number": 16001, "display_filter": "frame.number == 16001", "timestamp_epoch": "1533964908.387464000" }, { "tcp_stream": 445, "frame_number": 16002, "display_filter": "frame.number == 16002", "timestamp_epoch": "1533964908.387715000" }, { "tcp_stream": 735, "frame_number": 27313, "display_filter": "frame.number == 27313", "timestamp_epoch": "1533965035.371926000" }, { "tcp_stream": 734, "frame_number": 27315, "display_filter": "frame.number == 27315", "timestamp_epoch": "1533965035.374382000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-03cfc4a9abad3c07a273f07a", "type": "domain", "value": "sync.1rx.io", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 186, "frame_number": 18168, "display_filter": "frame.number == 18168", "timestamp_epoch": "1533964958.352910000" }, { "udp_stream": 186, "frame_number": 18183, "display_filter": "frame.number == 18183", "timestamp_epoch": "1533964958.434721000" }, { "tcp_stream": 507, "frame_number": 18238, "display_filter": "frame.number == 18238", "timestamp_epoch": "1533964958.548661000" }, { "tcp_stream": 506, "frame_number": 18239, "display_filter": "frame.number == 18239", "timestamp_epoch": "1533964958.549363000" }, { "tcp_stream": 800, "frame_number": 29920, "display_filter": "frame.number == 29920", "timestamp_epoch": "1533965097.843316000" }, { "tcp_stream": 801, "frame_number": 29921, "display_filter": "frame.number == 29921", "timestamp_epoch": "1533965097.843521000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-077d732115b658a278858ae7", "type": "domain", "value": "sync.adotmob.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 303, "frame_number": 35494, "display_filter": "frame.number == 35494", "timestamp_epoch": "1533965160.271065000" }, { "udp_stream": 303, "frame_number": 35536, "display_filter": "frame.number == 35536", "timestamp_epoch": "1533965160.370088000" }, { "tcp_stream": 966, "frame_number": 35619, "display_filter": "frame.number == 35619", "timestamp_epoch": "1533965160.477153000" }, { "tcp_stream": 967, "frame_number": 35623, "display_filter": "frame.number == 35623", "timestamp_epoch": "1533965160.478568000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3c0b506b1a253b6bd83095b5", "type": "domain", "value": "sync.aralego.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 187, "frame_number": 18169, "display_filter": "frame.number == 18169", "timestamp_epoch": "1533964958.353897000" }, { "udp_stream": 187, "frame_number": 18189, "display_filter": "frame.number == 18189", "timestamp_epoch": "1533964958.450799000" }, { "tcp_stream": 508, "frame_number": 18254, "display_filter": "frame.number == 18254", "timestamp_epoch": "1533964958.577179000" }, { "tcp_stream": 509, "frame_number": 18255, "display_filter": "frame.number == 18255", "timestamp_epoch": "1533964958.577252000" }, { "tcp_stream": 608, "frame_number": 22962, "display_filter": "frame.number == 22962", "timestamp_epoch": "1533964996.224007000" }, { "tcp_stream": 609, "frame_number": 22964, "display_filter": "frame.number == 22964", "timestamp_epoch": "1533964996.224362000" }, { "tcp_stream": 691, "frame_number": 26336, "display_filter": "frame.number == 26336", "timestamp_epoch": "1533965032.448005000" }, { "tcp_stream": 690, "frame_number": 26340, "display_filter": "frame.number == 26340", "timestamp_epoch": "1533965032.448472000" }, { "tcp_stream": 802, "frame_number": 29929, "display_filter": "frame.number == 29929", "timestamp_epoch": "1533965097.843912000" }, { "tcp_stream": 803, "frame_number": 32200, "display_filter": "frame.number == 32200", "timestamp_epoch": "1533965101.975590000" }, { "tcp_stream": 932, "frame_number": 33796, "display_filter": "frame.number == 33796", "timestamp_epoch": "1533965157.589684000" }, { "tcp_stream": 933, "frame_number": 33798, "display_filter": "frame.number == 33798", "timestamp_epoch": "1533965157.590054000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1df51e6d328380bf802f2668", "type": "domain", "value": "sync.crwdcntrl.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 242, "frame_number": 24211, "display_filter": "frame.number == 24211", "timestamp_epoch": "1533965000.652945000" }, { "udp_stream": 242, "frame_number": 24227, "display_filter": "frame.number == 24227", "timestamp_epoch": "1533965001.652660000" }, { "udp_stream": 242, "frame_number": 24228, "display_filter": "frame.number == 24228", "timestamp_epoch": "1533965001.681775000" }, { "tcp_stream": 676, "frame_number": 24245, "display_filter": "frame.number == 24245", "timestamp_epoch": "1533965002.158999000" }, { "tcp_stream": 677, "frame_number": 24246, "display_filter": "frame.number == 24246", "timestamp_epoch": "1533965002.159159000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d6d20f0e0b8b14e52bec9cb4", "type": "domain", "value": "sync.extend.tv", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 250, "frame_number": 26700, "display_filter": "frame.number == 26700", "timestamp_epoch": "1533965033.402325000" }, { "udp_stream": 250, "frame_number": 26727, "display_filter": "frame.number == 26727", "timestamp_epoch": "1533965033.481280000" }, { "tcp_stream": 715, "frame_number": 26787, "display_filter": "frame.number == 26787", "timestamp_epoch": "1533965033.600626000" }, { "tcp_stream": 716, "frame_number": 26792, "display_filter": "frame.number == 26792", "timestamp_epoch": "1533965033.601127000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-70db6675cba1133cab8a89eb", "type": "domain", "value": "sync.ipredictive.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 227, "frame_number": 23249, "display_filter": "frame.number == 23249", "timestamp_epoch": "1533964997.188987000" }, { "udp_stream": 227, "frame_number": 23293, "display_filter": "frame.number == 23293", "timestamp_epoch": "1533964997.291196000" }, { "tcp_stream": 634, "frame_number": 23420, "display_filter": "frame.number == 23420", "timestamp_epoch": "1533964997.428617000" }, { "tcp_stream": 635, "frame_number": 23422, "display_filter": "frame.number == 23422", "timestamp_epoch": "1533964997.428749000" }, { "tcp_stream": 822, "frame_number": 30826, "display_filter": "frame.number == 30826", "timestamp_epoch": "1533965099.301400000" }, { "tcp_stream": 823, "frame_number": 30827, "display_filter": "frame.number == 30827", "timestamp_epoch": "1533965099.301617000" }, { "tcp_stream": 954, "frame_number": 35577, "display_filter": "frame.number == 35577", "timestamp_epoch": "1533965160.397970000" }, { "tcp_stream": 955, "frame_number": 35578, "display_filter": "frame.number == 35578", "timestamp_epoch": "1533965160.398032000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-637a468a7136b9a0e96224f3", "type": "domain", "value": "sync.ligadx.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 286, "frame_number": 31612, "display_filter": "frame.number == 31612", "timestamp_epoch": "1533965100.695740000" }, { "udp_stream": 286, "frame_number": 31668, "display_filter": "frame.number == 31668", "timestamp_epoch": "1533965100.795644000" }, { "tcp_stream": 859, "frame_number": 31772, "display_filter": "frame.number == 31772", "timestamp_epoch": "1533965100.889802000" }, { "tcp_stream": 863, "frame_number": 31804, "display_filter": "frame.number == 31804", "timestamp_epoch": "1533965100.914146000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f41604ef74c26925619e658d", "type": "domain", "value": "sync.mathtag.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 61, "frame_number": 5075, "display_filter": "frame.number == 5075", "timestamp_epoch": "1533964555.919335000" }, { "udp_stream": 61, "frame_number": 5120, "display_filter": "frame.number == 5120", "timestamp_epoch": "1533964555.984165000" }, { "tcp_stream": 115, "frame_number": 5234, "display_filter": "frame.number == 5234", "timestamp_epoch": "1533964556.109083000" }, { "tcp_stream": 116, "frame_number": 5237, "display_filter": "frame.number == 5237", "timestamp_epoch": "1533964556.109634000" }, { "tcp_stream": 448, "frame_number": 16046, "display_filter": "frame.number == 16046", "timestamp_epoch": "1533964908.428705000" }, { "tcp_stream": 447, "frame_number": 16047, "display_filter": "frame.number == 16047", "timestamp_epoch": "1533964908.428863000" }, { "tcp_stream": 834, "frame_number": 31082, "display_filter": "frame.number == 31082", "timestamp_epoch": "1533965099.810576000" }, { "tcp_stream": 835, "frame_number": 31084, "display_filter": "frame.number == 31084", "timestamp_epoch": "1533965099.810884000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-91d26e2caf83668f569287b7", "type": "domain", "value": "sync.search.spotxchange.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 209, "frame_number": 19655, "display_filter": "frame.number == 19655", "timestamp_epoch": "1533964962.787611000" }, { "udp_stream": 209, "frame_number": 19708, "display_filter": "frame.number == 19708", "timestamp_epoch": "1533964962.901909000" }, { "tcp_stream": 571, "frame_number": 19769, "display_filter": "frame.number == 19769", "timestamp_epoch": "1533964962.999760000" }, { "tcp_stream": 570, "frame_number": 19784, "display_filter": "frame.number == 19784", "timestamp_epoch": "1533964963.001886000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d0ad87d83b940e521dec400b", "type": "domain", "value": "sync.springserve.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 185, "frame_number": 18167, "display_filter": "frame.number == 18167", "timestamp_epoch": "1533964958.352142000" }, { "udp_stream": 185, "frame_number": 18200, "display_filter": "frame.number == 18200", "timestamp_epoch": "1533964958.477773000" }, { "tcp_stream": 512, "frame_number": 18262, "display_filter": "frame.number == 18262", "timestamp_epoch": "1533964958.578339000" }, { "tcp_stream": 513, "frame_number": 18263, "display_filter": "frame.number == 18263", "timestamp_epoch": "1533964958.578487000" }, { "tcp_stream": 798, "frame_number": 29816, "display_filter": "frame.number == 29816", "timestamp_epoch": "1533965097.616748000" }, { "tcp_stream": 799, "frame_number": 29829, "display_filter": "frame.number == 29829", "timestamp_epoch": "1533965097.622782000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8fbf32ad297ed39e32b126c6", "type": "domain", "value": "sync.teads.tv", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 266, "frame_number": 27458, "display_filter": "frame.number == 27458", "timestamp_epoch": "1533965035.636894000" }, { "udp_stream": 266, "frame_number": 27558, "display_filter": "frame.number == 27558", "timestamp_epoch": "1533965035.720501000" }, { "tcp_stream": 762, "frame_number": 27715, "display_filter": "frame.number == 27715", "timestamp_epoch": "1533965035.911213000" }, { "tcp_stream": 763, "frame_number": 27723, "display_filter": "frame.number == 27723", "timestamp_epoch": "1533965035.926535000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f9fa8ac6d816991f38332f0b", "type": "domain", "value": "sync.tidaltv.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 252, "frame_number": 26702, "display_filter": "frame.number == 26702", "timestamp_epoch": "1533965033.403252000" }, { "udp_stream": 252, "frame_number": 26736, "display_filter": "frame.number == 26736", "timestamp_epoch": "1533965033.496493000" }, { "tcp_stream": 717, "frame_number": 26779, "display_filter": "frame.number == 26779", "timestamp_epoch": "1533965033.599995000" }, { "tcp_stream": 718, "frame_number": 26780, "display_filter": "frame.number == 26780", "timestamp_epoch": "1533965033.600087000" }, { "tcp_stream": 819, "frame_number": 30670, "display_filter": "frame.number == 30670", "timestamp_epoch": "1533965099.047943000" }, { "tcp_stream": 818, "frame_number": 30675, "display_filter": "frame.number == 30675", "timestamp_epoch": "1533965099.048530000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b592ac0bf7ba67806fe96635", "type": "domain", "value": "synchroscript.deliveryengine.adswizz.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 305, "frame_number": 35496, "display_filter": "frame.number == 35496", "timestamp_epoch": "1533965160.271640000" }, { "udp_stream": 305, "frame_number": 35537, "display_filter": "frame.number == 35537", "timestamp_epoch": "1533965160.370309000" }, { "tcp_stream": 969, "frame_number": 35709, "display_filter": "frame.number == 35709", "timestamp_epoch": "1533965160.581392000" }, { "tcp_stream": 968, "frame_number": 35730, "display_filter": "frame.number == 35730", "timestamp_epoch": "1533965160.668665000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-737ea5e6401fb1563d580f4c", "type": "domain", "value": "syndication.twitter.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 352, "frame_number": 44228, "display_filter": "frame.number == 44228", "timestamp_epoch": "1533965784.469953000" }, { "udp_stream": 352, "frame_number": 44343, "display_filter": "frame.number == 44343", "timestamp_epoch": "1533965785.001653000" }, { "tcp_stream": 1176, "frame_number": 44622, "display_filter": "frame.number == 44622", "timestamp_epoch": "1533965785.932997000" }, { "tcp_stream": 1175, "frame_number": 44626, "display_filter": "frame.number == 44626", "timestamp_epoch": "1533965785.935461000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4a651af8135c3e607fee3148", "type": "domain", "value": "t.cwkuki.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 112, "frame_number": 10580, "display_filter": "frame.number == 10580", "timestamp_epoch": "1533964900.525737000" }, { "udp_stream": 112, "frame_number": 10606, "display_filter": "frame.number == 10606", "timestamp_epoch": "1533964900.584234000" }, { "tcp_stream": 269, "frame_number": 10679, "display_filter": "frame.number == 10679", "timestamp_epoch": "1533964900.703345000" }, { "tcp_stream": 270, "frame_number": 10707, "display_filter": "frame.number == 10707", "timestamp_epoch": "1533964900.713504000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6d436e72d60c68bfa80f25b2", "type": "domain", "value": "t.lkqd.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 163, "frame_number": 15606, "display_filter": "frame.number == 15606", "timestamp_epoch": "1533964906.852301000" }, { "udp_stream": 163, "frame_number": 15635, "display_filter": "frame.number == 15635", "timestamp_epoch": "1533964906.967863000" }, { "tcp_stream": 428, "frame_number": 15676, "display_filter": "frame.number == 15676", "timestamp_epoch": "1533964907.180598000" }, { "tcp_stream": 429, "frame_number": 15677, "display_filter": "frame.number == 15677", "timestamp_epoch": "1533964907.180602000" }, { "tcp_stream": 427, "frame_number": 15682, "display_filter": "frame.number == 15682", "timestamp_epoch": "1533964907.187736000" }, { "tcp_stream": 430, "frame_number": 15727, "display_filter": "frame.number == 15727", "timestamp_epoch": "1533964907.339216000" }, { "tcp_stream": 431, "frame_number": 15735, "display_filter": "frame.number == 15735", "timestamp_epoch": "1533964907.423343000" }, { "tcp_stream": 434, "frame_number": 15831, "display_filter": "frame.number == 15831", "timestamp_epoch": "1533964907.716650000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-bfd4f01fb5e9280dec2412ed", "type": "domain", "value": "t.mookie1.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 234, "frame_number": 23569, "display_filter": "frame.number == 23569", "timestamp_epoch": "1533964997.744678000" }, { "udp_stream": 234, "frame_number": 23623, "display_filter": "frame.number == 23623", "timestamp_epoch": "1533964997.803829000" }, { "tcp_stream": 654, "frame_number": 23717, "display_filter": "frame.number == 23717", "timestamp_epoch": "1533964997.934130000" }, { "tcp_stream": 655, "frame_number": 23731, "display_filter": "frame.number == 23731", "timestamp_epoch": "1533964997.937638000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3ac6be24016c5515d382b5c5", "type": "domain", "value": "t.wayfair.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 232, "frame_number": 23567, "display_filter": "frame.number == 23567", "timestamp_epoch": "1533964997.736160000" }, { "udp_stream": 232, "frame_number": 23638, "display_filter": "frame.number == 23638", "timestamp_epoch": "1533964997.826472000" }, { "tcp_stream": 658, "frame_number": 23702, "display_filter": "frame.number == 23702", "timestamp_epoch": "1533964997.907612000" }, { "tcp_stream": 659, "frame_number": 23705, "display_filter": "frame.number == 23705", "timestamp_epoch": "1533964997.908221000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-16864e5fdda2d0203e42c59a", "type": "domain", "value": "tag.1rx.io", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 137, "frame_number": 12971, "display_filter": "frame.number == 12971", "timestamp_epoch": "1533964902.913737000" }, { "udp_stream": 137, "frame_number": 13018, "display_filter": "frame.number == 13018", "timestamp_epoch": "1533964902.980837000" }, { "tcp_stream": 335, "frame_number": 13105, "display_filter": "frame.number == 13105", "timestamp_epoch": "1533964903.067494000" }, { "tcp_stream": 334, "frame_number": 13115, "display_filter": "frame.number == 13115", "timestamp_epoch": "1533964903.080511000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-488dd99b2e3243d1ebc9e36a", "type": "domain", "value": "tags.bluekai.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 241, "frame_number": 24028, "display_filter": "frame.number == 24028", "timestamp_epoch": "1533964999.378484000" }, { "udp_stream": 241, "frame_number": 24044, "display_filter": "frame.number == 24044", "timestamp_epoch": "1533964999.506406000" }, { "tcp_stream": 675, "frame_number": 24084, "display_filter": "frame.number == 24084", "timestamp_epoch": "1533964999.566031000" }, { "tcp_stream": 674, "frame_number": 24089, "display_filter": "frame.number == 24089", "timestamp_epoch": "1533964999.566541000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-59bcde5efce29d9b5252d8a9", "type": "domain", "value": "tags.crwdcntrl.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 204, "frame_number": 19275, "display_filter": "frame.number == 19275", "timestamp_epoch": "1533964961.689236000" }, { "udp_stream": 204, "frame_number": 19335, "display_filter": "frame.number == 19335", "timestamp_epoch": "1533964961.815071000" }, { "tcp_stream": 558, "frame_number": 19374, "display_filter": "frame.number == 19374", "timestamp_epoch": "1533964961.873178000" }, { "tcp_stream": 559, "frame_number": 19381, "display_filter": "frame.number == 19381", "timestamp_epoch": "1533964961.876009000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d36da193eb5ec8e3057b0268", "type": "domain", "value": "target.mixi.media", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 104, "frame_number": 9220, "display_filter": "frame.number == 9220", "timestamp_epoch": "1533964899.124450000" }, { "udp_stream": 104, "frame_number": 9471, "display_filter": "frame.number == 9471", "timestamp_epoch": "1533964899.377655000" }, { "tcp_stream": 256, "frame_number": 9722, "display_filter": "frame.number == 9722", "timestamp_epoch": "1533964899.605767000" }, { "tcp_stream": 254, "frame_number": 9734, "display_filter": "frame.number == 9734", "timestamp_epoch": "1533964899.613514000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d458120e432992d199b50450", "type": "domain", "value": "tass.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:58.438980+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:58.435173+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 126, "frame_number": 40086, "display_filter": "frame.number == 40086", "timestamp_epoch": "1533965768.345089000" }, { "udp_stream": 126, "frame_number": 40087, "display_filter": "frame.number == 40087", "timestamp_epoch": "1533965768.408215000" }, { "tcp_stream": 1071, "frame_number": 40100, "display_filter": "frame.number == 40100", "timestamp_epoch": "1533965768.745327000" }, { "tcp_stream": 1070, "frame_number": 40113, "display_filter": "frame.number == 40113", "timestamp_epoch": "1533965770.052650000" }, { "tcp_stream": 1074, "frame_number": 40165, "display_filter": "frame.number == 40165", "timestamp_epoch": "1533965770.465535000" }, { "tcp_stream": 1072, "frame_number": 40171, "display_filter": "frame.number == 40171", "timestamp_epoch": "1533965770.466207000" }, { "tcp_stream": 1073, "frame_number": 40173, "display_filter": "frame.number == 40173", "timestamp_epoch": "1533965770.466368000" }, { "tcp_stream": 1075, "frame_number": 40177, "display_filter": "frame.number == 40177", "timestamp_epoch": "1533965770.467225000" }, { "tcp_stream": 1071, "frame_number": 40213, "display_filter": "frame.number == 40213", "timestamp_epoch": "1533965770.489095000" }, { "tcp_stream": 1071, "frame_number": 40361, "display_filter": "frame.number == 40361", "timestamp_epoch": "1533965770.816258000" }, { "tcp_stream": 1074, "frame_number": 40510, "display_filter": "frame.number == 40510", "timestamp_epoch": "1533965771.062766000" }, { "tcp_stream": 1072, "frame_number": 40518, "display_filter": "frame.number == 40518", "timestamp_epoch": "1533965771.072573000" }, { "tcp_stream": 1075, "frame_number": 40562, "display_filter": "frame.number == 40562", "timestamp_epoch": "1533965771.132264000" }, { "tcp_stream": 1071, "frame_number": 40737, "display_filter": "frame.number == 40737", "timestamp_epoch": "1533965771.477596000" }, { "tcp_stream": 1073, "frame_number": 41022, "display_filter": "frame.number == 41022", "timestamp_epoch": "1533965773.993678000" }, { "tcp_stream": 1070, "frame_number": 41026, "display_filter": "frame.number == 41026", "timestamp_epoch": "1533965774.002334000" }, { "tcp_stream": 1072, "frame_number": 41034, "display_filter": "frame.number == 41034", "timestamp_epoch": "1533965774.016397000" }, { "tcp_stream": 1074, "frame_number": 41036, "display_filter": "frame.number == 41036", "timestamp_epoch": "1533965774.016484000" }, { "tcp_stream": 1075, "frame_number": 41060, "display_filter": "frame.number == 41060", "timestamp_epoch": "1533965774.048915000" }, { "tcp_stream": 1071, "frame_number": 41126, "display_filter": "frame.number == 41126", "timestamp_epoch": "1533965772.393285000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:58.429864+00:00" }, { "observable_id": "observable-abab6f57883a3f35a2229b8d", "type": "domain", "value": "td.thebrighttag.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 260, "frame_number": 27324, "display_filter": "frame.number == 27324", "timestamp_epoch": "1533965035.406855000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-20eabb31357d266f1353b7e1", "type": "domain", "value": "teutorigos-cat.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 111, "frame_number": 10577, "display_filter": "frame.number == 10577", "timestamp_epoch": "1533964900.523369000" }, { "udp_stream": 111, "frame_number": 10617, "display_filter": "frame.number == 10617", "timestamp_epoch": "1533964900.621189000" }, { "tcp_stream": 274, "frame_number": 10675, "display_filter": "frame.number == 10675", "timestamp_epoch": "1533964900.703100000" }, { "tcp_stream": 273, "frame_number": 10680, "display_filter": "frame.number == 10680", "timestamp_epoch": "1533964900.703501000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-77085cead15e1e92cdd71c86", "type": "domain", "value": "thrtle.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 240, "frame_number": 24027, "display_filter": "frame.number == 24027", "timestamp_epoch": "1533964999.378366000" }, { "udp_stream": 240, "frame_number": 24040, "display_filter": "frame.number == 24040", "timestamp_epoch": "1533964999.467395000" }, { "tcp_stream": 670, "frame_number": 24101, "display_filter": "frame.number == 24101", "timestamp_epoch": "1533964999.588590000" }, { "tcp_stream": 671, "frame_number": 24107, "display_filter": "frame.number == 24107", "timestamp_epoch": "1533964999.608486000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a3d92c3b10000f7b9dc41231", "type": "domain", "value": "token.rubiconproject.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 174, "frame_number": 16538, "display_filter": "frame.number == 16538", "timestamp_epoch": "1533964909.995908000" }, { "udp_stream": 174, "frame_number": 16558, "display_filter": "frame.number == 16558", "timestamp_epoch": "1533964910.093175000" }, { "tcp_stream": 469, "frame_number": 16588, "display_filter": "frame.number == 16588", "timestamp_epoch": "1533964910.150506000" }, { "tcp_stream": 470, "frame_number": 16592, "display_filter": "frame.number == 16592", "timestamp_epoch": "1533964910.156208000" }, { "tcp_stream": 471, "frame_number": 16600, "display_filter": "frame.number == 16600", "timestamp_epoch": "1533964910.171224000" }, { "tcp_stream": 667, "frame_number": 24033, "display_filter": "frame.number == 24033", "timestamp_epoch": "1533964999.451299000" }, { "tcp_stream": 666, "frame_number": 24034, "display_filter": "frame.number == 24034", "timestamp_epoch": "1533964999.451579000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-255e87911e59b41153333be3", "type": "domain", "value": "tpc.googlesyndication.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 60, "frame_number": 4895, "display_filter": "frame.number == 4895", "timestamp_epoch": "1533964555.650027000" }, { "udp_stream": 60, "frame_number": 4936, "display_filter": "frame.number == 4936", "timestamp_epoch": "1533964555.714019000" }, { "udp_stream": 347, "frame_number": 44102, "display_filter": "frame.number == 44102", "timestamp_epoch": "1533965784.176878000" }, { "udp_stream": 347, "frame_number": 44193, "display_filter": "frame.number == 44193", "timestamp_epoch": "1533965784.401633000" }, { "tcp_stream": 1165, "frame_number": 44277, "display_filter": "frame.number == 44277", "timestamp_epoch": "1533965784.655535000" }, { "tcp_stream": 1166, "frame_number": 44398, "display_filter": "frame.number == 44398", "timestamp_epoch": "1533965785.099585000" }, { "tcp_stream": 113, "frame_number": 4986, "display_filter": "frame.number == 4986", "timestamp_epoch": "1533964555.774473000" }, { "tcp_stream": 114, "frame_number": 4996, "display_filter": "frame.number == 4996", "timestamp_epoch": "1533964555.787234000" }, { "tcp_stream": 248, "frame_number": 9666, "display_filter": "frame.number == 9666", "timestamp_epoch": "1533964899.587924000" }, { "tcp_stream": 249, "frame_number": 9668, "display_filter": "frame.number == 9668", "timestamp_epoch": "1533964899.588139000" }, { "tcp_stream": 258, "frame_number": 9716, "display_filter": "frame.number == 9716", "timestamp_epoch": "1533964899.603619000" }, { "tcp_stream": 906, "frame_number": 33110, "display_filter": "frame.number == 33110", "timestamp_epoch": "1533965137.166579000" }, { "tcp_stream": 907, "frame_number": 33118, "display_filter": "frame.number == 33118", "timestamp_epoch": "1533965137.186092000" }, { "tcp_stream": 1016, "frame_number": 39042, "display_filter": "frame.number == 39042", "timestamp_epoch": "1533965240.902415000" }, { "tcp_stream": 1017, "frame_number": 39050, "display_filter": "frame.number == 39050", "timestamp_epoch": "1533965240.916740000" }, { "tcp_stream": 1179, "frame_number": 44710, "display_filter": "frame.number == 44710", "timestamp_epoch": "1533965786.046910000" }, { "tcp_stream": 1177, "frame_number": 44716, "display_filter": "frame.number == 44716", "timestamp_epoch": "1533965786.047696000" }, { "tcp_stream": 1178, "frame_number": 44718, "display_filter": "frame.number == 44718", "timestamp_epoch": "1533965786.047800000" }, { "tcp_stream": 1185, "frame_number": 44726, "display_filter": "frame.number == 44726", "timestamp_epoch": "1533965786.084904000" }, { "tcp_stream": 1184, "frame_number": 44730, "display_filter": "frame.number == 44730", "timestamp_epoch": "1533965786.085797000" } ], "roles": [ "dns-query", "http-host", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a94419c92ff8df0945c9e032", "type": "domain", "value": "tps.doubleverify.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 298, "frame_number": 33372, "display_filter": "frame.number == 33372", "timestamp_epoch": "1533965137.714649000" }, { "udp_stream": 298, "frame_number": 33377, "display_filter": "frame.number == 33377", "timestamp_epoch": "1533965137.904526000" }, { "tcp_stream": 917, "frame_number": 33386, "display_filter": "frame.number == 33386", "timestamp_epoch": "1533965137.996576000" }, { "tcp_stream": 918, "frame_number": 33388, "display_filter": "frame.number == 33388", "timestamp_epoch": "1533965137.996654000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3d3a664b5fb06d9361a7bdba", "type": "domain", "value": "tps700.doubleverify.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 307, "frame_number": 38808, "display_filter": "frame.number == 38808", "timestamp_epoch": "1533965240.128848000" }, { "udp_stream": 307, "frame_number": 38809, "display_filter": "frame.number == 38809", "timestamp_epoch": "1533965240.205005000" }, { "tcp_stream": 1002, "frame_number": 38818, "display_filter": "frame.number == 38818", "timestamp_epoch": "1533965240.283333000" }, { "tcp_stream": 1003, "frame_number": 38824, "display_filter": "frame.number == 38824", "timestamp_epoch": "1533965240.296201000" }, { "tcp_stream": 1004, "frame_number": 38830, "display_filter": "frame.number == 38830", "timestamp_epoch": "1533965240.322685000" }, { "tcp_stream": 1005, "frame_number": 38850, "display_filter": "frame.number == 38850", "timestamp_epoch": "1533965240.367062000" }, { "tcp_stream": 1011, "frame_number": 38972, "display_filter": "frame.number == 38972", "timestamp_epoch": "1533965240.702883000" }, { "tcp_stream": 1012, "frame_number": 38974, "display_filter": "frame.number == 38974", "timestamp_epoch": "1533965240.703207000" }, { "tcp_stream": 1013, "frame_number": 38986, "display_filter": "frame.number == 38986", "timestamp_epoch": "1533965240.732190000" }, { "tcp_stream": 1018, "frame_number": 39046, "display_filter": "frame.number == 39046", "timestamp_epoch": "1533965240.915990000" }, { "tcp_stream": 1019, "frame_number": 39090, "display_filter": "frame.number == 39090", "timestamp_epoch": "1533965241.033400000" }, { "tcp_stream": 1020, "frame_number": 39136, "display_filter": "frame.number == 39136", "timestamp_epoch": "1533965241.351114000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e9cc20913710a8f7ce65a45d", "type": "domain", "value": "tps702.doubleverify.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 297, "frame_number": 33067, "display_filter": "frame.number == 33067", "timestamp_epoch": "1533965137.026488000" }, { "udp_stream": 297, "frame_number": 33093, "display_filter": "frame.number == 33093", "timestamp_epoch": "1533965137.114452000" }, { "tcp_stream": 908, "frame_number": 33119, "display_filter": "frame.number == 33119", "timestamp_epoch": "1533965137.186096000" }, { "tcp_stream": 911, "frame_number": 33132, "display_filter": "frame.number == 33132", "timestamp_epoch": "1533965137.203286000" }, { "tcp_stream": 910, "frame_number": 33133, "display_filter": "frame.number == 33133", "timestamp_epoch": "1533965137.203289000" }, { "tcp_stream": 909, "frame_number": 33135, "display_filter": "frame.number == 33135", "timestamp_epoch": "1533965137.203629000" }, { "tcp_stream": 913, "frame_number": 33136, "display_filter": "frame.number == 33136", "timestamp_epoch": "1533965137.203720000" }, { "tcp_stream": 912, "frame_number": 33139, "display_filter": "frame.number == 33139", "timestamp_epoch": "1533965137.203985000" }, { "tcp_stream": 915, "frame_number": 33350, "display_filter": "frame.number == 33350", "timestamp_epoch": "1533965137.611935000" }, { "tcp_stream": 916, "frame_number": 33358, "display_filter": "frame.number == 33358", "timestamp_epoch": "1533965137.615961000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6e61f4d495da78b41cf66845", "type": "domain", "value": "track-eu.adformnet.akadns.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 235, "frame_number": 23649, "display_filter": "frame.number == 23649", "timestamp_epoch": "1533964997.831687000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b9c3760cca1254ca0f41a646", "type": "domain", "value": "track.eyeviewads.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 248, "frame_number": 26698, "display_filter": "frame.number == 26698", "timestamp_epoch": "1533965033.400951000" }, { "udp_stream": 248, "frame_number": 26728, "display_filter": "frame.number == 26728", "timestamp_epoch": "1533965033.481510000" }, { "tcp_stream": 713, "frame_number": 26766, "display_filter": "frame.number == 26766", "timestamp_epoch": "1533965033.590350000" }, { "tcp_stream": 714, "frame_number": 26791, "display_filter": "frame.number == 26791", "timestamp_epoch": "1533965033.601028000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3cc7663e2a08ea553217811a", "type": "domain", "value": "tracking-prod-public-741746200.us-west-1.elb.amazonaws.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 154, "frame_number": 14640, "display_filter": "frame.number == 14640", "timestamp_epoch": "1533964904.663956000" }, { "udp_stream": 364, "frame_number": 46080, "display_filter": "frame.number == 46080", "timestamp_epoch": "1533965789.714227000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-dded06e97a7431cfd3ca8af4", "type": "domain", "value": "trc.taboola.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 279, "frame_number": 31566, "display_filter": "frame.number == 31566", "timestamp_epoch": "1533965100.651079000" }, { "udp_stream": 279, "frame_number": 31673, "display_filter": "frame.number == 31673", "timestamp_epoch": "1533965100.796418000" }, { "tcp_stream": 865, "frame_number": 31800, "display_filter": "frame.number == 31800", "timestamp_epoch": "1533965100.912658000" }, { "tcp_stream": 864, "frame_number": 31806, "display_filter": "frame.number == 31806", "timestamp_epoch": "1533965100.914287000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e84cdc0986031b8253fb6ca3", "type": "domain", "value": "trc.taboola.map.fastly.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 191, "frame_number": 18574, "display_filter": "frame.number == 18574", "timestamp_epoch": "1533964959.368247000" }, { "udp_stream": 287, "frame_number": 32144, "display_filter": "frame.number == 32144", "timestamp_epoch": "1533965101.694508000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f7d7b04b96fc88f0fa96e872", "type": "domain", "value": "tru.am", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 51, "frame_number": 3215, "display_filter": "frame.number == 3215", "timestamp_epoch": "1533964552.431390000" }, { "udp_stream": 51, "frame_number": 3335, "display_filter": "frame.number == 3335", "timestamp_epoch": "1533964552.717075000" }, { "tcp_stream": 92, "frame_number": 3486, "display_filter": "frame.number == 3486", "timestamp_epoch": "1533964552.880734000" }, { "tcp_stream": 93, "frame_number": 3494, "display_filter": "frame.number == 3494", "timestamp_epoch": "1533964552.882566000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3f3240459f55fd88e32b5c06", "type": "domain", "value": "tt.onthe.io", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 358, "frame_number": 45115, "display_filter": "frame.number == 45115", "timestamp_epoch": "1533965786.906355000" }, { "udp_stream": 358, "frame_number": 45340, "display_filter": "frame.number == 45340", "timestamp_epoch": "1533965787.454378000" }, { "tcp_stream": 1201, "frame_number": 45586, "display_filter": "frame.number == 45586", "timestamp_epoch": "1533965788.247122000" }, { "tcp_stream": 1200, "frame_number": 45594, "display_filter": "frame.number == 45594", "timestamp_epoch": "1533965788.250586000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-61d5bc0985707baae74d7d8e", "type": "domain", "value": "tt1.zedo.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 135, "frame_number": 12773, "display_filter": "frame.number == 12773", "timestamp_epoch": "1533964902.709304000" }, { "udp_stream": 135, "frame_number": 12799, "display_filter": "frame.number == 12799", "timestamp_epoch": "1533964902.763199000" }, { "tcp_stream": 331, "frame_number": 12887, "display_filter": "frame.number == 12887", "timestamp_epoch": "1533964902.838650000" }, { "tcp_stream": 330, "frame_number": 12889, "display_filter": "frame.number == 12889", "timestamp_epoch": "1533964902.838771000" }, { "tcp_stream": 338, "frame_number": 13336, "display_filter": "frame.number == 13336", "timestamp_epoch": "1533964903.232805000" }, { "tcp_stream": 337, "frame_number": 13337, "display_filter": "frame.number == 13337", "timestamp_epoch": "1533964903.232952000" }, { "tcp_stream": 346, "frame_number": 13496, "display_filter": "frame.number == 13496", "timestamp_epoch": "1533964903.482466000" }, { "tcp_stream": 345, "frame_number": 13505, "display_filter": "frame.number == 13505", "timestamp_epoch": "1533964903.493197000" }, { "tcp_stream": 348, "frame_number": 13511, "display_filter": "frame.number == 13511", "timestamp_epoch": "1533964903.504997000" }, { "tcp_stream": 347, "frame_number": 13512, "display_filter": "frame.number == 13512", "timestamp_epoch": "1533964903.505113000" }, { "tcp_stream": 351, "frame_number": 13601, "display_filter": "frame.number == 13601", "timestamp_epoch": "1533964903.579811000" }, { "tcp_stream": 354, "frame_number": 13631, "display_filter": "frame.number == 13631", "timestamp_epoch": "1533964903.624503000" }, { "tcp_stream": 359, "frame_number": 13872, "display_filter": "frame.number == 13872", "timestamp_epoch": "1533964903.772678000" }, { "tcp_stream": 358, "frame_number": 13880, "display_filter": "frame.number == 13880", "timestamp_epoch": "1533964903.781394000" }, { "tcp_stream": 360, "frame_number": 13913, "display_filter": "frame.number == 13913", "timestamp_epoch": "1533964903.793456000" }, { "tcp_stream": 361, "frame_number": 13915, "display_filter": "frame.number == 13915", "timestamp_epoch": "1533964903.793584000" }, { "tcp_stream": 365, "frame_number": 14009, "display_filter": "frame.number == 14009", "timestamp_epoch": "1533964903.870950000" }, { "tcp_stream": 366, "frame_number": 14047, "display_filter": "frame.number == 14047", "timestamp_epoch": "1533964903.937187000" }, { "tcp_stream": 367, "frame_number": 14191, "display_filter": "frame.number == 14191", "timestamp_epoch": "1533964904.073957000" }, { "tcp_stream": 368, "frame_number": 14244, "display_filter": "frame.number == 14244", "timestamp_epoch": "1533964904.125634000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-575e147c253236dde73615a3", "type": "domain", "value": "tt3.zedo.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 159, "frame_number": 14974, "display_filter": "frame.number == 14974", "timestamp_epoch": "1533964904.971944000" }, { "udp_stream": 159, "frame_number": 15053, "display_filter": "frame.number == 15053", "timestamp_epoch": "1533964905.068551000" }, { "tcp_stream": 415, "frame_number": 15084, "display_filter": "frame.number == 15084", "timestamp_epoch": "1533964905.116295000" }, { "tcp_stream": 416, "frame_number": 15091, "display_filter": "frame.number == 15091", "timestamp_epoch": "1533964905.125018000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ae798a2f813a380f8fb83d55", "type": "domain", "value": "uat-net.technoratimedia.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 182, "frame_number": 17854, "display_filter": "frame.number == 17854", "timestamp_epoch": "1533964957.358429000" }, { "udp_stream": 182, "frame_number": 17855, "display_filter": "frame.number == 17855", "timestamp_epoch": "1533964957.358759000" }, { "tcp_stream": 500, "frame_number": 17946, "display_filter": "frame.number == 17946", "timestamp_epoch": "1533964957.595012000" }, { "tcp_stream": 501, "frame_number": 17957, "display_filter": "frame.number == 17957", "timestamp_epoch": "1533964957.625014000" }, { "tcp_stream": 514, "frame_number": 18298, "display_filter": "frame.number == 18298", "timestamp_epoch": "1533964958.637131000" }, { "tcp_stream": 794, "frame_number": 29645, "display_filter": "frame.number == 29645", "timestamp_epoch": "1533965096.936583000" }, { "tcp_stream": 795, "frame_number": 29655, "display_filter": "frame.number == 29655", "timestamp_epoch": "1533965096.962190000" }, { "tcp_stream": 842, "frame_number": 31402, "display_filter": "frame.number == 31402", "timestamp_epoch": "1533965100.369048000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-bd78d613be7025b9ac548b74", "type": "domain", "value": "uat-secure.technoratimedia.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 179, "frame_number": 17346, "display_filter": "frame.number == 17346", "timestamp_epoch": "1533964956.246434000" }, { "udp_stream": 179, "frame_number": 17349, "display_filter": "frame.number == 17349", "timestamp_epoch": "1533964956.315471000" }, { "tcp_stream": 493, "frame_number": 17386, "display_filter": "frame.number == 17386", "timestamp_epoch": "1533964956.426876000" }, { "tcp_stream": 494, "frame_number": 17387, "display_filter": "frame.number == 17387", "timestamp_epoch": "1533964956.427338000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7ddf00bd86473f5ba4fe5bf0", "type": "domain", "value": "ucs02.engageya.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 115, "frame_number": 10615, "display_filter": "frame.number == 10615", "timestamp_epoch": "1533964900.592860000" }, { "udp_stream": 115, "frame_number": 10632, "display_filter": "frame.number == 10632", "timestamp_epoch": "1533964900.643556000" }, { "tcp_stream": 280, "frame_number": 10878, "display_filter": "frame.number == 10878", "timestamp_epoch": "1533964900.852025000" }, { "tcp_stream": 281, "frame_number": 10881, "display_filter": "frame.number == 10881", "timestamp_epoch": "1533964900.852278000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7fb09f1e9b9437ca3b15a0c4", "type": "domain", "value": "um.simpli.fi", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 75, "frame_number": 5852, "display_filter": "frame.number == 5852", "timestamp_epoch": "1533964559.407246000" }, { "udp_stream": 75, "frame_number": 5872, "display_filter": "frame.number == 5872", "timestamp_epoch": "1533964559.485716000" }, { "tcp_stream": 147, "frame_number": 5913, "display_filter": "frame.number == 5913", "timestamp_epoch": "1533964559.549609000" }, { "tcp_stream": 149, "frame_number": 5920, "display_filter": "frame.number == 5920", "timestamp_epoch": "1533964559.550654000" }, { "tcp_stream": 629, "frame_number": 23296, "display_filter": "frame.number == 23296", "timestamp_epoch": "1533964997.291763000" }, { "tcp_stream": 628, "frame_number": 23305, "display_filter": "frame.number == 23305", "timestamp_epoch": "1533964997.295515000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b3e63eba85e4b91e7a7f62e8", "type": "domain", "value": "us-u.openx.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 59, "frame_number": 4853, "display_filter": "frame.number == 4853", "timestamp_epoch": "1533964555.557011000" }, { "udp_stream": 59, "frame_number": 4896, "display_filter": "frame.number == 4896", "timestamp_epoch": "1533964555.650800000" }, { "tcp_stream": 111, "frame_number": 4925, "display_filter": "frame.number == 4925", "timestamp_epoch": "1533964555.708590000" }, { "tcp_stream": 112, "frame_number": 4934, "display_filter": "frame.number == 4934", "timestamp_epoch": "1533964555.710501000" }, { "tcp_stream": 222, "frame_number": 8695, "display_filter": "frame.number == 8695", "timestamp_epoch": "1533964898.654670000" }, { "tcp_stream": 221, "frame_number": 8699, "display_filter": "frame.number == 8699", "timestamp_epoch": "1533964898.655738000" }, { "tcp_stream": 374, "frame_number": 14364, "display_filter": "frame.number == 14364", "timestamp_epoch": "1533964904.327679000" }, { "tcp_stream": 376, "frame_number": 14366, "display_filter": "frame.number == 14366", "timestamp_epoch": "1533964904.327827000" }, { "tcp_stream": 373, "frame_number": 14368, "display_filter": "frame.number == 14368", "timestamp_epoch": "1533964904.328213000" }, { "tcp_stream": 375, "frame_number": 14369, "display_filter": "frame.number == 14369", "timestamp_epoch": "1533964904.328294000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-52b7722e8059b34b71cce374", "type": "domain", "value": "usorlzdiprd-external-190420686.us-west-2.elb.amazonaws.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 252, "frame_number": 26736, "display_filter": "frame.number == 26736", "timestamp_epoch": "1533965033.496493000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5262bc4a0a545ee10c81f277", "type": "domain", "value": "v.lkqd.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 157, "frame_number": 14624, "display_filter": "frame.number == 14624", "timestamp_epoch": "1533964904.640864000" }, { "udp_stream": 157, "frame_number": 14679, "display_filter": "frame.number == 14679", "timestamp_epoch": "1533964904.689217000" }, { "tcp_stream": 409, "frame_number": 14930, "display_filter": "frame.number == 14930", "timestamp_epoch": "1533964904.905276000" }, { "tcp_stream": 411, "frame_number": 14934, "display_filter": "frame.number == 14934", "timestamp_epoch": "1533964904.912081000" }, { "tcp_stream": 410, "frame_number": 14935, "display_filter": "frame.number == 14935", "timestamp_epoch": "1533964904.912221000" }, { "tcp_stream": 412, "frame_number": 14938, "display_filter": "frame.number == 14938", "timestamp_epoch": "1533964904.912592000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-85f325c27426fd96d6234106", "type": "domain", "value": "vap.lijit.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 284, "frame_number": 31672, "display_filter": "frame.number == 31672", "timestamp_epoch": "1533965100.795928000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-71ef8a3ce9222a08d8513b22", "type": "domain", "value": "vcdn.adnxs.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 226, "frame_number": 23164, "display_filter": "frame.number == 23164", "timestamp_epoch": "1533964996.955481000" }, { "udp_stream": 226, "frame_number": 23216, "display_filter": "frame.number == 23216", "timestamp_epoch": "1533964997.081499000" }, { "tcp_stream": 624, "frame_number": 23271, "display_filter": "frame.number == 23271", "timestamp_epoch": "1533964997.212549000" }, { "tcp_stream": 625, "frame_number": 23272, "display_filter": "frame.number == 23272", "timestamp_epoch": "1533964997.212875000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6a9d0e2848434463b998229c", "type": "domain", "value": "vid-io.springserve.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 180, "frame_number": 17429, "display_filter": "frame.number == 17429", "timestamp_epoch": "1533964956.524984000" }, { "udp_stream": 180, "frame_number": 17691, "display_filter": "frame.number == 17691", "timestamp_epoch": "1533964957.010961000" }, { "tcp_stream": 499, "frame_number": 17781, "display_filter": "frame.number == 17781", "timestamp_epoch": "1533964957.193121000" }, { "tcp_stream": 498, "frame_number": 17782, "display_filter": "frame.number == 17782", "timestamp_epoch": "1533964957.193122000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-250aa3332cacace8ab00b941", "type": "domain", "value": "vid-io.springserve.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 199, "frame_number": 19230, "display_filter": "frame.number == 19230", "timestamp_epoch": "1533964961.289231000" }, { "udp_stream": 199, "frame_number": 19231, "display_filter": "frame.number == 19231", "timestamp_epoch": "1533964961.387623000" }, { "tcp_stream": 549, "frame_number": 19235, "display_filter": "frame.number == 19235", "timestamp_epoch": "1533964961.462412000" }, { "tcp_stream": 603, "frame_number": 22011, "display_filter": "frame.number == 22011", "timestamp_epoch": "1533964981.293633000" }, { "tcp_stream": 678, "frame_number": 24295, "display_filter": "frame.number == 24295", "timestamp_epoch": "1533965002.762043000" }, { "tcp_stream": 681, "frame_number": 24464, "display_filter": "frame.number == 24464", "timestamp_epoch": "1533965016.446820000" }, { "tcp_stream": 772, "frame_number": 27956, "display_filter": "frame.number == 27956", "timestamp_epoch": "1533965036.405195000" }, { "tcp_stream": 779, "frame_number": 28264, "display_filter": "frame.number == 28264", "timestamp_epoch": "1533965056.460554000" }, { "tcp_stream": 782, "frame_number": 28501, "display_filter": "frame.number == 28501", "timestamp_epoch": "1533965076.803944000" }, { "tcp_stream": 785, "frame_number": 28646, "display_filter": "frame.number == 28646", "timestamp_epoch": "1533965091.432884000" }, { "tcp_stream": 884, "frame_number": 32429, "display_filter": "frame.number == 32429", "timestamp_epoch": "1533965111.411023000" }, { "tcp_stream": 887, "frame_number": 32608, "display_filter": "frame.number == 32608", "timestamp_epoch": "1533965131.843881000" }, { "tcp_stream": 923, "frame_number": 33544, "display_filter": "frame.number == 33544", "timestamp_epoch": "1533965152.660854000" }, { "tcp_stream": 976, "frame_number": 36112, "display_filter": "frame.number == 36112", "timestamp_epoch": "1533965174.416273000" }, { "tcp_stream": 979, "frame_number": 36276, "display_filter": "frame.number == 36276", "timestamp_epoch": "1533965195.109749000" }, { "tcp_stream": 989, "frame_number": 38643, "display_filter": "frame.number == 38643", "timestamp_epoch": "1533965235.986415000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f6be2edc73c2e55fbb01531e", "type": "domain", "value": "vid.springserve.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 181, "frame_number": 17792, "display_filter": "frame.number == 17792", "timestamp_epoch": "1533964957.237351000" }, { "udp_stream": 181, "frame_number": 17890, "display_filter": "frame.number == 17890", "timestamp_epoch": "1533964957.470463000" }, { "tcp_stream": 502, "frame_number": 17965, "display_filter": "frame.number == 17965", "timestamp_epoch": "1533964957.628407000" }, { "tcp_stream": 503, "frame_number": 17966, "display_filter": "frame.number == 17966", "timestamp_epoch": "1533964957.628409000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ab2217bf6e2a522a1543de3d", "type": "domain", "value": "vk.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:58.630659+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:58.624906+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 34, "frame_number": 603, "display_filter": "frame.number == 603", "timestamp_epoch": "1533964545.589318000" }, { "udp_stream": 34, "frame_number": 614, "display_filter": "frame.number == 614", "timestamp_epoch": "1533964545.653915000" }, { "udp_stream": 323, "frame_number": 40119, "display_filter": "frame.number == 40119", "timestamp_epoch": "1533965770.058014000" }, { "udp_stream": 323, "frame_number": 40120, "display_filter": "frame.number == 40120", "timestamp_epoch": "1533965770.136548000" }, { "tcp_stream": 1076, "frame_number": 40209, "display_filter": "frame.number == 40209", "timestamp_epoch": "1533965770.487843000" }, { "tcp_stream": 49, "frame_number": 747, "display_filter": "frame.number == 747", "timestamp_epoch": "1533964545.885142000" }, { "tcp_stream": 50, "frame_number": 758, "display_filter": "frame.number == 758", "timestamp_epoch": "1533964545.899143000" } ], "roles": [ "dns-query", "http-host", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:58.619384+00:00" }, { "observable_id": "observable-d467d184c5bb15cfa57a8165", "type": "domain", "value": "vpaid-springserve-net.ssmb.netdna-cdn.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 189, "frame_number": 18270, "display_filter": "frame.number == 18270", "timestamp_epoch": "1533964958.600112000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0ac9009813f07ad6657fce5e", "type": "domain", "value": "vpaid.springserve.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 189, "frame_number": 18233, "display_filter": "frame.number == 18233", "timestamp_epoch": "1533964958.535877000" }, { "udp_stream": 189, "frame_number": 18270, "display_filter": "frame.number == 18270", "timestamp_epoch": "1533964958.600112000" }, { "tcp_stream": 517, "frame_number": 18317, "display_filter": "frame.number == 18317", "timestamp_epoch": "1533964958.687621000" }, { "tcp_stream": 518, "frame_number": 18326, "display_filter": "frame.number == 18326", "timestamp_epoch": "1533964958.690508000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-06a4eb58e2aed2bd3e3716b8", "type": "domain", "value": "widget.engageya.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 92, "frame_number": 7801, "display_filter": "frame.number == 7801", "timestamp_epoch": "1533964897.663527000" }, { "udp_stream": 92, "frame_number": 8147, "display_filter": "frame.number == 8147", "timestamp_epoch": "1533964897.948811000" }, { "tcp_stream": 207, "frame_number": 8377, "display_filter": "frame.number == 8377", "timestamp_epoch": "1533964898.226439000" }, { "tcp_stream": 206, "frame_number": 8379, "display_filter": "frame.number == 8379", "timestamp_epoch": "1533964898.226623000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-9fd76303214145ce412e74d5", "type": "domain", "value": "widgets.outbrain.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 118, "frame_number": 10976, "display_filter": "frame.number == 10976", "timestamp_epoch": "1533964900.966203000" }, { "udp_stream": 118, "frame_number": 11285, "display_filter": "frame.number == 11285", "timestamp_epoch": "1533964901.153957000" }, { "tcp_stream": 293, "frame_number": 11393, "display_filter": "frame.number == 11393", "timestamp_epoch": "1533964901.234478000" }, { "tcp_stream": 292, "frame_number": 11399, "display_filter": "frame.number == 11399", "timestamp_epoch": "1533964901.236361000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4d9c3d11633432de285fb4de", "type": "domain", "value": "wpad.localdomain", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 18, "frame_number": 292, "display_filter": "frame.number == 292", "timestamp_epoch": "1533964512.094062000" }, { "udp_stream": 18, "frame_number": 293, "display_filter": "frame.number == 293", "timestamp_epoch": "1533964512.094245000" }, { "udp_stream": 321, "frame_number": 40090, "display_filter": "frame.number == 40090", "timestamp_epoch": "1533965768.474924000" }, { "udp_stream": 321, "frame_number": 40095, "display_filter": "frame.number == 40095", "timestamp_epoch": "1533965768.531747000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0e349b07febe00d49d4a389e", "type": "domain", "value": "wpad.sputnikhouse.org", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 17, "frame_number": 290, "display_filter": "frame.number == 290", "timestamp_epoch": "1533964512.093157000" }, { "udp_stream": 17, "frame_number": 291, "display_filter": "frame.number == 291", "timestamp_epoch": "1533964512.093493000" }, { "udp_stream": 320, "frame_number": 40088, "display_filter": "frame.number == 40088", "timestamp_epoch": "1533965768.474387000" }, { "udp_stream": 320, "frame_number": 40089, "display_filter": "frame.number == 40089", "timestamp_epoch": "1533965768.474612000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-902669b7995b7b6254b98b4e", "type": "domain", "value": "wpc.en.rt.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 28, "frame_number": 542, "display_filter": "frame.number == 542", "timestamp_epoch": "1533964544.690929000" }, { "udp_stream": 27, "frame_number": 543, "display_filter": "frame.number == 543", "timestamp_epoch": "1533964544.690931000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d08d631236a6321e263fa479", "type": "domain", "value": "www-google-analytics.l.google.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 48, "frame_number": 3327, "display_filter": "frame.number == 3327", "timestamp_epoch": "1533964552.700183000" }, { "udp_stream": 351, "frame_number": 44230, "display_filter": "frame.number == 44230", "timestamp_epoch": "1533965784.477104000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4dde73c118afffbca84325d9", "type": "domain", "value": "www-googletagmanager.l.google.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 339, "frame_number": 43662, "display_filter": "frame.number == 43662", "timestamp_epoch": "1533965783.090968000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-fe054b0cdc25182dc089210f", "type": "domain", "value": "www.bing.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 37, "frame_number": 2031, "display_filter": "frame.number == 2031", "timestamp_epoch": "1533964548.338549000" }, { "udp_stream": 38, "frame_number": 2033, "display_filter": "frame.number == 2033", "timestamp_epoch": "1533964548.338744000" }, { "udp_stream": 39, "frame_number": 2034, "display_filter": "frame.number == 2034", "timestamp_epoch": "1533964548.339435000" }, { "udp_stream": 40, "frame_number": 2035, "display_filter": "frame.number == 2035", "timestamp_epoch": "1533964548.339533000" }, { "udp_stream": 38, "frame_number": 2263, "display_filter": "frame.number == 2263", "timestamp_epoch": "1533964549.230108000" }, { "udp_stream": 39, "frame_number": 2265, "display_filter": "frame.number == 2265", "timestamp_epoch": "1533964549.230112000" }, { "udp_stream": 40, "frame_number": 2266, "display_filter": "frame.number == 2266", "timestamp_epoch": "1533964549.230247000" }, { "udp_stream": 37, "frame_number": 2268, "display_filter": "frame.number == 2268", "timestamp_epoch": "1533964549.230297000" }, { "udp_stream": 332, "frame_number": 41224, "display_filter": "frame.number == 41224", "timestamp_epoch": "1533965772.518384000" }, { "udp_stream": 333, "frame_number": 41225, "display_filter": "frame.number == 41225", "timestamp_epoch": "1533965772.518739000" }, { "udp_stream": 334, "frame_number": 41226, "display_filter": "frame.number == 41226", "timestamp_epoch": "1533965772.519191000" }, { "udp_stream": 335, "frame_number": 41227, "display_filter": "frame.number == 41227", "timestamp_epoch": "1533965772.519388000" }, { "udp_stream": 332, "frame_number": 41445, "display_filter": "frame.number == 41445", "timestamp_epoch": "1533965773.531006000" }, { "udp_stream": 333, "frame_number": 41446, "display_filter": "frame.number == 41446", "timestamp_epoch": "1533965773.531031000" }, { "udp_stream": 334, "frame_number": 41447, "display_filter": "frame.number == 41447", "timestamp_epoch": "1533965773.531293000" }, { "udp_stream": 335, "frame_number": 41448, "display_filter": "frame.number == 41448", "timestamp_epoch": "1533965773.531295000" }, { "udp_stream": 332, "frame_number": 41730, "display_filter": "frame.number == 41730", "timestamp_epoch": "1533965774.543297000" }, { "udp_stream": 334, "frame_number": 41731, "display_filter": "frame.number == 41731", "timestamp_epoch": "1533965774.543389000" }, { "udp_stream": 333, "frame_number": 41732, "display_filter": "frame.number == 41732", "timestamp_epoch": "1533965774.543470000" }, { "udp_stream": 335, "frame_number": 41733, "display_filter": "frame.number == 41733", "timestamp_epoch": "1533965774.543565000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f665b34099b63776fd85eb2e", "type": "domain", "value": "www.download.windowsupdate.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 55, "frame_number": 4150, "display_filter": "frame.number == 4150", "timestamp_epoch": "1533964553.828629000" }, { "udp_stream": 56, "frame_number": 4172, "display_filter": "frame.number == 4172", "timestamp_epoch": "1533964553.832380000" }, { "udp_stream": 56, "frame_number": 4256, "display_filter": "frame.number == 4256", "timestamp_epoch": "1533964554.071566000" }, { "udp_stream": 55, "frame_number": 4257, "display_filter": "frame.number == 4257", "timestamp_epoch": "1533964554.071727000" }, { "udp_stream": 271, "frame_number": 27969, "display_filter": "frame.number == 27969", "timestamp_epoch": "1533965036.476052000" }, { "udp_stream": 272, "frame_number": 27970, "display_filter": "frame.number == 27970", "timestamp_epoch": "1533965036.476055000" }, { "udp_stream": 272, "frame_number": 27994, "display_filter": "frame.number == 27994", "timestamp_epoch": "1533965036.569466000" }, { "udp_stream": 271, "frame_number": 27995, "display_filter": "frame.number == 27995", "timestamp_epoch": "1533965036.569468000" }, { "udp_stream": 308, "frame_number": 39481, "display_filter": "frame.number == 39481", "timestamp_epoch": "1533965400.871842000" }, { "udp_stream": 308, "frame_number": 39482, "display_filter": "frame.number == 39482", "timestamp_epoch": "1533965401.063902000" }, { "tcp_stream": 104, "frame_number": 4331, "display_filter": "frame.number == 4331", "timestamp_epoch": "1533964554.234128000" }, { "tcp_stream": 103, "frame_number": 4350, "display_filter": "frame.number == 4350", "timestamp_epoch": "1533964554.236277000" }, { "tcp_stream": 773, "frame_number": 28015, "display_filter": "frame.number == 28015", "timestamp_epoch": "1533965036.696949000" }, { "tcp_stream": 774, "frame_number": 28018, "display_filter": "frame.number == 28018", "timestamp_epoch": "1533965036.700513000" }, { "tcp_stream": 775, "frame_number": 28026, "display_filter": "frame.number == 28026", "timestamp_epoch": "1533965036.752397000" }, { "tcp_stream": 776, "frame_number": 28030, "display_filter": "frame.number == 28030", "timestamp_epoch": "1533965036.807677000" }, { "tcp_stream": 1034, "frame_number": 39486, "display_filter": "frame.number == 39486", "timestamp_epoch": "1533965401.164021000" }, { "tcp_stream": 1035, "frame_number": 39496, "display_filter": "frame.number == 39496", "timestamp_epoch": "1533965406.568628000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-21da2dd0fd56b47ebecaf3d6", "type": "domain", "value": "www.google-analytics.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 48, "frame_number": 3209, "display_filter": "frame.number == 3209", "timestamp_epoch": "1533964552.427007000" }, { "udp_stream": 48, "frame_number": 3327, "display_filter": "frame.number == 3327", "timestamp_epoch": "1533964552.700183000" }, { "udp_stream": 351, "frame_number": 44137, "display_filter": "frame.number == 44137", "timestamp_epoch": "1533965784.278556000" }, { "udp_stream": 351, "frame_number": 44230, "display_filter": "frame.number == 44230", "timestamp_epoch": "1533965784.477104000" }, { "tcp_stream": 89, "frame_number": 3448, "display_filter": "frame.number == 3448", "timestamp_epoch": "1533964552.872865000" }, { "tcp_stream": 88, "frame_number": 3452, "display_filter": "frame.number == 3452", "timestamp_epoch": "1533964552.874123000" }, { "tcp_stream": 214, "frame_number": 8417, "display_filter": "frame.number == 8417", "timestamp_epoch": "1533964898.250746000" }, { "tcp_stream": 215, "frame_number": 8425, "display_filter": "frame.number == 8425", "timestamp_epoch": "1533964898.266221000" }, { "tcp_stream": 1172, "frame_number": 44348, "display_filter": "frame.number == 44348", "timestamp_epoch": "1533965785.003892000" }, { "tcp_stream": 1171, "frame_number": 44368, "display_filter": "frame.number == 44368", "timestamp_epoch": "1533965785.010072000" }, { "tcp_stream": 1192, "frame_number": 45082, "display_filter": "frame.number == 45082", "timestamp_epoch": "1533965786.819879000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-fa186fa730f7bbff48167855", "type": "domain", "value": "www.google.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 58, "frame_number": 4677, "display_filter": "frame.number == 4677", "timestamp_epoch": "1533964555.194756000" }, { "udp_stream": 58, "frame_number": 4750, "display_filter": "frame.number == 4750", "timestamp_epoch": "1533964555.307152000" }, { "udp_stream": 360, "frame_number": 45622, "display_filter": "frame.number == 45622", "timestamp_epoch": "1533965788.343931000" }, { "udp_stream": 360, "frame_number": 45837, "display_filter": "frame.number == 45837", "timestamp_epoch": "1533965789.095261000" }, { "tcp_stream": 1208, "frame_number": 45898, "display_filter": "frame.number == 45898", "timestamp_epoch": "1533965789.194892000" }, { "tcp_stream": 109, "frame_number": 4775, "display_filter": "frame.number == 4775", "timestamp_epoch": "1533964555.360271000" }, { "tcp_stream": 110, "frame_number": 4777, "display_filter": "frame.number == 4777", "timestamp_epoch": "1533964555.360273000" }, { "tcp_stream": 236, "frame_number": 9024, "display_filter": "frame.number == 9024", "timestamp_epoch": "1533964898.996399000" }, { "tcp_stream": 237, "frame_number": 9027, "display_filter": "frame.number == 9027", "timestamp_epoch": "1533964898.996583000" }, { "tcp_stream": 1210, "frame_number": 45939, "display_filter": "frame.number == 45939", "timestamp_epoch": "1533965789.321805000" }, { "tcp_stream": 1217, "frame_number": 46105, "display_filter": "frame.number == 46105", "timestamp_epoch": "1533965789.758615000" }, { "tcp_stream": 1216, "frame_number": 46107, "display_filter": "frame.number == 46107", "timestamp_epoch": "1533965789.759079000" } ], "roles": [ "dns-query", "http-host", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-cd5a6ab6cd79e9a50658623b", "type": "domain", "value": "www.googletagmanager.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:46:38.593969+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:58.809039+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 339, "frame_number": 43640, "display_filter": "frame.number == 43640", "timestamp_epoch": "1533965783.005376000" }, { "udp_stream": 339, "frame_number": 43662, "display_filter": "frame.number == 43662", "timestamp_epoch": "1533965783.090968000" }, { "tcp_stream": 1147, "frame_number": 43686, "display_filter": "frame.number == 43686", "timestamp_epoch": "1533965783.173455000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:58.805929+00:00" }, { "observable_id": "observable-2f4cd8106dd545bea9c25565", "type": "domain", "value": "www.googletagservices.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 43, "frame_number": 3061, "display_filter": "frame.number == 3061", "timestamp_epoch": "1533964551.909128000" }, { "udp_stream": 43, "frame_number": 3185, "display_filter": "frame.number == 3185", "timestamp_epoch": "1533964552.354010000" }, { "udp_stream": 336, "frame_number": 43637, "display_filter": "frame.number == 43637", "timestamp_epoch": "1533965782.964876000" }, { "udp_stream": 336, "frame_number": 43648, "display_filter": "frame.number == 43648", "timestamp_epoch": "1533965783.044158000" }, { "tcp_stream": 1139, "frame_number": 43669, "display_filter": "frame.number == 43669", "timestamp_epoch": "1533965783.098093000" }, { "tcp_stream": 69, "frame_number": 3238, "display_filter": "frame.number == 3238", "timestamp_epoch": "1533964552.452910000" }, { "tcp_stream": 68, "frame_number": 3246, "display_filter": "frame.number == 3246", "timestamp_epoch": "1533964552.457436000" } ], "roles": [ "dns-query", "http-host", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-cc152019295b5193b24fda22", "type": "domain", "value": "www.msftncsi.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 24, "frame_number": 380, "display_filter": "frame.number == 380", "timestamp_epoch": "1533964519.258567000" }, { "udp_stream": 24, "frame_number": 381, "display_filter": "frame.number == 381", "timestamp_epoch": "1533964519.500541000" }, { "tcp_stream": 26, "frame_number": 385, "display_filter": "frame.number == 385", "timestamp_epoch": "1533964519.556735000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ef286096e361e1968a9523d1", "type": "domain", "value": "www.rt.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 27, "frame_number": 539, "display_filter": "frame.number == 539", "timestamp_epoch": "1533964544.230776000" }, { "udp_stream": 28, "frame_number": 541, "display_filter": "frame.number == 541", "timestamp_epoch": "1533964544.571554000" }, { "udp_stream": 28, "frame_number": 542, "display_filter": "frame.number == 542", "timestamp_epoch": "1533964544.690929000" }, { "udp_stream": 27, "frame_number": 543, "display_filter": "frame.number == 543", "timestamp_epoch": "1533964544.690931000" }, { "tcp_stream": 37, "frame_number": 550, "display_filter": "frame.number == 550", "timestamp_epoch": "1533964544.926326000" }, { "tcp_stream": 38, "frame_number": 552, "display_filter": "frame.number == 552", "timestamp_epoch": "1533964544.926457000" }, { "tcp_stream": 42, "frame_number": 636, "display_filter": "frame.number == 636", "timestamp_epoch": "1533964545.733784000" }, { "tcp_stream": 39, "frame_number": 638, "display_filter": "frame.number == 638", "timestamp_epoch": "1533964545.733803000" }, { "tcp_stream": 41, "frame_number": 642, "display_filter": "frame.number == 642", "timestamp_epoch": "1533964545.736658000" }, { "tcp_stream": 40, "frame_number": 646, "display_filter": "frame.number == 646", "timestamp_epoch": "1533964545.736960000" }, { "tcp_stream": 77, "frame_number": 3376, "display_filter": "frame.number == 3376", "timestamp_epoch": "1533964552.740894000" }, { "tcp_stream": 70, "frame_number": 3378, "display_filter": "frame.number == 3378", "timestamp_epoch": "1533964552.741152000" }, { "tcp_stream": 78, "frame_number": 3380, "display_filter": "frame.number == 3380", "timestamp_epoch": "1533964552.741239000" }, { "tcp_stream": 79, "frame_number": 3382, "display_filter": "frame.number == 3382", "timestamp_epoch": "1533964552.741451000" }, { "tcp_stream": 76, "frame_number": 3384, "display_filter": "frame.number == 3384", "timestamp_epoch": "1533964552.741554000" }, { "tcp_stream": 94, "frame_number": 3768, "display_filter": "frame.number == 3768", "timestamp_epoch": "1533964553.364593000" }, { "tcp_stream": 95, "frame_number": 3770, "display_filter": "frame.number == 3770", "timestamp_epoch": "1533964553.365363000" }, { "tcp_stream": 186, "frame_number": 7410, "display_filter": "frame.number == 7410", "timestamp_epoch": "1533964896.704230000" }, { "tcp_stream": 187, "frame_number": 7414, "display_filter": "frame.number == 7414", "timestamp_epoch": "1533964896.704820000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1d3c4b53bc5f07778c954ff5", "type": "domain", "value": "www.tns-counter.ru", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 50, "frame_number": 3211, "display_filter": "frame.number == 3211", "timestamp_epoch": "1533964552.429958000" }, { "udp_stream": 50, "frame_number": 3303, "display_filter": "frame.number == 3303", "timestamp_epoch": "1533964552.639522000" }, { "udp_stream": 341, "frame_number": 43642, "display_filter": "frame.number == 43642", "timestamp_epoch": "1533965783.028088000" }, { "udp_stream": 341, "frame_number": 43643, "display_filter": "frame.number == 43643", "timestamp_epoch": "1533965783.028284000" }, { "tcp_stream": 1137, "frame_number": 43727, "display_filter": "frame.number == 43727", "timestamp_epoch": "1533965783.254353000" }, { "tcp_stream": 1137, "frame_number": 43933, "display_filter": "frame.number == 43933", "timestamp_epoch": "1533965783.795213000" }, { "tcp_stream": 85, "frame_number": 3557, "display_filter": "frame.number == 3557", "timestamp_epoch": "1533964552.967444000" }, { "tcp_stream": 84, "frame_number": 3563, "display_filter": "frame.number == 3563", "timestamp_epoch": "1533964552.967938000" }, { "tcp_stream": 211, "frame_number": 8454, "display_filter": "frame.number == 8454", "timestamp_epoch": "1533964898.311765000" }, { "tcp_stream": 210, "frame_number": 8477, "display_filter": "frame.number == 8477", "timestamp_epoch": "1533964898.327920000" } ], "roles": [ "dns-query", "http-host", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e586ef68a407a60bb6b18881", "type": "domain", "value": "www.youtube.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 46, "frame_number": 3147, "display_filter": "frame.number == 3147", "timestamp_epoch": "1533964552.244810000" }, { "udp_stream": 46, "frame_number": 3212, "display_filter": "frame.number == 3212", "timestamp_epoch": "1533964552.430269000" }, { "udp_stream": 350, "frame_number": 44128, "display_filter": "frame.number == 44128", "timestamp_epoch": "1533965784.248113000" }, { "udp_stream": 350, "frame_number": 44229, "display_filter": "frame.number == 44229", "timestamp_epoch": "1533965784.476926000" }, { "tcp_stream": 81, "frame_number": 3318, "display_filter": "frame.number == 3318", "timestamp_epoch": "1533964552.685613000" }, { "tcp_stream": 80, "frame_number": 3321, "display_filter": "frame.number == 3321", "timestamp_epoch": "1533964552.686031000" }, { "tcp_stream": 98, "frame_number": 3953, "display_filter": "frame.number == 3953", "timestamp_epoch": "1533964553.582136000" }, { "tcp_stream": 96, "frame_number": 3955, "display_filter": "frame.number == 3955", "timestamp_epoch": "1533964553.582237000" }, { "tcp_stream": 97, "frame_number": 3969, "display_filter": "frame.number == 3969", "timestamp_epoch": "1533964553.584391000" }, { "tcp_stream": 203, "frame_number": 8129, "display_filter": "frame.number == 8129", "timestamp_epoch": "1533964897.943050000" }, { "tcp_stream": 202, "frame_number": 8131, "display_filter": "frame.number == 8131", "timestamp_epoch": "1533964897.943323000" }, { "tcp_stream": 229, "frame_number": 8743, "display_filter": "frame.number == 8743", "timestamp_epoch": "1533964898.710388000" }, { "tcp_stream": 228, "frame_number": 8745, "display_filter": "frame.number == 8745", "timestamp_epoch": "1533964898.710484000" }, { "tcp_stream": 1174, "frame_number": 44356, "display_filter": "frame.number == 44356", "timestamp_epoch": "1533965785.009008000" }, { "tcp_stream": 1173, "frame_number": 44366, "display_filter": "frame.number == 44366", "timestamp_epoch": "1533965785.009849000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6afafd5a71fc08769c1add69", "type": "domain", "value": "x.bidswitch.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 99, "frame_number": 8911, "display_filter": "frame.number == 8911", "timestamp_epoch": "1533964898.854136000" }, { "udp_stream": 99, "frame_number": 8979, "display_filter": "frame.number == 8979", "timestamp_epoch": "1533964898.946941000" }, { "tcp_stream": 243, "frame_number": 9061, "display_filter": "frame.number == 9061", "timestamp_epoch": "1533964899.026077000" }, { "tcp_stream": 242, "frame_number": 9063, "display_filter": "frame.number == 9063", "timestamp_epoch": "1533964899.026517000" }, { "tcp_stream": 610, "frame_number": 22977, "display_filter": "frame.number == 22977", "timestamp_epoch": "1533964996.316193000" }, { "tcp_stream": 611, "frame_number": 22980, "display_filter": "frame.number == 22980", "timestamp_epoch": "1533964996.316528000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-fe12c54b83f87a28d66ee186", "type": "domain", "value": "x.dlx.addthis.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 270, "frame_number": 27879, "display_filter": "frame.number == 27879", "timestamp_epoch": "1533965036.166310000" }, { "udp_stream": 270, "frame_number": 27927, "display_filter": "frame.number == 27927", "timestamp_epoch": "1533965036.249006000" }, { "tcp_stream": 770, "frame_number": 27948, "display_filter": "frame.number == 27948", "timestamp_epoch": "1533965036.402477000" }, { "tcp_stream": 771, "frame_number": 27949, "display_filter": "frame.number == 27949", "timestamp_epoch": "1533965036.402479000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2479630fb1e6308fe76cc1d5", "type": "domain", "value": "x.skimresources.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 217, "frame_number": 20181, "display_filter": "frame.number == 20181", "timestamp_epoch": "1533964964.890983000" }, { "udp_stream": 217, "frame_number": 20227, "display_filter": "frame.number == 20227", "timestamp_epoch": "1533964965.012520000" }, { "tcp_stream": 586, "frame_number": 20285, "display_filter": "frame.number == 20285", "timestamp_epoch": "1533964965.248555000" }, { "tcp_stream": 587, "frame_number": 20301, "display_filter": "frame.number == 20301", "timestamp_epoch": "1533964965.249899000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e40df2c21da5dbfba56c517c", "type": "domain", "value": "x.ss2.us", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 83, "frame_number": 6226, "display_filter": "frame.number == 6226", "timestamp_epoch": "1533964560.094890000" }, { "udp_stream": 84, "frame_number": 6227, "display_filter": "frame.number == 6227", "timestamp_epoch": "1533964560.102934000" }, { "udp_stream": 84, "frame_number": 6238, "display_filter": "frame.number == 6238", "timestamp_epoch": "1533964560.172654000" }, { "udp_stream": 83, "frame_number": 6239, "display_filter": "frame.number == 6239", "timestamp_epoch": "1533964560.172942000" }, { "tcp_stream": 158, "frame_number": 6267, "display_filter": "frame.number == 6267", "timestamp_epoch": "1533964560.250312000" }, { "tcp_stream": 159, "frame_number": 6271, "display_filter": "frame.number == 6271", "timestamp_epoch": "1533964560.267322000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-557c32bce40750d250148c04", "type": "domain", "value": "xs2-1096111735.us-east-1.elb.amazonaws.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 234, "frame_number": 23623, "display_filter": "frame.number == 23623", "timestamp_epoch": "1533964997.803829000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-293b6374167717db2b89f887", "type": "domain", "value": "yastatic.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 32, "frame_number": 596, "display_filter": "frame.number == 596", "timestamp_epoch": "1533964545.576638000" }, { "udp_stream": 32, "frame_number": 608, "display_filter": "frame.number == 608", "timestamp_epoch": "1533964545.638096000" }, { "tcp_stream": 46, "frame_number": 741, "display_filter": "frame.number == 741", "timestamp_epoch": "1533964545.878035000" }, { "tcp_stream": 45, "frame_number": 770, "display_filter": "frame.number == 770", "timestamp_epoch": "1533964545.905290000" }, { "tcp_stream": 295, "frame_number": 11792, "display_filter": "frame.number == 11792", "timestamp_epoch": "1533964901.575300000" }, { "tcp_stream": 294, "frame_number": 11803, "display_filter": "frame.number == 11803", "timestamp_epoch": "1533964901.578555000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c17dcfbfdc90d0382eeb4107", "type": "domain", "value": "youtube-ui.l.google.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 46, "frame_number": 3212, "display_filter": "frame.number == 3212", "timestamp_epoch": "1533964552.430269000" }, { "udp_stream": 350, "frame_number": 44229, "display_filter": "frame.number == 44229", "timestamp_epoch": "1533965784.476926000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1e8ebb97374ef7799279b3b3", "type": "domain", "value": "ytimg-edge-static.l.google.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 71, "frame_number": 5698, "display_filter": "frame.number == 5698", "timestamp_epoch": "1533964558.771373000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1cd721c3cc1a93bb66d2aac8", "type": "domain", "value": "ytstatic.l.google.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 356, "frame_number": 45110, "display_filter": "frame.number == 45110", "timestamp_epoch": "1533965786.890742000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b51f981b7d92a561278c829f", "type": "domain", "value": "z.moatads.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 125, "frame_number": 11727, "display_filter": "frame.number == 11727", "timestamp_epoch": "1533964901.537832000" }, { "udp_stream": 125, "frame_number": 11930, "display_filter": "frame.number == 11930", "timestamp_epoch": "1533964901.698652000" }, { "tcp_stream": 311, "frame_number": 11959, "display_filter": "frame.number == 11959", "timestamp_epoch": "1533964901.767859000" }, { "tcp_stream": 308, "frame_number": 11964, "display_filter": "frame.number == 11964", "timestamp_epoch": "1533964901.769138000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2c430604a46045bf6acb687f", "type": "domain", "value": "zedo-d.openx.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 139, "frame_number": 13252, "display_filter": "frame.number == 13252", "timestamp_epoch": "1533964903.183367000" }, { "udp_stream": 139, "frame_number": 13383, "display_filter": "frame.number == 13383", "timestamp_epoch": "1533964903.261260000" }, { "tcp_stream": 342, "frame_number": 13425, "display_filter": "frame.number == 13425", "timestamp_epoch": "1533964903.335589000" }, { "tcp_stream": 341, "frame_number": 13427, "display_filter": "frame.number == 13427", "timestamp_epoch": "1533964903.335838000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-73540aa58b5062e149836c34", "type": "domain", "value": "ztag-trackedevents-enterprise-1441845540.us-west-2.elb.amazonaws.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 162, "frame_number": 15556, "display_filter": "frame.number == 15556", "timestamp_epoch": "1533964906.746311000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ed4ca891511ae13c1a4a7c2d", "type": "ipv4", "value": "0.0.0.0", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-96aaa7bbf0447255e4ecb7b9", "type": "ipv4", "value": "103.5.149.72", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:58.819359+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:58.815511+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 126, "frame_number": 40087, "display_filter": "frame.number == 40087", "timestamp_epoch": "1533965768.408215000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:58.812095+00:00" }, { "observable_id": "observable-0caaf79606fdc5dc37e9590a", "type": "ipv4", "value": "103.5.149.77", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 193, "frame_number": 44698, "display_filter": "frame.number == 44698", "timestamp_epoch": "1533965786.043507000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a037596f43edfed333ec38c1", "type": "ipv4", "value": "104.110.128.239", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 127, "frame_number": 11957, "display_filter": "frame.number == 11957", "timestamp_epoch": "1533964901.767352000" }, { "udp_stream": 241, "frame_number": 24044, "display_filter": "frame.number == 24044", "timestamp_epoch": "1533964999.506406000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-cd7fb7958f0e2779d483933e", "type": "ipv4", "value": "104.16.237.184", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 237, "frame_number": 23970, "display_filter": "frame.number == 23970", "timestamp_epoch": "1533964998.468790000" }, { "udp_stream": 236, "frame_number": 23971, "display_filter": "frame.number == 23971", "timestamp_epoch": "1533964998.468958000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c3a141b03c0fcb563c6c467a", "type": "ipv4", "value": "104.16.238.184", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 237, "frame_number": 23970, "display_filter": "frame.number == 23970", "timestamp_epoch": "1533964998.468790000" }, { "udp_stream": 236, "frame_number": 23971, "display_filter": "frame.number == 23971", "timestamp_epoch": "1533964998.468958000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e1b5c61e54e446b76b2969aa", "type": "ipv4", "value": "104.16.239.184", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 237, "frame_number": 23970, "display_filter": "frame.number == 23970", "timestamp_epoch": "1533964998.468790000" }, { "udp_stream": 236, "frame_number": 23971, "display_filter": "frame.number == 23971", "timestamp_epoch": "1533964998.468958000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a621802d9ba001552cbe2482", "type": "ipv4", "value": "104.16.240.184", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 237, "frame_number": 23970, "display_filter": "frame.number == 23970", "timestamp_epoch": "1533964998.468790000" }, { "udp_stream": 236, "frame_number": 23971, "display_filter": "frame.number == 23971", "timestamp_epoch": "1533964998.468958000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2b813e1a7b061bac8bb4b909", "type": "ipv4", "value": "104.16.241.184", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 237, "frame_number": 23970, "display_filter": "frame.number == 23970", "timestamp_epoch": "1533964998.468790000" }, { "udp_stream": 236, "frame_number": 23971, "display_filter": "frame.number == 23971", "timestamp_epoch": "1533964998.468958000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c4d3518f17c5c3341402dd18", "type": "ipv4", "value": "104.16.89.188", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 121, "frame_number": 11428, "display_filter": "frame.number == 11428", "timestamp_epoch": "1533964901.270602000" }, { "udp_stream": 120, "frame_number": 11429, "display_filter": "frame.number == 11429", "timestamp_epoch": "1533964901.270707000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-608b18b4b08109dee427e4cd", "type": "ipv4", "value": "104.16.90.188", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 121, "frame_number": 11428, "display_filter": "frame.number == 11428", "timestamp_epoch": "1533964901.270602000" }, { "udp_stream": 120, "frame_number": 11429, "display_filter": "frame.number == 11429", "timestamp_epoch": "1533964901.270707000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6c31200e36e32c63d73f368a", "type": "ipv4", "value": "104.16.91.188", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 121, "frame_number": 11428, "display_filter": "frame.number == 11428", "timestamp_epoch": "1533964901.270602000" }, { "udp_stream": 120, "frame_number": 11429, "display_filter": "frame.number == 11429", "timestamp_epoch": "1533964901.270707000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-27512987e138866f89753fc2", "type": "ipv4", "value": "104.16.92.188", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 121, "frame_number": 11428, "display_filter": "frame.number == 11428", "timestamp_epoch": "1533964901.270602000" }, { "udp_stream": 120, "frame_number": 11429, "display_filter": "frame.number == 11429", "timestamp_epoch": "1533964901.270707000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-554b0daccc73aac4b2eb9c48", "type": "ipv4", "value": "104.16.93.188", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 121, "frame_number": 11428, "display_filter": "frame.number == 11428", "timestamp_epoch": "1533964901.270602000" }, { "udp_stream": 120, "frame_number": 11429, "display_filter": "frame.number == 11429", "timestamp_epoch": "1533964901.270707000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-65da8391848ccf80f3fd04af", "type": "ipv4", "value": "104.193.83.156", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 169, "frame_number": 16028, "display_filter": "frame.number == 16028", "timestamp_epoch": "1533964908.406114000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-dfb30ca3154714bcb20705ee", "type": "ipv4", "value": "104.193.83.157", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 169, "frame_number": 16028, "display_filter": "frame.number == 16028", "timestamp_epoch": "1533964908.406114000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e0b81521f345d3e8b13ce9d6", "type": "ipv4", "value": "104.198.109.132", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 99, "frame_number": 8979, "display_filter": "frame.number == 8979", "timestamp_epoch": "1533964898.946941000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-388f98a86dd3cc25b6f08680", "type": "ipv4", "value": "104.20.20.239", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 42, "frame_number": 3180, "display_filter": "frame.number == 3180", "timestamp_epoch": "1533964552.350754000" }, { "udp_stream": 74, "frame_number": 5863, "display_filter": "frame.number == 5863", "timestamp_epoch": "1533964559.449101000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ffa75f86e2186028de6256e9", "type": "ipv4", "value": "104.20.21.239", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 42, "frame_number": 3180, "display_filter": "frame.number == 3180", "timestamp_epoch": "1533964552.350754000" }, { "udp_stream": 74, "frame_number": 5863, "display_filter": "frame.number == 5863", "timestamp_epoch": "1533964559.449101000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c84183c56554dea3c309dbcf", "type": "ipv4", "value": "104.24.246.16", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 245, "frame_number": 26408, "display_filter": "frame.number == 26408", "timestamp_epoch": "1533965032.676936000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f787bf9dd4359cf0ad667c2a", "type": "ipv4", "value": "104.24.247.16", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 245, "frame_number": 26408, "display_filter": "frame.number == 26408", "timestamp_epoch": "1533965032.676936000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-256203749f16488b6341059c", "type": "ipv4", "value": "104.25.162.34", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 51, "frame_number": 3335, "display_filter": "frame.number == 3335", "timestamp_epoch": "1533964552.717075000" }, { "udp_stream": 93, "frame_number": 8506, "display_filter": "frame.number == 8506", "timestamp_epoch": "1533964898.378728000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-13b0d87c753b9debdb9e96e9", "type": "ipv4", "value": "104.25.163.34", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 51, "frame_number": 3335, "display_filter": "frame.number == 3335", "timestamp_epoch": "1533964552.717075000" }, { "udp_stream": 93, "frame_number": 8506, "display_filter": "frame.number == 8506", "timestamp_epoch": "1533964898.378728000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-91673b98b50d053008c8ea1b", "type": "ipv4", "value": "104.254.150.108", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 210, "frame_number": 19910, "display_filter": "frame.number == 19910", "timestamp_epoch": "1533964963.540458000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3c2b81e758c3d9a44ede8a37", "type": "ipv4", "value": "104.254.150.11", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 100, "frame_number": 8956, "display_filter": "frame.number == 8956", "timestamp_epoch": "1533964898.930148000" }, { "udp_stream": 184, "frame_number": 18186, "display_filter": "frame.number == 18186", "timestamp_epoch": "1533964958.450245000" }, { "udp_stream": 202, "frame_number": 19300, "display_filter": "frame.number == 19300", "timestamp_epoch": "1533964961.756585000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ac3886b441ecaed4560e9ab6", "type": "ipv4", "value": "104.254.150.13", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 100, "frame_number": 8956, "display_filter": "frame.number == 8956", "timestamp_epoch": "1533964898.930148000" }, { "udp_stream": 184, "frame_number": 18186, "display_filter": "frame.number == 18186", "timestamp_epoch": "1533964958.450245000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0248c44d6d3cc5ba99b1cea1", "type": "ipv4", "value": "104.254.150.179", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 210, "frame_number": 19910, "display_filter": "frame.number == 19910", "timestamp_epoch": "1533964963.540458000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c2e4771f6243938295742a51", "type": "ipv4", "value": "104.254.150.37", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 100, "frame_number": 8956, "display_filter": "frame.number == 8956", "timestamp_epoch": "1533964898.930148000" }, { "udp_stream": 184, "frame_number": 18186, "display_filter": "frame.number == 18186", "timestamp_epoch": "1533964958.450245000" }, { "udp_stream": 202, "frame_number": 19300, "display_filter": "frame.number == 19300", "timestamp_epoch": "1533964961.756585000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-01dcc88640decf68314d2800", "type": "ipv4", "value": "104.254.150.4", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 202, "frame_number": 19300, "display_filter": "frame.number == 19300", "timestamp_epoch": "1533964961.756585000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-eee5e8216fba99b59a939884", "type": "ipv4", "value": "104.254.150.58", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 100, "frame_number": 8956, "display_filter": "frame.number == 8956", "timestamp_epoch": "1533964898.930148000" }, { "udp_stream": 184, "frame_number": 18186, "display_filter": "frame.number == 18186", "timestamp_epoch": "1533964958.450245000" }, { "udp_stream": 202, "frame_number": 19300, "display_filter": "frame.number == 19300", "timestamp_epoch": "1533964961.756585000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-871189e0c432cc7b8f79aa02", "type": "ipv4", "value": "104.254.150.59", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 100, "frame_number": 8956, "display_filter": "frame.number == 8956", "timestamp_epoch": "1533964898.930148000" }, { "udp_stream": 184, "frame_number": 18186, "display_filter": "frame.number == 18186", "timestamp_epoch": "1533964958.450245000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-19d1bd043b1eaa1798c9ca6c", "type": "ipv4", "value": "104.254.150.69", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 100, "frame_number": 8956, "display_filter": "frame.number == 8956", "timestamp_epoch": "1533964898.930148000" }, { "udp_stream": 184, "frame_number": 18186, "display_filter": "frame.number == 18186", "timestamp_epoch": "1533964958.450245000" }, { "udp_stream": 202, "frame_number": 19300, "display_filter": "frame.number == 19300", "timestamp_epoch": "1533964961.756585000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-73289d24150c8460c7926585", "type": "ipv4", "value": "104.254.150.70", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 202, "frame_number": 19300, "display_filter": "frame.number == 19300", "timestamp_epoch": "1533964961.756585000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7795e4a894ba0c383de44beb", "type": "ipv4", "value": "104.254.150.77", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 100, "frame_number": 8956, "display_filter": "frame.number == 8956", "timestamp_epoch": "1533964898.930148000" }, { "udp_stream": 184, "frame_number": 18186, "display_filter": "frame.number == 18186", "timestamp_epoch": "1533964958.450245000" }, { "udp_stream": 202, "frame_number": 19300, "display_filter": "frame.number == 19300", "timestamp_epoch": "1533964961.756585000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d7123cbae498a33d05a83609", "type": "ipv4", "value": "104.254.150.9", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 100, "frame_number": 8956, "display_filter": "frame.number == 8956", "timestamp_epoch": "1533964898.930148000" }, { "udp_stream": 184, "frame_number": 18186, "display_filter": "frame.number == 18186", "timestamp_epoch": "1533964958.450245000" }, { "udp_stream": 202, "frame_number": 19300, "display_filter": "frame.number == 19300", "timestamp_epoch": "1533964961.756585000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-95641815635b924ec8a0258e", "type": "ipv4", "value": "104.36.113.17", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 128, "frame_number": 11978, "display_filter": "frame.number == 11978", "timestamp_epoch": "1533964901.783846000" }, { "udp_stream": 170, "frame_number": 16092, "display_filter": "frame.number == 16092", "timestamp_epoch": "1533964908.469322000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8eeacae169fe041a0233c110", "type": "ipv4", "value": "104.36.113.23", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 165, "frame_number": 15930, "display_filter": "frame.number == 15930", "timestamp_epoch": "1533964908.051426000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b57aa0cc1043b689e65ea7da", "type": "ipv4", "value": "104.36.113.24", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 171, "frame_number": 16389, "display_filter": "frame.number == 16389", "timestamp_epoch": "1533964908.885044000" }, { "udp_stream": 176, "frame_number": 16722, "display_filter": "frame.number == 16722", "timestamp_epoch": "1533964910.397514000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a66e65aac432fb8f9c5ba1e8", "type": "ipv4", "value": "107.178.242.85", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 286, "frame_number": 31668, "display_filter": "frame.number == 31668", "timestamp_epoch": "1533965100.795644000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-9c8f7bce39f5215993f65879", "type": "ipv4", "value": "107.178.254.65", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 218, "frame_number": 20323, "display_filter": "frame.number == 20323", "timestamp_epoch": "1533964965.297460000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-dd9497a4395dbb2881d7503a", "type": "ipv4", "value": "107.21.48.136", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 240, "frame_number": 24040, "display_filter": "frame.number == 24040", "timestamp_epoch": "1533964999.467395000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-17a7745e38a13c08315a0acc", "type": "ipv4", "value": "107.23.160.218", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 112, "frame_number": 10606, "display_filter": "frame.number == 10606", "timestamp_epoch": "1533964900.584234000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-755706316ba19459ee092e0f", "type": "ipv4", "value": "107.23.83.163", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 190, "frame_number": 18568, "display_filter": "frame.number == 18568", "timestamp_epoch": "1533964959.365164000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7aba3a755465363099c2b3ae", "type": "ipv4", "value": "108.177.12.120", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 151, "frame_number": 14626, "display_filter": "frame.number == 14626", "timestamp_epoch": "1533964904.641770000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f870cbc074aa5f6b73ac1873", "type": "ipv4", "value": "108.177.12.94", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 151, "frame_number": 14626, "display_filter": "frame.number == 14626", "timestamp_epoch": "1533964904.641770000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-9b9c1c7243f75246db674120", "type": "ipv4", "value": "108.59.0.12", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 113, "frame_number": 10616, "display_filter": "frame.number == 10616", "timestamp_epoch": "1533964900.621029000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8a365e15ed870724ef72faca", "type": "ipv4", "value": "108.59.0.8", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 113, "frame_number": 10616, "display_filter": "frame.number == 10616", "timestamp_epoch": "1533964900.621029000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-55319fc89eaa18fb407aa9f9", "type": "ipv4", "value": "108.59.4.171", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 113, "frame_number": 10616, "display_filter": "frame.number == 10616", "timestamp_epoch": "1533964900.621029000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0caa487a95688442a4a0ee9f", "type": "ipv4", "value": "108.59.4.172", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 113, "frame_number": 10616, "display_filter": "frame.number == 10616", "timestamp_epoch": "1533964900.621029000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-db87856edd3a46b67d15deb4", "type": "ipv4", "value": "108.59.4.173", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 113, "frame_number": 10616, "display_filter": "frame.number == 10616", "timestamp_epoch": "1533964900.621029000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-148f89512a04fa71fb41b300", "type": "ipv4", "value": "109.201.156.81", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 329, "frame_number": 40243, "display_filter": "frame.number == 40243", "timestamp_epoch": "1533965770.575466000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0903e43d0eecf956699fabc0", "type": "ipv4", "value": "109.232.197.110", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 200, "frame_number": 19258, "display_filter": "frame.number == 19258", "timestamp_epoch": "1533964961.633523000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a8e8d717d2f3c00897d001b7", "type": "ipv4", "value": "109.232.197.33", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 200, "frame_number": 19258, "display_filter": "frame.number == 19258", "timestamp_epoch": "1533964961.633523000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-431a8bebcf09aff10e381b32", "type": "ipv4", "value": "13.107.21.200", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 38, "frame_number": 2263, "display_filter": "frame.number == 2263", "timestamp_epoch": "1533964549.230108000" }, { "udp_stream": 39, "frame_number": 2265, "display_filter": "frame.number == 2265", "timestamp_epoch": "1533964549.230112000" }, { "udp_stream": 40, "frame_number": 2266, "display_filter": "frame.number == 2266", "timestamp_epoch": "1533964549.230247000" }, { "udp_stream": 37, "frame_number": 2268, "display_filter": "frame.number == 2268", "timestamp_epoch": "1533964549.230297000" }, { "udp_stream": 206, "frame_number": 19673, "display_filter": "frame.number == 19673", "timestamp_epoch": "1533964962.856769000" }, { "udp_stream": 333, "frame_number": 43410, "display_filter": "frame.number == 43410", "timestamp_epoch": "1533965778.972314000" }, { "udp_stream": 334, "frame_number": 43411, "display_filter": "frame.number == 43411", "timestamp_epoch": "1533965778.972428000" }, { "udp_stream": 335, "frame_number": 43412, "display_filter": "frame.number == 43412", "timestamp_epoch": "1533965778.972581000" }, { "udp_stream": 333, "frame_number": 43413, "display_filter": "frame.number == 43413", "timestamp_epoch": "1533965778.972688000" }, { "udp_stream": 334, "frame_number": 43415, "display_filter": "frame.number == 43415", "timestamp_epoch": "1533965778.972803000" }, { "udp_stream": 335, "frame_number": 43417, "display_filter": "frame.number == 43417", "timestamp_epoch": "1533965778.972805000" }, { "udp_stream": 334, "frame_number": 43418, "display_filter": "frame.number == 43418", "timestamp_epoch": "1533965778.972933000" }, { "udp_stream": 333, "frame_number": 43419, "display_filter": "frame.number == 43419", "timestamp_epoch": "1533965778.972999000" }, { "udp_stream": 335, "frame_number": 43420, "display_filter": "frame.number == 43420", "timestamp_epoch": "1533965778.973091000" }, { "udp_stream": 332, "frame_number": 43421, "display_filter": "frame.number == 43421", "timestamp_epoch": "1533965778.973203000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-88a32548d4051118930887f8", "type": "ipv4", "value": "13.107.4.50", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 272, "frame_number": 27994, "display_filter": "frame.number == 27994", "timestamp_epoch": "1533965036.569466000" }, { "udp_stream": 271, "frame_number": 27995, "display_filter": "frame.number == 27995", "timestamp_epoch": "1533965036.569468000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-735eb278fd02dee8709733eb", "type": "ipv4", "value": "13.107.5.80", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 35, "frame_number": 2030, "display_filter": "frame.number == 2030", "timestamp_epoch": "1533964548.338547000" }, { "udp_stream": 36, "frame_number": 2032, "display_filter": "frame.number == 2032", "timestamp_epoch": "1533964548.338743000" }, { "udp_stream": 331, "frame_number": 41615, "display_filter": "frame.number == 41615", "timestamp_epoch": "1533965774.364547000" }, { "udp_stream": 331, "frame_number": 41618, "display_filter": "frame.number == 41618", "timestamp_epoch": "1533965774.364689000" }, { "udp_stream": 330, "frame_number": 41619, "display_filter": "frame.number == 41619", "timestamp_epoch": "1533965774.364956000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4b451257b265f47991f3fa71", "type": "ipv4", "value": "13.33.106.254", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 72, "frame_number": 5857, "display_filter": "frame.number == 5857", "timestamp_epoch": "1533964559.422782000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-76fa16bfab85d8dbe112d4d5", "type": "ipv4", "value": "13.33.107.131", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 111, "frame_number": 10617, "display_filter": "frame.number == 10617", "timestamp_epoch": "1533964900.621189000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-83270b02459a1d5755cf1a29", "type": "ipv4", "value": "13.33.107.160", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 111, "frame_number": 10617, "display_filter": "frame.number == 10617", "timestamp_epoch": "1533964900.621189000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4fd8792c563fce9ab9d5eeb9", "type": "ipv4", "value": "13.33.107.209", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 111, "frame_number": 10617, "display_filter": "frame.number == 10617", "timestamp_epoch": "1533964900.621189000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3c6faa35dad298b10a50bf8b", "type": "ipv4", "value": "13.33.107.212", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 111, "frame_number": 10617, "display_filter": "frame.number == 10617", "timestamp_epoch": "1533964900.621189000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ae7470064df29eb6ce78ca84", "type": "ipv4", "value": "13.33.78.101", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 213, "frame_number": 20107, "display_filter": "frame.number == 20107", "timestamp_epoch": "1533964964.633293000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a03eaa020c90236a3f038427", "type": "ipv4", "value": "13.33.78.144", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 213, "frame_number": 20107, "display_filter": "frame.number == 20107", "timestamp_epoch": "1533964964.633293000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2b3451f1322400ec96dc5360", "type": "ipv4", "value": "13.33.78.186", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 84, "frame_number": 6238, "display_filter": "frame.number == 6238", "timestamp_epoch": "1533964560.172654000" }, { "udp_stream": 83, "frame_number": 6239, "display_filter": "frame.number == 6239", "timestamp_epoch": "1533964560.172942000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8b23663457051139c7d6a663", "type": "ipv4", "value": "13.33.78.214", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 84, "frame_number": 6238, "display_filter": "frame.number == 6238", "timestamp_epoch": "1533964560.172654000" }, { "udp_stream": 83, "frame_number": 6239, "display_filter": "frame.number == 6239", "timestamp_epoch": "1533964560.172942000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-37ca79d2bfddd8afd9bb1827", "type": "ipv4", "value": "13.33.78.217", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 213, "frame_number": 20107, "display_filter": "frame.number == 20107", "timestamp_epoch": "1533964964.633293000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-13241b6c11e46674b6720b68", "type": "ipv4", "value": "13.33.78.38", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 213, "frame_number": 20107, "display_filter": "frame.number == 20107", "timestamp_epoch": "1533964964.633293000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-23ab7029992ae0d03a601347", "type": "ipv4", "value": "13.33.78.48", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 84, "frame_number": 6238, "display_filter": "frame.number == 6238", "timestamp_epoch": "1533964560.172654000" }, { "udp_stream": 83, "frame_number": 6239, "display_filter": "frame.number == 6239", "timestamp_epoch": "1533964560.172942000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-26dbc1df975d91621a50d29d", "type": "ipv4", "value": "13.33.78.61", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 84, "frame_number": 6238, "display_filter": "frame.number == 6238", "timestamp_epoch": "1533964560.172654000" }, { "udp_stream": 83, "frame_number": 6239, "display_filter": "frame.number == 6239", "timestamp_epoch": "1533964560.172942000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-42d788bcbb6f84a6a2032dbb", "type": "ipv4", "value": "13.56.1.77", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 102, "frame_number": 8976, "display_filter": "frame.number == 8976", "timestamp_epoch": "1533964898.938935000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-644dddf741e2acd314da7516", "type": "ipv4", "value": "13.57.103.80", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 212, "frame_number": 20071, "display_filter": "frame.number == 20071", "timestamp_epoch": "1533964964.450971000" }, { "udp_stream": 242, "frame_number": 24228, "display_filter": "frame.number == 24228", "timestamp_epoch": "1533965001.681775000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3de91ba3161cbcfad2aaa019", "type": "ipv4", "value": "13.57.162.22", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 277, "frame_number": 30810, "display_filter": "frame.number == 30810", "timestamp_epoch": "1533965099.289135000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b516ddc5c64a715511015154", "type": "ipv4", "value": "13.57.70.199", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 141, "frame_number": 13494, "display_filter": "frame.number == 13494", "timestamp_epoch": "1533964903.481649000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-fd9b2668bea4b45a64bc40e5", "type": "ipv4", "value": "13.57.96.247", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 217, "frame_number": 20227, "display_filter": "frame.number == 20227", "timestamp_epoch": "1533964965.012520000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-63402ffdc034d4492cadf4b7", "type": "ipv4", "value": "13.59.169.161", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 293, "frame_number": 32841, "display_filter": "frame.number == 32841", "timestamp_epoch": "1533965136.087192000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-9c1d4ab7b5d0af4014ea2cff", "type": "ipv4", "value": "13.59.61.143", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 293, "frame_number": 32841, "display_filter": "frame.number == 32841", "timestamp_epoch": "1533965136.087192000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-abde429364714712b36bd160", "type": "ipv4", "value": "136.243.151.13", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 358, "frame_number": 45340, "display_filter": "frame.number == 45340", "timestamp_epoch": "1533965787.454378000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6ffaeef16043e82dc50f30bc", "type": "ipv4", "value": "136.243.249.79", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 29, "frame_number": 605, "display_filter": "frame.number == 605", "timestamp_epoch": "1533964545.630742000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a1f67a43b4d0328ad2b42709", "type": "ipv4", "value": "136.243.25.70", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 29, "frame_number": 605, "display_filter": "frame.number == 605", "timestamp_epoch": "1533964545.630742000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-80e17f5b10edc8328dac0b52", "type": "ipv4", "value": "136.243.42.207", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 105, "frame_number": 9340, "display_filter": "frame.number == 9340", "timestamp_epoch": "1533964899.269568000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8e5668d096ab487d142678da", "type": "ipv4", "value": "136.243.42.249", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 105, "frame_number": 9340, "display_filter": "frame.number == 9340", "timestamp_epoch": "1533964899.269568000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-dc3c5c7ac4fdfb2fb957d8b3", "type": "ipv4", "value": "136.243.7.47", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 122, "frame_number": 11789, "display_filter": "frame.number == 11789", "timestamp_epoch": "1533964901.574246000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7ebad788b7c844f8f6c76ac6", "type": "ipv4", "value": "136.243.73.56", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 122, "frame_number": 11789, "display_filter": "frame.number == 11789", "timestamp_epoch": "1533964901.574246000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f2ad0cbce89c596f79a2dec3", "type": "ipv4", "value": "136.243.95.174", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 29, "frame_number": 605, "display_filter": "frame.number == 605", "timestamp_epoch": "1533964545.630742000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-12305c763292151e238f63d2", "type": "ipv4", "value": "136.243.95.176", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 29, "frame_number": 605, "display_filter": "frame.number == 605", "timestamp_epoch": "1533964545.630742000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-9f82c8a5628c978b10d706c3", "type": "ipv4", "value": "142.93.53.73", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 349, "frame_number": 44215, "display_filter": "frame.number == 44215", "timestamp_epoch": "1533965784.462482000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a60a74d688c33633ce5510db", "type": "ipv4", "value": "142.93.61.36", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 349, "frame_number": 44215, "display_filter": "frame.number == 44215", "timestamp_epoch": "1533965784.462482000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2109a3bd4b88c075601377db", "type": "ipv4", "value": "142.93.61.37", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 349, "frame_number": 44215, "display_filter": "frame.number == 44215", "timestamp_epoch": "1533965784.462482000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-296063da5c21ef8de9d47d75", "type": "ipv4", "value": "142.93.61.39", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 349, "frame_number": 44215, "display_filter": "frame.number == 44215", "timestamp_epoch": "1533965784.462482000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6eae8c16399ea5a5a709625a", "type": "ipv4", "value": "142.93.61.40", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 349, "frame_number": 44215, "display_filter": "frame.number == 44215", "timestamp_epoch": "1533965784.462482000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-cb1349d7a7401aab36f627e1", "type": "ipv4", "value": "144.76.121.172", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 29, "frame_number": 605, "display_filter": "frame.number == 605", "timestamp_epoch": "1533964545.630742000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ff309a071771487afd419035", "type": "ipv4", "value": "146.20.132.242", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 163, "frame_number": 15635, "display_filter": "frame.number == 15635", "timestamp_epoch": "1533964906.967863000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-02bb05cec52c8fae7a4c8e93", "type": "ipv4", "value": "146.20.132.243", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 163, "frame_number": 15635, "display_filter": "frame.number == 15635", "timestamp_epoch": "1533964906.967863000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d11a67f9eff3c4baaa91b6a7", "type": "ipv4", "value": "146.20.132.244", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 163, "frame_number": 15635, "display_filter": "frame.number == 15635", "timestamp_epoch": "1533964906.967863000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b40e834ae969526d2af052f8", "type": "ipv4", "value": "146.20.132.245", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 163, "frame_number": 15635, "display_filter": "frame.number == 15635", "timestamp_epoch": "1533964906.967863000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5664d3168b5f9573e03d8f5e", "type": "ipv4", "value": "146.20.132.246", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 163, "frame_number": 15635, "display_filter": "frame.number == 15635", "timestamp_epoch": "1533964906.967863000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-9cdd144aea08b9dba1619870", "type": "ipv4", "value": "146.20.132.247", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 163, "frame_number": 15635, "display_filter": "frame.number == 15635", "timestamp_epoch": "1533964906.967863000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2353443b9c9551ab74189021", "type": "ipv4", "value": "146.20.132.248", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 163, "frame_number": 15635, "display_filter": "frame.number == 15635", "timestamp_epoch": "1533964906.967863000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f31b6750936ec669d024dc2f", "type": "ipv4", "value": "146.20.132.249", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 163, "frame_number": 15635, "display_filter": "frame.number == 15635", "timestamp_epoch": "1533964906.967863000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-fabf0280ad790aa8f601c254", "type": "ipv4", "value": "146.20.132.250", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 163, "frame_number": 15635, "display_filter": "frame.number == 15635", "timestamp_epoch": "1533964906.967863000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0848c5e065383867bff165f9", "type": "ipv4", "value": "146.20.132.251", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 163, "frame_number": 15635, "display_filter": "frame.number == 15635", "timestamp_epoch": "1533964906.967863000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-20d4838af0c15cee654cf37c", "type": "ipv4", "value": "146.20.132.252", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 163, "frame_number": 15635, "display_filter": "frame.number == 15635", "timestamp_epoch": "1533964906.967863000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f4c798f6049033b02aa30116", "type": "ipv4", "value": "146.20.132.253", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 163, "frame_number": 15635, "display_filter": "frame.number == 15635", "timestamp_epoch": "1533964906.967863000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8622f3ab505499dbcdcf852a", "type": "ipv4", "value": "146.20.132.254", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 163, "frame_number": 15635, "display_filter": "frame.number == 15635", "timestamp_epoch": "1533964906.967863000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-00b6d4e7c05c1c61acff0ccb", "type": "ipv4", "value": "146.20.132.255", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 163, "frame_number": 15635, "display_filter": "frame.number == 15635", "timestamp_epoch": "1533964906.967863000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-457f199b9960be382116fa5c", "type": "ipv4", "value": "146.20.133.0", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 163, "frame_number": 15635, "display_filter": "frame.number == 15635", "timestamp_epoch": "1533964906.967863000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-64d0593319b0815ffb920d1d", "type": "ipv4", "value": "146.20.133.1", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 163, "frame_number": 15635, "display_filter": "frame.number == 15635", "timestamp_epoch": "1533964906.967863000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2d671221cedcc06cf1854b9e", "type": "ipv4", "value": "146.20.133.82", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 157, "frame_number": 14679, "display_filter": "frame.number == 14679", "timestamp_epoch": "1533964904.689217000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e98cef13093f61c9f06d83e0", "type": "ipv4", "value": "146.20.133.83", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 157, "frame_number": 14679, "display_filter": "frame.number == 14679", "timestamp_epoch": "1533964904.689217000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e69c9e01fa603839d0758dce", "type": "ipv4", "value": "146.20.133.84", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 157, "frame_number": 14679, "display_filter": "frame.number == 14679", "timestamp_epoch": "1533964904.689217000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5f2e1c3b94ecd73a76177993", "type": "ipv4", "value": "146.20.133.85", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 157, "frame_number": 14679, "display_filter": "frame.number == 14679", "timestamp_epoch": "1533964904.689217000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1f80af41b748f405b72b8bd7", "type": "ipv4", "value": "146.20.133.86", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 157, "frame_number": 14679, "display_filter": "frame.number == 14679", "timestamp_epoch": "1533964904.689217000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-89a8810622fc743e24be48a8", "type": "ipv4", "value": "146.20.133.87", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 157, "frame_number": 14679, "display_filter": "frame.number == 14679", "timestamp_epoch": "1533964904.689217000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5302bc645751f78b78ad1625", "type": "ipv4", "value": "146.20.133.88", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 157, "frame_number": 14679, "display_filter": "frame.number == 14679", "timestamp_epoch": "1533964904.689217000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-03f378060419dc26995e0868", "type": "ipv4", "value": "146.20.133.89", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 157, "frame_number": 14679, "display_filter": "frame.number == 14679", "timestamp_epoch": "1533964904.689217000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c517e49f4fe1fb4d099e8e97", "type": "ipv4", "value": "146.20.133.90", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 157, "frame_number": 14679, "display_filter": "frame.number == 14679", "timestamp_epoch": "1533964904.689217000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-dd97acc872854791c2c0649f", "type": "ipv4", "value": "146.20.133.91", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 157, "frame_number": 14679, "display_filter": "frame.number == 14679", "timestamp_epoch": "1533964904.689217000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-66421ac70b7a362d6cae74af", "type": "ipv4", "value": "146.20.133.92", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 157, "frame_number": 14679, "display_filter": "frame.number == 14679", "timestamp_epoch": "1533964904.689217000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c38df622f741be56dbc5a3f2", "type": "ipv4", "value": "146.20.133.93", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 157, "frame_number": 14679, "display_filter": "frame.number == 14679", "timestamp_epoch": "1533964904.689217000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d3654d3c19e1ae6f4290a597", "type": "ipv4", "value": "146.20.133.94", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 157, "frame_number": 14679, "display_filter": "frame.number == 14679", "timestamp_epoch": "1533964904.689217000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a9b08dde55157c62483df084", "type": "ipv4", "value": "146.20.133.95", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 157, "frame_number": 14679, "display_filter": "frame.number == 14679", "timestamp_epoch": "1533964904.689217000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-65dec8e525e1a02cc7c1c964", "type": "ipv4", "value": "146.20.133.96", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 157, "frame_number": 14679, "display_filter": "frame.number == 14679", "timestamp_epoch": "1533964904.689217000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8c5325a6e0af4360a59dbb01", "type": "ipv4", "value": "146.20.133.97", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 157, "frame_number": 14679, "display_filter": "frame.number == 14679", "timestamp_epoch": "1533964904.689217000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-061cd4bb3a6285e0e9e82218", "type": "ipv4", "value": "148.251.82.59", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 123, "frame_number": 11477, "display_filter": "frame.number == 11477", "timestamp_epoch": "1533964901.323587000" }, { "udp_stream": 124, "frame_number": 11530, "display_filter": "frame.number == 11530", "timestamp_epoch": "1533964901.340738000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1ac3d2569214ee0d3b919151", "type": "ipv4", "value": "149.129.222.112", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:59.014714+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:59.010975+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 89, "frame_number": 7259, "display_filter": "frame.number == 7259", "timestamp_epoch": "1533964850.053278000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:59.008177+00:00" }, { "observable_id": "observable-fe33be4f5c690aca2164e9f5", "type": "ipv4", "value": "149.174.66.131", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 79, "frame_number": 5893, "display_filter": "frame.number == 5893", "timestamp_epoch": "1533964559.525559000" }, { "udp_stream": 229, "frame_number": 23322, "display_filter": "frame.number == 23322", "timestamp_epoch": "1533964997.328492000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d4e72a469971dba3b5a8d8f0", "type": "ipv4", "value": "151.101.0.166", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 246, "frame_number": 26420, "display_filter": "frame.number == 26420", "timestamp_epoch": "1533965032.696494000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f42ef9630b8c9fbf0f12486e", "type": "ipv4", "value": "151.101.128.166", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 246, "frame_number": 26420, "display_filter": "frame.number == 26420", "timestamp_epoch": "1533965032.696494000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-18beb671a52243b24c4627f1", "type": "ipv4", "value": "151.101.130.2", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 138, "frame_number": 13349, "display_filter": "frame.number == 13349", "timestamp_epoch": "1533964903.242983000" }, { "udp_stream": 279, "frame_number": 31673, "display_filter": "frame.number == 31673", "timestamp_epoch": "1533965100.796418000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-353e182073fdab85b32b2411", "type": "ipv4", "value": "151.101.130.49", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 63, "frame_number": 5155, "display_filter": "frame.number == 5155", "timestamp_epoch": "1533964556.031163000" }, { "udp_stream": 191, "frame_number": 18574, "display_filter": "frame.number == 18574", "timestamp_epoch": "1533964959.368247000" }, { "udp_stream": 287, "frame_number": 32144, "display_filter": "frame.number == 32144", "timestamp_epoch": "1533965101.694508000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c4153ecca717eabe9584063d", "type": "ipv4", "value": "151.101.192.166", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 246, "frame_number": 26420, "display_filter": "frame.number == 26420", "timestamp_epoch": "1533965032.696494000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-cff9cd7aba62d733cfccfa98", "type": "ipv4", "value": "151.101.194.2", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 138, "frame_number": 13349, "display_filter": "frame.number == 13349", "timestamp_epoch": "1533964903.242983000" }, { "udp_stream": 279, "frame_number": 31673, "display_filter": "frame.number == 31673", "timestamp_epoch": "1533965100.796418000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0cf18939e9ce1dd8dbc93b38", "type": "ipv4", "value": "151.101.194.49", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 63, "frame_number": 5155, "display_filter": "frame.number == 5155", "timestamp_epoch": "1533964556.031163000" }, { "udp_stream": 191, "frame_number": 18574, "display_filter": "frame.number == 18574", "timestamp_epoch": "1533964959.368247000" }, { "udp_stream": 287, "frame_number": 32144, "display_filter": "frame.number == 32144", "timestamp_epoch": "1533965101.694508000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8fc6cab21b2d851315f7b759", "type": "ipv4", "value": "151.101.2.2", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 138, "frame_number": 13349, "display_filter": "frame.number == 13349", "timestamp_epoch": "1533964903.242983000" }, { "udp_stream": 279, "frame_number": 31673, "display_filter": "frame.number == 31673", "timestamp_epoch": "1533965100.796418000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e121f2e249a0fdabea83979e", "type": "ipv4", "value": "151.101.2.49", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 63, "frame_number": 5155, "display_filter": "frame.number == 5155", "timestamp_epoch": "1533964556.031163000" }, { "udp_stream": 191, "frame_number": 18574, "display_filter": "frame.number == 18574", "timestamp_epoch": "1533964959.368247000" }, { "udp_stream": 287, "frame_number": 32144, "display_filter": "frame.number == 32144", "timestamp_epoch": "1533965101.694508000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7dfa23bf13eaf7d72d956b6b", "type": "ipv4", "value": "151.101.41.108", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 226, "frame_number": 23216, "display_filter": "frame.number == 23216", "timestamp_epoch": "1533964997.081499000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4e33cc23e91fa3598afad5fc", "type": "ipv4", "value": "151.101.53.108", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 201, "frame_number": 19305, "display_filter": "frame.number == 19305", "timestamp_epoch": "1533964961.766961000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-645a83affdcd1c2c39d85de0", "type": "ipv4", "value": "151.101.64.166", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 246, "frame_number": 26420, "display_filter": "frame.number == 26420", "timestamp_epoch": "1533965032.696494000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3da98076a3313d04ffe99719", "type": "ipv4", "value": "151.101.66.2", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 138, "frame_number": 13349, "display_filter": "frame.number == 13349", "timestamp_epoch": "1533964903.242983000" }, { "udp_stream": 279, "frame_number": 31673, "display_filter": "frame.number == 31673", "timestamp_epoch": "1533965100.796418000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-60cd80a4a8bf52b8d413a422", "type": "ipv4", "value": "151.101.66.49", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 63, "frame_number": 5155, "display_filter": "frame.number == 5155", "timestamp_epoch": "1533964556.031163000" }, { "udp_stream": 191, "frame_number": 18574, "display_filter": "frame.number == 18574", "timestamp_epoch": "1533964959.368247000" }, { "udp_stream": 287, "frame_number": 32144, "display_filter": "frame.number == 32144", "timestamp_epoch": "1533965101.694508000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-cee83611b8ba8112bcb9594f", "type": "ipv4", "value": "151.236.120.42", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 326, "frame_number": 40222, "display_filter": "frame.number == 40222", "timestamp_epoch": "1533965770.569135000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8a2bea20390fba77b5cdd505", "type": "ipv4", "value": "151.236.85.22", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 324, "frame_number": 40193, "display_filter": "frame.number == 40193", "timestamp_epoch": "1533965770.483961000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-014964de481a3052c7d6f8dd", "type": "ipv4", "value": "151.236.98.22", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 328, "frame_number": 40224, "display_filter": "frame.number == 40224", "timestamp_epoch": "1533965770.569362000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-85f2cf451cf75d70aecb7b6d", "type": "ipv4", "value": "152.163.13.4", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 79, "frame_number": 5893, "display_filter": "frame.number == 5893", "timestamp_epoch": "1533964559.525559000" }, { "udp_stream": 229, "frame_number": 23322, "display_filter": "frame.number == 23322", "timestamp_epoch": "1533964997.328492000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-52622f99b3a8cce37923e030", "type": "ipv4", "value": "152.195.14.112", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 247, "frame_number": 26644, "display_filter": "frame.number == 26644", "timestamp_epoch": "1533965033.203044000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-242824b6d9de3abd39c175ef", "type": "ipv4", "value": "156.154.136.36", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 180, "frame_number": 20228, "display_filter": "frame.number == 20228", "timestamp_epoch": "1533964965.012614000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-587813915083f68c98e1be61", "type": "ipv4", "value": "156.154.202.36", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 180, "frame_number": 20228, "display_filter": "frame.number == 20228", "timestamp_epoch": "1533964965.012614000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-971ef05dd2064ac6ead2c21f", "type": "ipv4", "value": "157.240.11.22", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:59.197115+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:59.194172+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 342, "frame_number": 43674, "display_filter": "frame.number == 43674", "timestamp_epoch": "1533965783.128458000" }, { "udp_stream": 348, "frame_number": 44214, "display_filter": "frame.number == 44214", "timestamp_epoch": "1533965784.461656000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:59.190613+00:00" }, { "observable_id": "observable-942f9234717f0ecae59f93fd", "type": "ipv4", "value": "161.170.239.188", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 208, "frame_number": 19705, "display_filter": "frame.number == 19705", "timestamp_epoch": "1533964962.898059000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-496dc6de5831a74cedcb1d7a", "type": "ipv4", "value": "162.210.196.115", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 113, "frame_number": 10616, "display_filter": "frame.number == 10616", "timestamp_epoch": "1533964900.621029000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-79d16283f77fcd5321a26b96", "type": "ipv4", "value": "162.210.196.116", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 113, "frame_number": 10616, "display_filter": "frame.number == 10616", "timestamp_epoch": "1533964900.621029000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b407691369d51e198c88d6af", "type": "ipv4", "value": "162.210.197.137", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 113, "frame_number": 10616, "display_filter": "frame.number == 10616", "timestamp_epoch": "1533964900.621029000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a126e0e9cef74f9438e1d7d2", "type": "ipv4", "value": "162.210.199.69", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 113, "frame_number": 10616, "display_filter": "frame.number == 10616", "timestamp_epoch": "1533964900.621029000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-52faf923055257c8d1a5ef2a", "type": "ipv4", "value": "172.217.0.42", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 30, "frame_number": 611, "display_filter": "frame.number == 611", "timestamp_epoch": "1533964545.651017000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-baa626635df45cb6c19234c8", "type": "ipv4", "value": "172.217.0.46", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 46, "frame_number": 3212, "display_filter": "frame.number == 3212", "timestamp_epoch": "1533964552.430269000" }, { "udp_stream": 350, "frame_number": 44229, "display_filter": "frame.number == 44229", "timestamp_epoch": "1533965784.476926000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-9b1bea06491420ec65a3c29d", "type": "ipv4", "value": "172.217.0.54", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 71, "frame_number": 5698, "display_filter": "frame.number == 5698", "timestamp_epoch": "1533964558.771373000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0c9773acbe67157c814a5a61", "type": "ipv4", "value": "172.217.6.66", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 66, "frame_number": 5140, "display_filter": "frame.number == 5140", "timestamp_epoch": "1533964556.025417000" }, { "udp_stream": 362, "frame_number": 46032, "display_filter": "frame.number == 46032", "timestamp_epoch": "1533965789.555893000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a604d37204943840ec698d49", "type": "ipv4", "value": "172.217.6.74", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 30, "frame_number": 611, "display_filter": "frame.number == 611", "timestamp_epoch": "1533964545.651017000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1857171736f65c1c8722f450", "type": "ipv4", "value": "172.217.6.78", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 46, "frame_number": 3212, "display_filter": "frame.number == 3212", "timestamp_epoch": "1533964552.430269000" }, { "udp_stream": 350, "frame_number": 44229, "display_filter": "frame.number == 44229", "timestamp_epoch": "1533965784.476926000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ebefae67f94a1451f2f50c30", "type": "ipv4", "value": "173.0.153.44", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 91, "frame_number": 8116, "display_filter": "frame.number == 8116", "timestamp_epoch": "1533964897.941119000" }, { "udp_stream": 103, "frame_number": 9470, "display_filter": "frame.number == 9470", "timestamp_epoch": "1533964899.377567000" }, { "udp_stream": 104, "frame_number": 9471, "display_filter": "frame.number == 9471", "timestamp_epoch": "1533964899.377655000" }, { "udp_stream": 131, "frame_number": 12208, "display_filter": "frame.number == 12208", "timestamp_epoch": "1533964901.980409000" }, { "udp_stream": 130, "frame_number": 12212, "display_filter": "frame.number == 12212", "timestamp_epoch": "1533964901.981250000" }, { "udp_stream": 134, "frame_number": 12763, "display_filter": "frame.number == 12763", "timestamp_epoch": "1533964902.706045000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-61531f0db337bbd6f0f4748e", "type": "ipv4", "value": "173.239.42.221", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 283, "frame_number": 31670, "display_filter": "frame.number == 31670", "timestamp_epoch": "1533965100.795818000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-de221b5755ad6372bc175c44", "type": "ipv4", "value": "173.241.250.104", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 76, "frame_number": 5871, "display_filter": "frame.number == 5871", "timestamp_epoch": "1533964559.485487000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-309c7b6ef4fe0172c4dde9de", "type": "ipv4", "value": "173.241.250.143", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 59, "frame_number": 4896, "display_filter": "frame.number == 4896", "timestamp_epoch": "1533964555.650800000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2af8523b085bffc65a309ca8", "type": "ipv4", "value": "173.241.250.220", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 31, "frame_number": 617, "display_filter": "frame.number == 617", "timestamp_epoch": "1533964545.677779000" }, { "udp_stream": 119, "frame_number": 11261, "display_filter": "frame.number == 11261", "timestamp_epoch": "1533964901.134370000" }, { "udp_stream": 139, "frame_number": 13383, "display_filter": "frame.number == 13383", "timestamp_epoch": "1533964903.261260000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-09d7554751955443d5f1d580", "type": "ipv4", "value": "176.9.67.12", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 29, "frame_number": 605, "display_filter": "frame.number == 605", "timestamp_epoch": "1533964545.630742000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5a6bd7f6567123003fd2dfef", "type": "ipv4", "value": "178.154.131.215", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 32, "frame_number": 608, "display_filter": "frame.number == 608", "timestamp_epoch": "1533964545.638096000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e0baf28c4095518f57acc5ce", "type": "ipv4", "value": "178.154.131.216", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 32, "frame_number": 608, "display_filter": "frame.number == 608", "timestamp_epoch": "1533964545.638096000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-869d9f7e5c4f56869b897672", "type": "ipv4", "value": "178.154.131.217", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 32, "frame_number": 608, "display_filter": "frame.number == 608", "timestamp_epoch": "1533964545.638096000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e81813376f707581d2e1db41", "type": "ipv4", "value": "18.185.181.189", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 261, "frame_number": 27339, "display_filter": "frame.number == 27339", "timestamp_epoch": "1533965035.445254000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2f75b8abe131ec90fb7e67c3", "type": "ipv4", "value": "18.197.74.2", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 261, "frame_number": 27339, "display_filter": "frame.number == 27339", "timestamp_epoch": "1533965035.445254000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-26062e57d8d0c6e57e1f24bc", "type": "ipv4", "value": "18.211.105.159", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 234, "frame_number": 23623, "display_filter": "frame.number == 23623", "timestamp_epoch": "1533964997.803829000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-02af47575d899b0416a5037c", "type": "ipv4", "value": "18.218.252.177", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 303, "frame_number": 35536, "display_filter": "frame.number == 35536", "timestamp_epoch": "1533965160.370088000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5ec7da20798587dc64468638", "type": "ipv4", "value": "18.218.6.11", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 293, "frame_number": 32841, "display_filter": "frame.number == 32841", "timestamp_epoch": "1533965136.087192000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-61c0c0ba8b7b063f387a3976", "type": "ipv4", "value": "18.218.60.224", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 303, "frame_number": 35536, "display_filter": "frame.number == 35536", "timestamp_epoch": "1533965160.370088000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-be003a2ce96b34cdc4e73070", "type": "ipv4", "value": "18.219.146.238", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 293, "frame_number": 32841, "display_filter": "frame.number == 32841", "timestamp_epoch": "1533965136.087192000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2d580dc1f20ed011010bd7f3", "type": "ipv4", "value": "18.220.35.131", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 293, "frame_number": 32841, "display_filter": "frame.number == 32841", "timestamp_epoch": "1533965136.087192000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b3e392d5837cea1a5b983381", "type": "ipv4", "value": "18.221.66.92", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 293, "frame_number": 32841, "display_filter": "frame.number == 32841", "timestamp_epoch": "1533965136.087192000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4943fba9e6b855e4a471b376", "type": "ipv4", "value": "184.26.122.58", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 172, "frame_number": 16445, "display_filter": "frame.number == 16445", "timestamp_epoch": "1533964909.104131000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6bdd303f46cee74de2527256", "type": "ipv4", "value": "185.167.164.37", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 97, "frame_number": 8972, "display_filter": "frame.number == 8972", "timestamp_epoch": "1533964898.937210000" }, { "udp_stream": 195, "frame_number": 18760, "display_filter": "frame.number == 18760", "timestamp_epoch": "1533964960.021343000" }, { "udp_stream": 255, "frame_number": 27166, "display_filter": "frame.number == 27166", "timestamp_epoch": "1533965034.849432000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-538026c3d03b50be81c3fa55", "type": "ipv4", "value": "185.167.164.39", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 97, "frame_number": 8972, "display_filter": "frame.number == 8972", "timestamp_epoch": "1533964898.937210000" }, { "udp_stream": 195, "frame_number": 18760, "display_filter": "frame.number == 18760", "timestamp_epoch": "1533964960.021343000" }, { "udp_stream": 255, "frame_number": 27166, "display_filter": "frame.number == 27166", "timestamp_epoch": "1533965034.849432000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-28ad3736011505ef20f4eca4", "type": "ipv4", "value": "185.167.166.40", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 198, "frame_number": 19168, "display_filter": "frame.number == 19168", "timestamp_epoch": "1533964960.869060000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2cfd40d240524ced25427598", "type": "ipv4", "value": "185.167.166.41", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 198, "frame_number": 19168, "display_filter": "frame.number == 19168", "timestamp_epoch": "1533964960.869060000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b2716b498a26bbd71310a7d9", "type": "ipv4", "value": "185.180.13.28", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 221, "frame_number": 21150, "display_filter": "frame.number == 21150", "timestamp_epoch": "1533964967.906377000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-9c099f0fd46ef6775f80364f", "type": "ipv4", "value": "185.28.71.53", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 33, "frame_number": 649, "display_filter": "frame.number == 649", "timestamp_epoch": "1533964545.745951000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e17f8b987c9ba869003a6d26", "type": "ipv4", "value": "185.68.93.18", "classification": "suspicious", "ioc_candidate": true, "reasons": [ { "kind": "behavior", "finding_id": "finding-8798192d6b4571d1d4d40028", "rule_id": "periodic-http-callbacks", "frame_number": 39557 }, { "kind": "behavior", "finding_id": "finding-8798192d6b4571d1d4d40028", "rule_id": "periodic-http-callbacks", "frame_number": 39676 }, { "kind": "behavior", "finding_id": "finding-8798192d6b4571d1d4d40028", "rule_id": "periodic-http-callbacks", "frame_number": 39681 }, { "kind": "behavior", "finding_id": "finding-8798192d6b4571d1d4d40028", "rule_id": "periodic-http-callbacks", "frame_number": 39699 }, { "kind": "behavior", "finding_id": "finding-8798192d6b4571d1d4d40028", "rule_id": "periodic-http-callbacks", "frame_number": 39712 }, { "kind": "behavior", "finding_id": "finding-8798192d6b4571d1d4d40028", "rule_id": "periodic-http-callbacks", "frame_number": 39725 }, { "kind": "behavior", "finding_id": "finding-8798192d6b4571d1d4d40028", "rule_id": "periodic-http-callbacks", "frame_number": 39741 }, { "kind": "behavior", "finding_id": "finding-8798192d6b4571d1d4d40028", "rule_id": "periodic-http-callbacks", "frame_number": 39754 }, { "kind": "behavior", "finding_id": "finding-8798192d6b4571d1d4d40028", "rule_id": "periodic-http-callbacks", "frame_number": 39767 }, { "kind": "behavior", "finding_id": "finding-8798192d6b4571d1d4d40028", "rule_id": "periodic-http-callbacks", "frame_number": 39781 }, { "kind": "behavior", "finding_id": "finding-8798192d6b4571d1d4d40028", "rule_id": "periodic-http-callbacks", "frame_number": 39796 }, { "kind": "behavior", "finding_id": "finding-8798192d6b4571d1d4d40028", "rule_id": "periodic-http-callbacks", "frame_number": 39809 }, { "kind": "behavior", "finding_id": "finding-8798192d6b4571d1d4d40028", "rule_id": "periodic-http-callbacks", "frame_number": 39879 }, { "kind": "behavior", "finding_id": "finding-8798192d6b4571d1d4d40028", "rule_id": "periodic-http-callbacks", "frame_number": 39895 }, { "kind": "behavior", "finding_id": "finding-8798192d6b4571d1d4d40028", "rule_id": "periodic-http-callbacks", "frame_number": 39951 }, { "kind": "behavior", "finding_id": "finding-8798192d6b4571d1d4d40028", "rule_id": "periodic-http-callbacks", "frame_number": 39970 }, { "kind": "behavior", "finding_id": "finding-8798192d6b4571d1d4d40028", "rule_id": "periodic-http-callbacks", "frame_number": 39983 }, { "kind": "behavior", "finding_id": "finding-8798192d6b4571d1d4d40028", "rule_id": "periodic-http-callbacks", "frame_number": 39996 }, { "kind": "behavior", "finding_id": "finding-8798192d6b4571d1d4d40028", "rule_id": "periodic-http-callbacks", "frame_number": 40009 }, { "kind": "behavior", "finding_id": "finding-8798192d6b4571d1d4d40028", "rule_id": "periodic-http-callbacks", "frame_number": 40022 } ], "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:52.654243+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:52.460656+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:52.458085+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Candidate requires analyst validation", "evidence": [ { "tcp_stream": 1036, "frame_number": 39557, "display_filter": "frame.number == 39557", "timestamp_epoch": "1533965406.977212000" }, { "tcp_stream": 1046, "frame_number": 39676, "display_filter": "frame.number == 39676", "timestamp_epoch": "1533965418.580357000" }, { "tcp_stream": 1046, "frame_number": 39681, "display_filter": "frame.number == 39681", "timestamp_epoch": "1533965419.412338000" }, { "tcp_stream": 1047, "frame_number": 39699, "display_filter": "frame.number == 39699", "timestamp_epoch": "1533965435.576793000" }, { "tcp_stream": 1048, "frame_number": 39712, "display_filter": "frame.number == 39712", "timestamp_epoch": "1533965451.757604000" }, { "tcp_stream": 1049, "frame_number": 39725, "display_filter": "frame.number == 39725", "timestamp_epoch": "1533965467.936416000" }, { "tcp_stream": 1050, "frame_number": 39741, "display_filter": "frame.number == 39741", "timestamp_epoch": "1533965484.293094000" }, { "tcp_stream": 1051, "frame_number": 39754, "display_filter": "frame.number == 39754", "timestamp_epoch": "1533965500.471438000" }, { "tcp_stream": 1052, "frame_number": 39767, "display_filter": "frame.number == 39767", "timestamp_epoch": "1533965516.649335000" }, { "tcp_stream": 1053, "frame_number": 39781, "display_filter": "frame.number == 39781", "timestamp_epoch": "1533965532.902740000" }, { "tcp_stream": 1054, "frame_number": 39796, "display_filter": "frame.number == 39796", "timestamp_epoch": "1533965549.287287000" }, { "tcp_stream": 1055, "frame_number": 39809, "display_filter": "frame.number == 39809", "timestamp_epoch": "1533965565.437819000" }, { "tcp_stream": 1057, "frame_number": 39879, "display_filter": "frame.number == 39879", "timestamp_epoch": "1533965581.646796000" }, { "tcp_stream": 1058, "frame_number": 39895, "display_filter": "frame.number == 39895", "timestamp_epoch": "1533965597.772796000" }, { "tcp_stream": 1060, "frame_number": 39951, "display_filter": "frame.number == 39951", "timestamp_epoch": "1533965613.953658000" }, { "tcp_stream": 1061, "frame_number": 39970, "display_filter": "frame.number == 39970", "timestamp_epoch": "1533965630.124714000" }, { "tcp_stream": 1062, "frame_number": 39983, "display_filter": "frame.number == 39983", "timestamp_epoch": "1533965646.289888000" }, { "tcp_stream": 1063, "frame_number": 39996, "display_filter": "frame.number == 39996", "timestamp_epoch": "1533965662.463461000" }, { "tcp_stream": 1064, "frame_number": 40009, "display_filter": "frame.number == 40009", "timestamp_epoch": "1533965678.767587000" }, { "tcp_stream": 1065, "frame_number": 40022, "display_filter": "frame.number == 40022", "timestamp_epoch": "1533965694.815438000" } ], "roles": [ "http-host", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:52.454803+00:00" }, { "observable_id": "observable-647e18feead336ed22e360d3", "type": "ipv4", "value": "185.86.137.17", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 265, "frame_number": 27532, "display_filter": "frame.number == 27532", "timestamp_epoch": "1533965035.693277000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e85d6d3775b6542a5d22aeea", "type": "ipv4", "value": "185.86.137.32", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 265, "frame_number": 27532, "display_filter": "frame.number == 27532", "timestamp_epoch": "1533965035.693277000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5e52ac605b62c00915d50437", "type": "ipv4", "value": "185.86.137.42", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 265, "frame_number": 27532, "display_filter": "frame.number == 27532", "timestamp_epoch": "1533965035.693277000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3a12d2b7eda868b74f7c1dd2", "type": "ipv4", "value": "185.86.137.43", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 265, "frame_number": 27532, "display_filter": "frame.number == 27532", "timestamp_epoch": "1533965035.693277000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3067df8b6a654db0c431c2a5", "type": "ipv4", "value": "185.99.9.116", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 365, "frame_number": 46422, "display_filter": "frame.number == 46422", "timestamp_epoch": "1533965791.276701000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6ebcff8c6bdf1799c1a5cf00", "type": "ipv4", "value": "185.99.9.117", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 365, "frame_number": 46422, "display_filter": "frame.number == 46422", "timestamp_epoch": "1533965791.276701000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4b0b9eb748eb9422c012dfe9", "type": "ipv4", "value": "185.99.9.123", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 365, "frame_number": 46422, "display_filter": "frame.number == 46422", "timestamp_epoch": "1533965791.276701000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b0e10e0119a02a4066729c01", "type": "ipv4", "value": "185.99.9.124", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 365, "frame_number": 46422, "display_filter": "frame.number == 46422", "timestamp_epoch": "1533965791.276701000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-eb6562d3d5b26867a0de5dc8", "type": "ipv4", "value": "188.40.114.5", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 358, "frame_number": 45340, "display_filter": "frame.number == 45340", "timestamp_epoch": "1533965787.454378000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-968a0e4f9d96e4b2551628bd", "type": "ipv4", "value": "188.40.114.52", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 358, "frame_number": 45340, "display_filter": "frame.number == 45340", "timestamp_epoch": "1533965787.454378000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6c6aef21ba85127603a8a536", "type": "ipv4", "value": "188.40.115.111", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 358, "frame_number": 45340, "display_filter": "frame.number == 45340", "timestamp_epoch": "1533965787.454378000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-97c6afb874030c57e5d6e120", "type": "ipv4", "value": "188.40.115.112", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 358, "frame_number": 45340, "display_filter": "frame.number == 45340", "timestamp_epoch": "1533965787.454378000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-08855ed6f27d08e66abe2d1c", "type": "ipv4", "value": "188.40.118.169", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 358, "frame_number": 45340, "display_filter": "frame.number == 45340", "timestamp_epoch": "1533965787.454378000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b38169eb51bdf4832e6938b5", "type": "ipv4", "value": "192.168.1.1", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-91a90452fbd67a51f51e0bcf", "type": "ipv4", "value": "192.168.1.254", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8169a9e435ec231f96c45001", "type": "ipv4", "value": "192.168.1.255", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-746dd24e5d6b1986fc5f7963", "type": "ipv4", "value": "192.168.1.6", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 5, "frame_number": 14, "display_filter": "frame.number == 14", "timestamp_epoch": "1533964509.083115000" }, { "udp_stream": 6, "frame_number": 16, "display_filter": "frame.number == 16", "timestamp_epoch": "1533964509.084490000" }, { "udp_stream": 10, "frame_number": 25, "display_filter": "frame.number == 25", "timestamp_epoch": "1533964509.191910000" }, { "udp_stream": 21, "frame_number": 335, "display_filter": "frame.number == 335", "timestamp_epoch": "1533964517.019178000" }, { "udp_stream": 22, "frame_number": 375, "display_filter": "frame.number == 375", "timestamp_epoch": "1533964517.089954000" }, { "udp_stream": 309, "frame_number": 39583, "display_filter": "frame.number == 39583", "timestamp_epoch": "1533965407.390593000" }, { "udp_stream": 311, "frame_number": 39595, "display_filter": "frame.number == 39595", "timestamp_epoch": "1533965407.491736000" }, { "udp_stream": 314, "frame_number": 39654, "display_filter": "frame.number == 39654", "timestamp_epoch": "1533965410.183053000" }, { "udp_stream": 316, "frame_number": 39658, "display_filter": "frame.number == 39658", "timestamp_epoch": "1533965410.185581000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1acef6b065f530508c789024", "type": "ipv4", "value": "192.168.1.95", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 23, "frame_number": 376, "display_filter": "frame.number == 376", "timestamp_epoch": "1533964517.090941000" }, { "udp_stream": 23, "frame_number": 377, "display_filter": "frame.number == 377", "timestamp_epoch": "1533964517.092165000" }, { "udp_stream": 315, "frame_number": 39655, "display_filter": "frame.number == 39655", "timestamp_epoch": "1533965410.183603000" }, { "udp_stream": 315, "frame_number": 39656, "display_filter": "frame.number == 39656", "timestamp_epoch": "1533965410.184627000" }, { "udp_stream": 317, "frame_number": 39659, "display_filter": "frame.number == 39659", "timestamp_epoch": "1533965410.186117000" }, { "udp_stream": 317, "frame_number": 39660, "display_filter": "frame.number == 39660", "timestamp_epoch": "1533965410.186527000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-581e22079d56132df78b21d5", "type": "ipv4", "value": "192.184.65.2", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 142, "frame_number": 13537, "display_filter": "frame.number == 13537", "timestamp_epoch": "1533964903.535108000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a38e574705304847cef00a57", "type": "ipv4", "value": "192.184.65.3", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 142, "frame_number": 13537, "display_filter": "frame.number == 13537", "timestamp_epoch": "1533964903.535108000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-004267b410c919bfe039d490", "type": "ipv4", "value": "192.184.65.4", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 142, "frame_number": 13537, "display_filter": "frame.number == 13537", "timestamp_epoch": "1533964903.535108000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d10eacd8bb3ce9540afbe0c4", "type": "ipv4", "value": "192.184.65.5", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 142, "frame_number": 13537, "display_filter": "frame.number == 13537", "timestamp_epoch": "1533964903.535108000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-479266ab680239d5d28915ca", "type": "ipv4", "value": "192.229.163.25", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 343, "frame_number": 43671, "display_filter": "frame.number == 43671", "timestamp_epoch": "1533965783.112888000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-67640acc70c6d9b8cc78c390", "type": "ipv4", "value": "192.229.210.158", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 214, "frame_number": 20116, "display_filter": "frame.number == 20116", "timestamp_epoch": "1533964964.705871000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3ba29e3f71badf83d4c8d746", "type": "ipv4", "value": "192.35.177.64", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 95, "frame_number": 8582, "display_filter": "frame.number == 8582", "timestamp_epoch": "1533964898.485160000" }, { "udp_stream": 94, "frame_number": 8583, "display_filter": "frame.number == 8583", "timestamp_epoch": "1533964898.485161000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a21ff2d99d79cc9f4bf81fe6", "type": "ipv4", "value": "194.226.130.226", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 50, "frame_number": 3303, "display_filter": "frame.number == 3303", "timestamp_epoch": "1533964552.639522000" }, { "udp_stream": 341, "frame_number": 43643, "display_filter": "frame.number == 43643", "timestamp_epoch": "1533965783.028284000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b22b45a2962a992f9df73f3b", "type": "ipv4", "value": "194.226.130.227", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 50, "frame_number": 3303, "display_filter": "frame.number == 3303", "timestamp_epoch": "1533964552.639522000" }, { "udp_stream": 341, "frame_number": 43643, "display_filter": "frame.number == 43643", "timestamp_epoch": "1533965783.028284000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8af1714d721911bf1ba38e75", "type": "ipv4", "value": "194.226.130.228", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 50, "frame_number": 3303, "display_filter": "frame.number == 3303", "timestamp_epoch": "1533964552.639522000" }, { "udp_stream": 341, "frame_number": 43643, "display_filter": "frame.number == 43643", "timestamp_epoch": "1533965783.028284000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-29cf7a6571d5ab232edfb7ea", "type": "ipv4", "value": "194.226.130.229", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 50, "frame_number": 3303, "display_filter": "frame.number == 3303", "timestamp_epoch": "1533964552.639522000" }, { "udp_stream": 341, "frame_number": 43643, "display_filter": "frame.number == 43643", "timestamp_epoch": "1533965783.028284000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ddc5f546a551755ec81f2e04", "type": "ipv4", "value": "195.244.31.10", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 146, "frame_number": 13566, "display_filter": "frame.number == 13566", "timestamp_epoch": "1533964903.560435000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-edf5382b8e7c90dc0f36528f", "type": "ipv4", "value": "195.244.31.11", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 146, "frame_number": 13566, "display_filter": "frame.number == 13566", "timestamp_epoch": "1533964903.560435000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-034af9e98486ff2b973ebcce", "type": "ipv4", "value": "198.23.90.56", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 75, "frame_number": 5872, "display_filter": "frame.number == 5872", "timestamp_epoch": "1533964559.485716000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4381840b7c5030bd80c0bd6b", "type": "ipv4", "value": "198.23.90.60", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 75, "frame_number": 5872, "display_filter": "frame.number == 5872", "timestamp_epoch": "1533964559.485716000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5330dbb153efa9c6a170557a", "type": "ipv4", "value": "198.23.90.62", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 75, "frame_number": 5872, "display_filter": "frame.number == 5872", "timestamp_epoch": "1533964559.485716000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-77efb9df3b8a635946b23000", "type": "ipv4", "value": "198.54.12.127", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 209, "frame_number": 19708, "display_filter": "frame.number == 19708", "timestamp_epoch": "1533964962.901909000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c95601b6a07791e2e35b2165", "type": "ipv4", "value": "198.54.12.145", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 209, "frame_number": 19708, "display_filter": "frame.number == 19708", "timestamp_epoch": "1533964962.901909000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-bd482a1921dc3371e9748be3", "type": "ipv4", "value": "198.7.56.229", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 113, "frame_number": 10616, "display_filter": "frame.number == 10616", "timestamp_epoch": "1533964900.621029000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a39279106f37ad2aa60eb510", "type": "ipv4", "value": "198.70.71.144", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 56, "frame_number": 4256, "display_filter": "frame.number == 4256", "timestamp_epoch": "1533964554.071566000" }, { "udp_stream": 55, "frame_number": 4257, "display_filter": "frame.number == 4257", "timestamp_epoch": "1533964554.071727000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-9e641980a234dc9f4d634834", "type": "ipv4", "value": "198.70.71.147", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 24, "frame_number": 381, "display_filter": "frame.number == 381", "timestamp_epoch": "1533964519.500541000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-40cb45cab86c23e6059b6823", "type": "ipv4", "value": "198.70.71.161", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 24, "frame_number": 381, "display_filter": "frame.number == 381", "timestamp_epoch": "1533964519.500541000" }, { "udp_stream": 56, "frame_number": 4256, "display_filter": "frame.number == 4256", "timestamp_epoch": "1533964554.071566000" }, { "udp_stream": 55, "frame_number": 4257, "display_filter": "frame.number == 4257", "timestamp_epoch": "1533964554.071727000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-74187595b41aea54aa066a74", "type": "ipv4", "value": "199.38.167.128", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 78, "frame_number": 6313, "display_filter": "frame.number == 6313", "timestamp_epoch": "1533964560.553014000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1c7f0a807909521e8b4a1789", "type": "ipv4", "value": "199.59.149.201", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 352, "frame_number": 44343, "display_filter": "frame.number == 44343", "timestamp_epoch": "1533965785.001653000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-289ab7b7876b92eacc7425f2", "type": "ipv4", "value": "199.59.149.233", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 352, "frame_number": 44343, "display_filter": "frame.number == 44343", "timestamp_epoch": "1533965785.001653000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-216d0f0b3362b9b540866e1e", "type": "ipv4", "value": "204.11.109.65", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 193, "frame_number": 18627, "display_filter": "frame.number == 18627", "timestamp_epoch": "1533964959.502881000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ee490f4b63b155c277fa126c", "type": "ipv4", "value": "204.11.109.66", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 193, "frame_number": 18627, "display_filter": "frame.number == 18627", "timestamp_epoch": "1533964959.502881000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a02fa51e97ef753c9e8db1e7", "type": "ipv4", "value": "204.11.109.67", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 193, "frame_number": 18627, "display_filter": "frame.number == 18627", "timestamp_epoch": "1533964959.502881000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6dfeabd0e470fe4d17715343", "type": "ipv4", "value": "204.11.109.68", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 193, "frame_number": 18627, "display_filter": "frame.number == 18627", "timestamp_epoch": "1533964959.502881000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-27efd57c37e8e3e5cf52cdb6", "type": "ipv4", "value": "204.2.197.201", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 192, "frame_number": 18626, "display_filter": "frame.number == 18626", "timestamp_epoch": "1533964959.502753000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-57ec0a4947bec6d1b7f41c52", "type": "ipv4", "value": "204.2.250.100", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 137, "frame_number": 13018, "display_filter": "frame.number == 13018", "timestamp_epoch": "1533964902.980837000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-82c356f87ebaf2a0d46a6bd0", "type": "ipv4", "value": "204.236.186.16", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 262, "frame_number": 27340, "display_filter": "frame.number == 27340", "timestamp_epoch": "1533965035.445360000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0ed22b80d10e2ad7ec0de9e4", "type": "ipv4", "value": "204.79.197.200", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 38, "frame_number": 2263, "display_filter": "frame.number == 2263", "timestamp_epoch": "1533964549.230108000" }, { "udp_stream": 39, "frame_number": 2265, "display_filter": "frame.number == 2265", "timestamp_epoch": "1533964549.230112000" }, { "udp_stream": 40, "frame_number": 2266, "display_filter": "frame.number == 2266", "timestamp_epoch": "1533964549.230247000" }, { "udp_stream": 37, "frame_number": 2268, "display_filter": "frame.number == 2268", "timestamp_epoch": "1533964549.230297000" }, { "udp_stream": 206, "frame_number": 19673, "display_filter": "frame.number == 19673", "timestamp_epoch": "1533964962.856769000" }, { "udp_stream": 333, "frame_number": 43410, "display_filter": "frame.number == 43410", "timestamp_epoch": "1533965778.972314000" }, { "udp_stream": 334, "frame_number": 43411, "display_filter": "frame.number == 43411", "timestamp_epoch": "1533965778.972428000" }, { "udp_stream": 335, "frame_number": 43412, "display_filter": "frame.number == 43412", "timestamp_epoch": "1533965778.972581000" }, { "udp_stream": 333, "frame_number": 43413, "display_filter": "frame.number == 43413", "timestamp_epoch": "1533965778.972688000" }, { "udp_stream": 334, "frame_number": 43415, "display_filter": "frame.number == 43415", "timestamp_epoch": "1533965778.972803000" }, { "udp_stream": 335, "frame_number": 43417, "display_filter": "frame.number == 43417", "timestamp_epoch": "1533965778.972805000" }, { "udp_stream": 334, "frame_number": 43418, "display_filter": "frame.number == 43418", "timestamp_epoch": "1533965778.972933000" }, { "udp_stream": 333, "frame_number": 43419, "display_filter": "frame.number == 43419", "timestamp_epoch": "1533965778.972999000" }, { "udp_stream": 335, "frame_number": 43420, "display_filter": "frame.number == 43420", "timestamp_epoch": "1533965778.973091000" }, { "udp_stream": 332, "frame_number": 43421, "display_filter": "frame.number == 43421", "timestamp_epoch": "1533965778.973203000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d309e04a9772ccd90d3ec099", "type": "ipv4", "value": "204.79.197.229", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 335, "frame_number": 42737, "display_filter": "frame.number == 42737", "timestamp_epoch": "1533965777.047036000" }, { "udp_stream": 334, "frame_number": 42738, "display_filter": "frame.number == 42738", "timestamp_epoch": "1533965777.047173000" }, { "udp_stream": 332, "frame_number": 42739, "display_filter": "frame.number == 42739", "timestamp_epoch": "1533965777.047205000" }, { "udp_stream": 333, "frame_number": 42741, "display_filter": "frame.number == 42741", "timestamp_epoch": "1533965777.047368000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-afed5841129f5f2873ec4b22", "type": "ipv4", "value": "205.180.87.137", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 168, "frame_number": 16039, "display_filter": "frame.number == 16039", "timestamp_epoch": "1533964908.424347000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-083cf6e09d3074b369ffbb44", "type": "ipv4", "value": "205.180.87.204", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 249, "frame_number": 26802, "display_filter": "frame.number == 26802", "timestamp_epoch": "1533965033.625618000" }, { "udp_stream": 267, "frame_number": 27573, "display_filter": "frame.number == 27573", "timestamp_epoch": "1533965035.747066000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3cd0ad3c560ed16ab07ff408", "type": "ipv4", "value": "205.185.216.10", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 90, "frame_number": 7515, "display_filter": "frame.number == 7515", "timestamp_epoch": "1533964897.312123000" }, { "udp_stream": 160, "frame_number": 15186, "display_filter": "frame.number == 15186", "timestamp_epoch": "1533964906.152257000" }, { "udp_stream": 308, "frame_number": 39482, "display_filter": "frame.number == 39482", "timestamp_epoch": "1533965401.063902000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-621426fac0f69dbad84af286", "type": "ipv4", "value": "205.185.216.42", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 90, "frame_number": 7515, "display_filter": "frame.number == 7515", "timestamp_epoch": "1533964897.312123000" }, { "udp_stream": 160, "frame_number": 15186, "display_filter": "frame.number == 15186", "timestamp_epoch": "1533964906.152257000" }, { "udp_stream": 308, "frame_number": 39482, "display_filter": "frame.number == 39482", "timestamp_epoch": "1533965401.063902000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c6f91e92ba642fd60e7fe1bf", "type": "ipv4", "value": "207.244.102.143", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 187, "frame_number": 18189, "display_filter": "frame.number == 18189", "timestamp_epoch": "1533964958.450799000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4cb4b7e307a6f4af72d382a8", "type": "ipv4", "value": "207.244.108.217", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 113, "frame_number": 10616, "display_filter": "frame.number == 10616", "timestamp_epoch": "1533964900.621029000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ad28a76e6bafc7270487bea4", "type": "ipv4", "value": "207.244.110.3", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 113, "frame_number": 10616, "display_filter": "frame.number == 10616", "timestamp_epoch": "1533964900.621029000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-84a33fddc38359ce695d606f", "type": "ipv4", "value": "207.244.121.25", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 113, "frame_number": 10616, "display_filter": "frame.number == 10616", "timestamp_epoch": "1533964900.621029000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a177265ead569a870b878750", "type": "ipv4", "value": "207.244.121.27", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 113, "frame_number": 10616, "display_filter": "frame.number == 10616", "timestamp_epoch": "1533964900.621029000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-55342d117704343a6daae087", "type": "ipv4", "value": "207.244.66.112", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 113, "frame_number": 10616, "display_filter": "frame.number == 10616", "timestamp_epoch": "1533964900.621029000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3e41d8da4cf6629d62290f7a", "type": "ipv4", "value": "207.244.67.98", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 113, "frame_number": 10616, "display_filter": "frame.number == 10616", "timestamp_epoch": "1533964900.621029000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-9f802443151fb648c9ed1d6b", "type": "ipv4", "value": "207.244.67.99", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 113, "frame_number": 10616, "display_filter": "frame.number == 10616", "timestamp_epoch": "1533964900.621029000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f259ab3dea97ce65ac78d185", "type": "ipv4", "value": "207.244.76.83", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 113, "frame_number": 10616, "display_filter": "frame.number == 10616", "timestamp_epoch": "1533964900.621029000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-07d8a8d7e44d2c4c2e0a6bac", "type": "ipv4", "value": "207.244.80.166", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 28, "frame_number": 542, "display_filter": "frame.number == 542", "timestamp_epoch": "1533964544.690929000" }, { "udp_stream": 27, "frame_number": 543, "display_filter": "frame.number == 543", "timestamp_epoch": "1533964544.690931000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a2db4073fa680f434b13ba3a", "type": "ipv4", "value": "207.244.94.20", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 113, "frame_number": 10616, "display_filter": "frame.number == 10616", "timestamp_epoch": "1533964900.621029000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-80954f0d15033a317ff35eca", "type": "ipv4", "value": "208.185.50.80", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 196, "frame_number": 18786, "display_filter": "frame.number == 18786", "timestamp_epoch": "1533964960.049215000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-72e1f81e0d4f43f6b0804909", "type": "ipv4", "value": "208.185.50.90", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 196, "frame_number": 18786, "display_filter": "frame.number == 18786", "timestamp_epoch": "1533964960.049215000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f8822fefb70101aa37834e9c", "type": "ipv4", "value": "209.191.163.208", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 284, "frame_number": 31672, "display_filter": "frame.number == 31672", "timestamp_epoch": "1533965100.795928000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f4933a964c80490792f7e548", "type": "ipv4", "value": "209.191.163.209", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 284, "frame_number": 31672, "display_filter": "frame.number == 31672", "timestamp_epoch": "1533965100.795928000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f8fc766a9732ce162fcff7a8", "type": "ipv4", "value": "209.191.163.213", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 284, "frame_number": 31672, "display_filter": "frame.number == 31672", "timestamp_epoch": "1533965100.795928000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6855e375ae701b20b0627af4", "type": "ipv4", "value": "209.58.136.29", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 223, "frame_number": 23086, "display_filter": "frame.number == 23086", "timestamp_epoch": "1533964996.618558000" }, { "udp_stream": 361, "frame_number": 46077, "display_filter": "frame.number == 46077", "timestamp_epoch": "1533965789.700898000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1e65ebe2cbcf6a090e74dbbf", "type": "ipv4", "value": "209.58.136.30", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 223, "frame_number": 23086, "display_filter": "frame.number == 23086", "timestamp_epoch": "1533964996.618558000" }, { "udp_stream": 361, "frame_number": 46077, "display_filter": "frame.number == 46077", "timestamp_epoch": "1533965789.700898000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b12cece31f6959996ad07939", "type": "ipv4", "value": "209.58.136.32", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 223, "frame_number": 23086, "display_filter": "frame.number == 23086", "timestamp_epoch": "1533964996.618558000" }, { "udp_stream": 361, "frame_number": 46077, "display_filter": "frame.number == 46077", "timestamp_epoch": "1533965789.700898000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1472887ee65bdf6fa6d18e70", "type": "ipv4", "value": "209.58.139.154", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 223, "frame_number": 23086, "display_filter": "frame.number == 23086", "timestamp_epoch": "1533964996.618558000" }, { "udp_stream": 361, "frame_number": 46077, "display_filter": "frame.number == 46077", "timestamp_epoch": "1533965789.700898000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d4f0d7eed12fb5675adbbdf4", "type": "ipv4", "value": "213.155.156.164", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 243, "frame_number": 35522, "display_filter": "frame.number == 35522", "timestamp_epoch": "1533965160.354549000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5a246e5429cb187a8c2814cb", "type": "ipv4", "value": "213.155.156.165", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 243, "frame_number": 35522, "display_filter": "frame.number == 35522", "timestamp_epoch": "1533965160.354549000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b52b4e755f0ad657a99c795a", "type": "ipv4", "value": "213.155.156.166", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 243, "frame_number": 35522, "display_filter": "frame.number == 35522", "timestamp_epoch": "1533965160.354549000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f3a3f8adc155b9682060f440", "type": "ipv4", "value": "213.155.156.167", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 243, "frame_number": 35522, "display_filter": "frame.number == 35522", "timestamp_epoch": "1533965160.354549000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c72c0c25307f94e3298d6829", "type": "ipv4", "value": "213.155.156.168", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 243, "frame_number": 35522, "display_filter": "frame.number == 35522", "timestamp_epoch": "1533965160.354549000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-24d4f0eb2b96a1384b0fe256", "type": "ipv4", "value": "213.155.156.169", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 243, "frame_number": 35522, "display_filter": "frame.number == 35522", "timestamp_epoch": "1533965160.354549000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-88356829632a7394259c2500", "type": "ipv4", "value": "213.155.156.180", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 243, "frame_number": 35522, "display_filter": "frame.number == 35522", "timestamp_epoch": "1533965160.354549000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6c3078c98dbef908d21a7a5a", "type": "ipv4", "value": "213.155.156.181", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 243, "frame_number": 35522, "display_filter": "frame.number == 35522", "timestamp_epoch": "1533965160.354549000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1e90897e0aca293168046ab8", "type": "ipv4", "value": "213.155.156.182", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 243, "frame_number": 35522, "display_filter": "frame.number == 35522", "timestamp_epoch": "1533965160.354549000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3c1726dfcaedf67fe59ab8d1", "type": "ipv4", "value": "213.155.156.183", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 243, "frame_number": 35522, "display_filter": "frame.number == 35522", "timestamp_epoch": "1533965160.354549000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1dda96c2bf79a94b11f14c0c", "type": "ipv4", "value": "213.155.156.184", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 243, "frame_number": 35522, "display_filter": "frame.number == 35522", "timestamp_epoch": "1533965160.354549000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b59c4d96b90ce639411ee930", "type": "ipv4", "value": "213.155.156.185", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 243, "frame_number": 35522, "display_filter": "frame.number == 35522", "timestamp_epoch": "1533965160.354549000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3b92bfb65a50601af91e4b62", "type": "ipv4", "value": "213.180.193.38", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 88, "frame_number": 7089, "display_filter": "frame.number == 7089", "timestamp_epoch": "1533964677.421170000" }, { "udp_stream": 319, "frame_number": 39904, "display_filter": "frame.number == 39904", "timestamp_epoch": "1533965605.965885000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d280dbeea7eadd96c459f3aa", "type": "ipv4", "value": "213.180.193.90", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 44, "frame_number": 3197, "display_filter": "frame.number == 3197", "timestamp_epoch": "1533964552.405569000" }, { "udp_stream": 337, "frame_number": 43651, "display_filter": "frame.number == 43651", "timestamp_epoch": "1533965783.060399000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-16530eaebf9e9a0a80a4a54d", "type": "ipv4", "value": "213.180.204.37", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 87, "frame_number": 6567, "display_filter": "frame.number == 6567", "timestamp_epoch": "1533964577.203660000" }, { "udp_stream": 318, "frame_number": 39814, "display_filter": "frame.number == 39814", "timestamp_epoch": "1533965567.514714000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3ba20341aeea758c3138a0e6", "type": "ipv4", "value": "213.180.204.38", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 88, "frame_number": 7089, "display_filter": "frame.number == 7089", "timestamp_epoch": "1533964677.421170000" }, { "udp_stream": 319, "frame_number": 39904, "display_filter": "frame.number == 39904", "timestamp_epoch": "1533965605.965885000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-fa7babca841453878b2221dc", "type": "ipv4", "value": "213.180.204.90", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 44, "frame_number": 3197, "display_filter": "frame.number == 3197", "timestamp_epoch": "1533964552.405569000" }, { "udp_stream": 337, "frame_number": 43651, "display_filter": "frame.number == 43651", "timestamp_epoch": "1533965783.060399000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-89efe3582775e8524cd7302f", "type": "ipv4", "value": "216.115.100.123", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 194, "frame_number": 18742, "display_filter": "frame.number == 18742", "timestamp_epoch": "1533964959.980701000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1a14340b8b4ca1739e37d220", "type": "ipv4", "value": "216.115.100.124", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 194, "frame_number": 18742, "display_filter": "frame.number == 18742", "timestamp_epoch": "1533964959.980701000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-413ced18688a4b04daf33a10", "type": "ipv4", "value": "216.200.232.221", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 61, "frame_number": 5120, "display_filter": "frame.number == 5120", "timestamp_epoch": "1533964555.984165000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-92e6378e8c1f5f7286af7290", "type": "ipv4", "value": "216.200.232.234", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 61, "frame_number": 5120, "display_filter": "frame.number == 5120", "timestamp_epoch": "1533964555.984165000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-9e77721891f795d5e5b32114", "type": "ipv4", "value": "216.200.232.235", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 61, "frame_number": 5120, "display_filter": "frame.number == 5120", "timestamp_epoch": "1533964555.984165000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-588b5b87a59e2859fe2d7039", "type": "ipv4", "value": "216.52.31.73", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 276, "frame_number": 30803, "display_filter": "frame.number == 30803", "timestamp_epoch": "1533965099.278838000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-087eaafca5f018163e9d5267", "type": "ipv4", "value": "216.58.192.1", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 60, "frame_number": 4936, "display_filter": "frame.number == 4936", "timestamp_epoch": "1533964555.714019000" }, { "udp_stream": 347, "frame_number": 44193, "display_filter": "frame.number == 44193", "timestamp_epoch": "1533965784.401633000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a5026c990fc57d42b9dadd45", "type": "ipv4", "value": "216.58.192.10", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 41, "frame_number": 2425, "display_filter": "frame.number == 2425", "timestamp_epoch": "1533964549.757857000" }, { "udp_stream": 140, "frame_number": 13400, "display_filter": "frame.number == 13400", "timestamp_epoch": "1533964903.310256000" }, { "udp_stream": 354, "frame_number": 44732, "display_filter": "frame.number == 44732", "timestamp_epoch": "1533965786.093172000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4fdf79b5f41033dc08c0b6e1", "type": "ipv4", "value": "216.58.192.14", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 48, "frame_number": 3327, "display_filter": "frame.number == 3327", "timestamp_epoch": "1533964552.700183000" }, { "udp_stream": 350, "frame_number": 44229, "display_filter": "frame.number == 44229", "timestamp_epoch": "1533965784.476926000" }, { "udp_stream": 351, "frame_number": 44230, "display_filter": "frame.number == 44230", "timestamp_epoch": "1533965784.477104000" }, { "udp_stream": 356, "frame_number": 45110, "display_filter": "frame.number == 45110", "timestamp_epoch": "1533965786.890742000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3ba9ffa3db30fc9ec2ec2df4", "type": "ipv4", "value": "216.58.192.2", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 54, "frame_number": 3927, "display_filter": "frame.number == 3927", "timestamp_epoch": "1533964553.575840000" }, { "udp_stream": 126, "frame_number": 11931, "display_filter": "frame.number == 11931", "timestamp_epoch": "1533964901.698739000" }, { "udp_stream": 177, "frame_number": 16951, "display_filter": "frame.number == 16951", "timestamp_epoch": "1533964912.917076000" }, { "udp_stream": 183, "frame_number": 18111, "display_filter": "frame.number == 18111", "timestamp_epoch": "1533964958.070258000" }, { "udp_stream": 346, "frame_number": 44008, "display_filter": "frame.number == 44008", "timestamp_epoch": "1533965783.935554000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-501e31511bf9be9c26cdd3d4", "type": "ipv4", "value": "216.58.192.3", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 45, "frame_number": 3196, "display_filter": "frame.number == 3196", "timestamp_epoch": "1533964552.405445000" }, { "udp_stream": 357, "frame_number": 45116, "display_filter": "frame.number == 45116", "timestamp_epoch": "1533965786.910754000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-79f8f8d2bbd841b4c7808256", "type": "ipv4", "value": "216.58.192.4", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 58, "frame_number": 4750, "display_filter": "frame.number == 4750", "timestamp_epoch": "1533964555.307152000" }, { "udp_stream": 360, "frame_number": 45837, "display_filter": "frame.number == 45837", "timestamp_epoch": "1533965789.095261000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-834a319cb7d70fb18ca4b3d7", "type": "ipv4", "value": "216.58.192.6", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 70, "frame_number": 5456, "display_filter": "frame.number == 5456", "timestamp_epoch": "1533964556.909758000" }, { "udp_stream": 116, "frame_number": 10721, "display_filter": "frame.number == 10721", "timestamp_epoch": "1533964900.718497000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-69192f7a4c1563cb96fb0b80", "type": "ipv4", "value": "216.58.192.8", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:59.390971+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:59.386066+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 339, "frame_number": 43662, "display_filter": "frame.number == 43662", "timestamp_epoch": "1533965783.090968000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:59.380554+00:00" }, { "observable_id": "observable-f9320887d1145c2a8668ef2c", "type": "ipv4", "value": "216.58.194.162", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 43, "frame_number": 3185, "display_filter": "frame.number == 3185", "timestamp_epoch": "1533964552.354010000" }, { "udp_stream": 53, "frame_number": 3925, "display_filter": "frame.number == 3925", "timestamp_epoch": "1533964553.575811000" }, { "udp_stream": 69, "frame_number": 5441, "display_filter": "frame.number == 5441", "timestamp_epoch": "1533964556.880955000" }, { "udp_stream": 106, "frame_number": 9637, "display_filter": "frame.number == 9637", "timestamp_epoch": "1533964899.569932000" }, { "udp_stream": 336, "frame_number": 43648, "display_filter": "frame.number == 43648", "timestamp_epoch": "1533965783.044158000" }, { "udp_stream": 345, "frame_number": 43840, "display_filter": "frame.number == 43840", "timestamp_epoch": "1533965783.630277000" }, { "udp_stream": 353, "frame_number": 44701, "display_filter": "frame.number == 44701", "timestamp_epoch": "1533965786.043701000" }, { "udp_stream": 359, "frame_number": 45830, "display_filter": "frame.number == 45830", "timestamp_epoch": "1533965789.081206000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b8eecb18ecca00ee191d2437", "type": "ipv4", "value": "216.58.194.170", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 30, "frame_number": 611, "display_filter": "frame.number == 611", "timestamp_epoch": "1533964545.651017000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a4dd7efb7c9ebe25b9079aef", "type": "ipv4", "value": "216.58.194.174", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 46, "frame_number": 3212, "display_filter": "frame.number == 3212", "timestamp_epoch": "1533964552.430269000" }, { "udp_stream": 350, "frame_number": 44229, "display_filter": "frame.number == 44229", "timestamp_epoch": "1533965784.476926000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-45ada13018f3c4109461baa5", "type": "ipv4", "value": "216.58.194.182", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 71, "frame_number": 5698, "display_filter": "frame.number == 5698", "timestamp_epoch": "1533964558.771373000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-680374a0875e411bcf2990fa", "type": "ipv4", "value": "216.58.194.202", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 30, "frame_number": 611, "display_filter": "frame.number == 611", "timestamp_epoch": "1533964545.651017000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-15d6908e9ac548ff6395deac", "type": "ipv4", "value": "216.58.194.206", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 350, "frame_number": 44229, "display_filter": "frame.number == 44229", "timestamp_epoch": "1533965784.476926000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-da00669c56cf49ecaa116393", "type": "ipv4", "value": "216.58.194.214", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 71, "frame_number": 5698, "display_filter": "frame.number == 5698", "timestamp_epoch": "1533964558.771373000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5f5b2115e9ba8090c8cc4ed0", "type": "ipv4", "value": "216.58.195.74", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 30, "frame_number": 611, "display_filter": "frame.number == 611", "timestamp_epoch": "1533964545.651017000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6803328e2d52699b0ab534ab", "type": "ipv4", "value": "216.58.195.78", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 46, "frame_number": 3212, "display_filter": "frame.number == 3212", "timestamp_epoch": "1533964552.430269000" }, { "udp_stream": 350, "frame_number": 44229, "display_filter": "frame.number == 44229", "timestamp_epoch": "1533965784.476926000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-aee57217c61a4cb0704e6e46", "type": "ipv4", "value": "216.58.195.86", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 71, "frame_number": 5698, "display_filter": "frame.number == 5698", "timestamp_epoch": "1533964558.771373000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3e9a3a79932cbad5d80eb340", "type": "ipv4", "value": "217.182.126.162", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 269, "frame_number": 27577, "display_filter": "frame.number == 27577", "timestamp_epoch": "1533965035.747708000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e769dd156852577a2b5fa450", "type": "ipv4", "value": "217.182.126.163", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 269, "frame_number": 27577, "display_filter": "frame.number == 27577", "timestamp_epoch": "1533965035.747708000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7737fb76f9db78643e32c73b", "type": "ipv4", "value": "224.0.0.22", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ec6d0755cdfb4300432fa147", "type": "ipv4", "value": "224.0.0.252", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-582286e9b243895553303f57", "type": "ipv4", "value": "23.108.108.218", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 223, "frame_number": 23086, "display_filter": "frame.number == 23086", "timestamp_epoch": "1533964996.618558000" }, { "udp_stream": 361, "frame_number": 46077, "display_filter": "frame.number == 46077", "timestamp_epoch": "1533965789.700898000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3149718017233eb5f69636df", "type": "ipv4", "value": "23.108.190.222", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 223, "frame_number": 23086, "display_filter": "frame.number == 23086", "timestamp_epoch": "1533964996.618558000" }, { "udp_stream": 361, "frame_number": 46077, "display_filter": "frame.number == 46077", "timestamp_epoch": "1533965789.700898000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ad3e87a0b43a3f5a47d57485", "type": "ipv4", "value": "23.108.190.223", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 223, "frame_number": 23086, "display_filter": "frame.number == 23086", "timestamp_epoch": "1533964996.618558000" }, { "udp_stream": 361, "frame_number": 46077, "display_filter": "frame.number == 46077", "timestamp_epoch": "1533965789.700898000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-eee6428ac61b6b9f71e1afdf", "type": "ipv4", "value": "23.20.105.102", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 280, "frame_number": 31704, "display_filter": "frame.number == 31704", "timestamp_epoch": "1533965100.817951000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f186b7a30cf188031694b2ce", "type": "ipv4", "value": "23.20.36.175", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 306, "frame_number": 35556, "display_filter": "frame.number == 35556", "timestamp_epoch": "1533965160.381946000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2fa8d351ff66ba5af50be524", "type": "ipv4", "value": "23.213.38.151", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 149, "frame_number": 14601, "display_filter": "frame.number == 14601", "timestamp_epoch": "1533964904.629602000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-bc3ade17457388cce13da436", "type": "ipv4", "value": "23.220.174.162", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 92, "frame_number": 8147, "display_filter": "frame.number == 8147", "timestamp_epoch": "1533964897.948811000" }, { "udp_stream": 110, "frame_number": 10626, "display_filter": "frame.number == 10626", "timestamp_epoch": "1533964900.625516000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3ea582830ea8d63406aa69d5", "type": "ipv4", "value": "23.220.187.187", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 136, "frame_number": 12842, "display_filter": "frame.number == 12842", "timestamp_epoch": "1533964902.809158000" }, { "udp_stream": 188, "frame_number": 18210, "display_filter": "frame.number == 18210", "timestamp_epoch": "1533964958.485955000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-fc6e2dc5360928bb233a832c", "type": "ipv4", "value": "23.23.98.214", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 82, "frame_number": 6148, "display_filter": "frame.number == 6148", "timestamp_epoch": "1533964559.906110000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-77d7dca3e61499cc6c45c859", "type": "ipv4", "value": "23.23.99.70", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 82, "frame_number": 6148, "display_filter": "frame.number == 6148", "timestamp_epoch": "1533964559.906110000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e5585a04b58b30d53a981b24", "type": "ipv4", "value": "23.35.180.245", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 132, "frame_number": 12260, "display_filter": "frame.number == 12260", "timestamp_epoch": "1533964902.009546000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b3c7a99710a7492fa18da457", "type": "ipv4", "value": "23.35.182.113", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 147, "frame_number": 13794, "display_filter": "frame.number == 13794", "timestamp_epoch": "1533964903.730026000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-bb83a84dd868154fe61699c3", "type": "ipv4", "value": "23.43.176.205", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 68, "frame_number": 5371, "display_filter": "frame.number == 5371", "timestamp_epoch": "1533964556.454915000" }, { "udp_stream": 67, "frame_number": 5372, "display_filter": "frame.number == 5372", "timestamp_epoch": "1533964556.455020000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-211be56b74ee30b8f8416f60", "type": "ipv4", "value": "23.54.20.214", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 203, "frame_number": 19312, "display_filter": "frame.number == 19312", "timestamp_epoch": "1533964961.782585000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-158f297ea5924c7ec244ed46", "type": "ipv4", "value": "23.54.20.74", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 292, "frame_number": 32847, "display_filter": "frame.number == 32847", "timestamp_epoch": "1533965136.094373000" }, { "udp_stream": 294, "frame_number": 32947, "display_filter": "frame.number == 32947", "timestamp_epoch": "1533965136.618382000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a1b055cb5c4deb7816166334", "type": "ipv4", "value": "23.54.21.179", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 232, "frame_number": 23638, "display_filter": "frame.number == 23638", "timestamp_epoch": "1533964997.826472000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-87e07cf3725235da23ac596b", "type": "ipv4", "value": "23.54.21.180", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 164, "frame_number": 15826, "display_filter": "frame.number == 15826", "timestamp_epoch": "1533964907.702394000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-208a2c6e13a924da61190006", "type": "ipv4", "value": "23.54.21.240", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 291, "frame_number": 32736, "display_filter": "frame.number == 32736", "timestamp_epoch": "1533965135.439362000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3cee285db96af4511daf173d", "type": "ipv4", "value": "23.54.22.209", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 118, "frame_number": 11285, "display_filter": "frame.number == 11285", "timestamp_epoch": "1533964901.153957000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d5e7a38406e2a1a2ea95bfb6", "type": "ipv4", "value": "23.54.22.27", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 256, "frame_number": 27329, "display_filter": "frame.number == 27329", "timestamp_epoch": "1533965035.426932000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ac7791c29f543408d156fa2d", "type": "ipv4", "value": "23.54.23.55", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 125, "frame_number": 11930, "display_filter": "frame.number == 11930", "timestamp_epoch": "1533964901.698652000" }, { "udp_stream": 133, "frame_number": 12591, "display_filter": "frame.number == 12591", "timestamp_epoch": "1533964902.539371000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ae978053ec67a1e5f71b03ce", "type": "ipv4", "value": "23.55.114.34", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 238, "frame_number": 24043, "display_filter": "frame.number == 24043", "timestamp_epoch": "1533964999.497119000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-50df5609eb44df3b0625c2ae", "type": "ipv4", "value": "23.55.50.209", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 47, "frame_number": 3334, "display_filter": "frame.number == 3334", "timestamp_epoch": "1533964552.716941000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a1f503b2c8038a6b08868043", "type": "ipv4", "value": "23.73.225.194", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 108, "frame_number": 9752, "display_filter": "frame.number == 9752", "timestamp_epoch": "1533964899.625132000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-243c45a75531b15a532a4334", "type": "ipv4", "value": "23.73.231.65", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 243, "frame_number": 26414, "display_filter": "frame.number == 26414", "timestamp_epoch": "1533965032.677681000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c0bdc0c1e10eb8fcf3bce013", "type": "ipv4", "value": "23.73.239.75", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 114, "frame_number": 10640, "display_filter": "frame.number == 10640", "timestamp_epoch": "1533964900.661382000" }, { "udp_stream": 159, "frame_number": 15053, "display_filter": "frame.number == 15053", "timestamp_epoch": "1533964905.068551000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-013df11602e2be35975e4821", "type": "ipv4", "value": "23.8.170.84", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 152, "frame_number": 14656, "display_filter": "frame.number == 14656", "timestamp_epoch": "1533964904.683765000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b77fd0b8b2bc49363ef7d1ab", "type": "ipv4", "value": "255.255.255.255", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1741226040b4bc8a2e2d8b63", "type": "ipv4", "value": "34.192.56.110", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 259, "frame_number": 27332, "display_filter": "frame.number == 27332", "timestamp_epoch": "1533965035.434545000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-16e300586a954f0d55d8a741", "type": "ipv4", "value": "34.193.211.130", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 258, "frame_number": 27323, "display_filter": "frame.number == 27323", "timestamp_epoch": "1533965035.406624000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5d176b047a8a673c7633bf16", "type": "ipv4", "value": "34.193.227.152", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 240, "frame_number": 24040, "display_filter": "frame.number == 24040", "timestamp_epoch": "1533964999.467395000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-cb3e79699a3484eb4824cd9d", "type": "ipv4", "value": "34.193.232.33", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 190, "frame_number": 18568, "display_filter": "frame.number == 18568", "timestamp_epoch": "1533964959.365164000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7a059689fef519c6a6aa3e5b", "type": "ipv4", "value": "34.194.151.202", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 258, "frame_number": 27323, "display_filter": "frame.number == 27323", "timestamp_epoch": "1533965035.406624000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2f956a2c12a37628b24ac5fe", "type": "ipv4", "value": "34.194.201.62", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 148, "frame_number": 14376, "display_filter": "frame.number == 14376", "timestamp_epoch": "1533964904.333194000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-acdc84e3da63ae5385dd3ef1", "type": "ipv4", "value": "34.194.88.13", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 259, "frame_number": 27332, "display_filter": "frame.number == 27332", "timestamp_epoch": "1533965035.434545000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-105e2fa8dfb8274705bf3a9a", "type": "ipv4", "value": "34.195.63.41", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 248, "frame_number": 26728, "display_filter": "frame.number == 26728", "timestamp_epoch": "1533965033.481510000" }, { "udp_stream": 254, "frame_number": 27021, "display_filter": "frame.number == 27021", "timestamp_epoch": "1533965034.135661000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-933118c6288ddd65ab778f24", "type": "ipv4", "value": "34.196.110.17", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 234, "frame_number": 23623, "display_filter": "frame.number == 23623", "timestamp_epoch": "1533964997.803829000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f8cc7715823cc6636715a1ad", "type": "ipv4", "value": "34.196.181.242", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 266, "frame_number": 27558, "display_filter": "frame.number == 27558", "timestamp_epoch": "1533965035.720501000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2046bfab9e1d8cec3c548cf2", "type": "ipv4", "value": "34.196.187.76", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 234, "frame_number": 23623, "display_filter": "frame.number == 23623", "timestamp_epoch": "1533964997.803829000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-64b5d4e850af2c302a5bf075", "type": "ipv4", "value": "34.197.131.250", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 205, "frame_number": 19619, "display_filter": "frame.number == 19619", "timestamp_epoch": "1533964962.605621000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-668c8f7f027f8719147d3bca", "type": "ipv4", "value": "34.198.191.149", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 266, "frame_number": 27558, "display_filter": "frame.number == 27558", "timestamp_epoch": "1533965035.720501000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-bab5a540c09849506cb83ac0", "type": "ipv4", "value": "34.198.228.49", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 266, "frame_number": 27558, "display_filter": "frame.number == 27558", "timestamp_epoch": "1533965035.720501000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-94e3ffe36b839fac2ecdee8b", "type": "ipv4", "value": "34.199.147.44", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 248, "frame_number": 26728, "display_filter": "frame.number == 26728", "timestamp_epoch": "1533965033.481510000" }, { "udp_stream": 254, "frame_number": 27021, "display_filter": "frame.number == 27021", "timestamp_epoch": "1533965034.135661000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-31c789c5c8aaa86562493304", "type": "ipv4", "value": "34.201.202.206", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 179, "frame_number": 17349, "display_filter": "frame.number == 17349", "timestamp_epoch": "1533964956.315471000" }, { "udp_stream": 182, "frame_number": 17855, "display_filter": "frame.number == 17855", "timestamp_epoch": "1533964957.358759000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a43c150d4d4623e003e8a752", "type": "ipv4", "value": "34.205.99.3", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 266, "frame_number": 27558, "display_filter": "frame.number == 27558", "timestamp_epoch": "1533965035.720501000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3066dbc8eb329299cbd4ca2c", "type": "ipv4", "value": "34.206.197.3", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 306, "frame_number": 35556, "display_filter": "frame.number == 35556", "timestamp_epoch": "1533965160.381946000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f4ece3622c08a31a0d0d0964", "type": "ipv4", "value": "34.206.215.186", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 234, "frame_number": 23623, "display_filter": "frame.number == 23623", "timestamp_epoch": "1533964997.803829000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6bddecb1968cc4f6c651eb28", "type": "ipv4", "value": "34.207.5.71", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 190, "frame_number": 18568, "display_filter": "frame.number == 18568", "timestamp_epoch": "1533964959.365164000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e0c0f402d1c99fba08d2e5c1", "type": "ipv4", "value": "34.208.13.206", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 65, "frame_number": 5141, "display_filter": "frame.number == 5141", "timestamp_epoch": "1533964556.025527000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-924195c86da4f2d607d42b23", "type": "ipv4", "value": "34.208.25.6", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 290, "frame_number": 32701, "display_filter": "frame.number == 32701", "timestamp_epoch": "1533965134.862529000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ac1edb1d279d97c47152884e", "type": "ipv4", "value": "34.208.49.173", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 150, "frame_number": 14614, "display_filter": "frame.number == 14614", "timestamp_epoch": "1533964904.637907000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4c57383480dd0877f0efba56", "type": "ipv4", "value": "34.209.105.94", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 222, "frame_number": 23033, "display_filter": "frame.number == 23033", "timestamp_epoch": "1533964996.474799000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3f0b2f5098a5effc04908b10", "type": "ipv4", "value": "34.210.171.204", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 181, "frame_number": 17890, "display_filter": "frame.number == 17890", "timestamp_epoch": "1533964957.470463000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e087d1e00e1072416979dee7", "type": "ipv4", "value": "34.210.7.129", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 145, "frame_number": 13562, "display_filter": "frame.number == 13562", "timestamp_epoch": "1533964903.558314000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-74e4414e299ddcb4d0100a39", "type": "ipv4", "value": "34.211.210.144", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 98, "frame_number": 8958, "display_filter": "frame.number == 8958", "timestamp_epoch": "1533964898.930359000" }, { "udp_stream": 231, "frame_number": 23599, "display_filter": "frame.number == 23599", "timestamp_epoch": "1533964997.757167000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-74bde356b3cdc36e3cdee3ed", "type": "ipv4", "value": "34.211.69.152", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 145, "frame_number": 13562, "display_filter": "frame.number == 13562", "timestamp_epoch": "1533964903.558314000" }, { "udp_stream": 155, "frame_number": 14641, "display_filter": "frame.number == 14641", "timestamp_epoch": "1533964904.664048000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ca399ab4e4cb1ed1f0e5ab2b", "type": "ipv4", "value": "34.212.197.102", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 199, "frame_number": 19231, "display_filter": "frame.number == 19231", "timestamp_epoch": "1533964961.387623000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4a86dd187eb4fc8594ada98f", "type": "ipv4", "value": "34.212.77.105", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 185, "frame_number": 18200, "display_filter": "frame.number == 18200", "timestamp_epoch": "1533964958.477773000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5e405cc774d9b65313d73c6a", "type": "ipv4", "value": "34.213.12.32", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 199, "frame_number": 19231, "display_filter": "frame.number == 19231", "timestamp_epoch": "1533964961.387623000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-bf4a5491d26cf3183390bf8b", "type": "ipv4", "value": "34.213.2.162", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 156, "frame_number": 14613, "display_filter": "frame.number == 14613", "timestamp_epoch": "1533964904.637787000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c45c7917a2a1c350f082dbf0", "type": "ipv4", "value": "34.213.219.1", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 199, "frame_number": 19231, "display_filter": "frame.number == 19231", "timestamp_epoch": "1533964961.387623000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ce8988b21d0be84d92604081", "type": "ipv4", "value": "34.213.95.197", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 145, "frame_number": 13562, "display_filter": "frame.number == 13562", "timestamp_epoch": "1533964903.558314000" }, { "udp_stream": 155, "frame_number": 14641, "display_filter": "frame.number == 14641", "timestamp_epoch": "1533964904.664048000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-fb6edd1a256f471751cfd10a", "type": "ipv4", "value": "34.214.108.62", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 199, "frame_number": 19231, "display_filter": "frame.number == 19231", "timestamp_epoch": "1533964961.387623000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ec23b353057e65c523fa7bde", "type": "ipv4", "value": "34.215.18.221", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 98, "frame_number": 8958, "display_filter": "frame.number == 8958", "timestamp_epoch": "1533964898.930359000" }, { "udp_stream": 231, "frame_number": 23599, "display_filter": "frame.number == 23599", "timestamp_epoch": "1533964997.757167000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-44c02e8992a6e6a8da7cf08e", "type": "ipv4", "value": "34.216.116.50", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 199, "frame_number": 19231, "display_filter": "frame.number == 19231", "timestamp_epoch": "1533964961.387623000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-634801e7f3c65b135eaecb54", "type": "ipv4", "value": "34.224.45.36", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 300, "frame_number": 33970, "display_filter": "frame.number == 33970", "timestamp_epoch": "1533965157.910445000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d715cc8dd48ff75ccf5315c6", "type": "ipv4", "value": "34.226.161.213", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 300, "frame_number": 33970, "display_filter": "frame.number == 33970", "timestamp_epoch": "1533965157.910445000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4aece5924689c6d1796e0535", "type": "ipv4", "value": "34.226.179.16", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 179, "frame_number": 17349, "display_filter": "frame.number == 17349", "timestamp_epoch": "1533964956.315471000" }, { "udp_stream": 182, "frame_number": 17855, "display_filter": "frame.number == 17855", "timestamp_epoch": "1533964957.358759000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-416eb66db9b18c0866c52cc1", "type": "ipv4", "value": "34.226.50.209", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 300, "frame_number": 33970, "display_filter": "frame.number == 33970", "timestamp_epoch": "1533965157.910445000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b6841e1df1f13331988142cf", "type": "ipv4", "value": "34.231.203.163", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 248, "frame_number": 26728, "display_filter": "frame.number == 26728", "timestamp_epoch": "1533965033.481510000" }, { "udp_stream": 254, "frame_number": 27021, "display_filter": "frame.number == 27021", "timestamp_epoch": "1533965034.135661000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8c2a67b9372e637e1e79766b", "type": "ipv4", "value": "34.233.214.90", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 258, "frame_number": 27323, "display_filter": "frame.number == 27323", "timestamp_epoch": "1533965035.406624000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-667e9f86abee671bf0a3fc5f", "type": "ipv4", "value": "34.233.6.212", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 190, "frame_number": 18568, "display_filter": "frame.number == 18568", "timestamp_epoch": "1533964959.365164000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-087936c2a9d7dad867139713", "type": "ipv4", "value": "34.234.134.91", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 273, "frame_number": 30652, "display_filter": "frame.number == 30652", "timestamp_epoch": "1533965099.045919000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-97f4233851dc0e5d1c9eb795", "type": "ipv4", "value": "34.234.149.11", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 273, "frame_number": 30652, "display_filter": "frame.number == 30652", "timestamp_epoch": "1533965099.045919000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-335d1f62f4b9990605498358", "type": "ipv4", "value": "34.235.5.53", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 300, "frame_number": 33970, "display_filter": "frame.number == 33970", "timestamp_epoch": "1533965157.910445000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-19ccb2245a6b68c638ad3a65", "type": "ipv4", "value": "34.235.70.251", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 280, "frame_number": 31704, "display_filter": "frame.number == 31704", "timestamp_epoch": "1533965100.817951000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-fcf2a0e27cf43820bd2fb734", "type": "ipv4", "value": "34.236.123.105", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 258, "frame_number": 27323, "display_filter": "frame.number == 27323", "timestamp_epoch": "1533965035.406624000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-438321f28f2a6b6f753c3eec", "type": "ipv4", "value": "34.236.230.194", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 248, "frame_number": 26728, "display_filter": "frame.number == 26728", "timestamp_epoch": "1533965033.481510000" }, { "udp_stream": 254, "frame_number": 27021, "display_filter": "frame.number == 27021", "timestamp_epoch": "1533965034.135661000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1d815dbf2b97ace4b839aab4", "type": "ipv4", "value": "34.236.75.36", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 306, "frame_number": 35556, "display_filter": "frame.number == 35556", "timestamp_epoch": "1533965160.381946000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2b911f856af2ff50cba4bac2", "type": "ipv4", "value": "34.237.159.145", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 266, "frame_number": 27558, "display_filter": "frame.number == 27558", "timestamp_epoch": "1533965035.720501000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-71d496e51dc8f502bf8c8730", "type": "ipv4", "value": "34.237.234.13", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 205, "frame_number": 19619, "display_filter": "frame.number == 19619", "timestamp_epoch": "1533964962.605621000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-98c494718554b6b27ea8b4a4", "type": "ipv4", "value": "34.239.209.246", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 300, "frame_number": 33970, "display_filter": "frame.number == 33970", "timestamp_epoch": "1533965157.910445000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-cc00cda2fb396ab1294707c6", "type": "ipv4", "value": "34.239.239.138", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 280, "frame_number": 31704, "display_filter": "frame.number == 31704", "timestamp_epoch": "1533965100.817951000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-85f0ec52dfe58997632e49ff", "type": "ipv4", "value": "34.246.164.247", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 305, "frame_number": 35537, "display_filter": "frame.number == 35537", "timestamp_epoch": "1533965160.370309000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-00aa0ed8bca45ec6b0f8aa05", "type": "ipv4", "value": "34.246.244.104", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 73, "frame_number": 5860, "display_filter": "frame.number == 5860", "timestamp_epoch": "1533964559.445991000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-cdbc2513b250ba0e98c5331d", "type": "ipv4", "value": "34.246.74.216", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 305, "frame_number": 35537, "display_filter": "frame.number == 35537", "timestamp_epoch": "1533965160.370309000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1cffd7318b77e6e5b7fd5eef", "type": "ipv4", "value": "34.247.143.160", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 173, "frame_number": 16524, "display_filter": "frame.number == 16524", "timestamp_epoch": "1533964909.718959000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-9b15f8e84bb6f5e5d5eb0b6e", "type": "ipv4", "value": "34.248.66.236", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 173, "frame_number": 16524, "display_filter": "frame.number == 16524", "timestamp_epoch": "1533964909.718959000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f7280335e231793c80212a79", "type": "ipv4", "value": "34.251.231.74", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 173, "frame_number": 16524, "display_filter": "frame.number == 16524", "timestamp_epoch": "1533964909.718959000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-074c8941fdb17ee18915d315", "type": "ipv4", "value": "35.160.145.246", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 181, "frame_number": 17890, "display_filter": "frame.number == 17890", "timestamp_epoch": "1533964957.470463000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e00e153bf1eeb0ba770eeed1", "type": "ipv4", "value": "35.160.44.27", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 199, "frame_number": 19231, "display_filter": "frame.number == 19231", "timestamp_epoch": "1533964961.387623000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-59489f42b5c98e126c038480", "type": "ipv4", "value": "35.160.46.147", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 199, "frame_number": 19231, "display_filter": "frame.number == 19231", "timestamp_epoch": "1533964961.387623000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a85016df8437ec33799649d9", "type": "ipv4", "value": "35.160.51.142", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 145, "frame_number": 13562, "display_filter": "frame.number == 13562", "timestamp_epoch": "1533964903.558314000" }, { "udp_stream": 155, "frame_number": 14641, "display_filter": "frame.number == 14641", "timestamp_epoch": "1533964904.664048000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b1464ca324230850fa0247b5", "type": "ipv4", "value": "35.161.139.221", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 199, "frame_number": 19231, "display_filter": "frame.number == 19231", "timestamp_epoch": "1533964961.387623000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-40677e12c292bbe3c2d73fc7", "type": "ipv4", "value": "35.161.228.236", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 181, "frame_number": 17890, "display_filter": "frame.number == 17890", "timestamp_epoch": "1533964957.470463000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6e879c2fe0d1000a4182e330", "type": "ipv4", "value": "35.162.109.147", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 222, "frame_number": 23033, "display_filter": "frame.number == 23033", "timestamp_epoch": "1533964996.474799000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-cf1276deebd21a5ab25e7860", "type": "ipv4", "value": "35.162.194.159", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 150, "frame_number": 14614, "display_filter": "frame.number == 14614", "timestamp_epoch": "1533964904.637907000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ba32264fce0ca768c69f8ccf", "type": "ipv4", "value": "35.163.160.113", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 181, "frame_number": 17890, "display_filter": "frame.number == 17890", "timestamp_epoch": "1533964957.470463000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d864fe61a2c3adbe7efc90a5", "type": "ipv4", "value": "35.164.101.53", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 181, "frame_number": 17890, "display_filter": "frame.number == 17890", "timestamp_epoch": "1533964957.470463000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-68610d9c9b7c67f355ff2b87", "type": "ipv4", "value": "35.164.209.30", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 145, "frame_number": 13562, "display_filter": "frame.number == 13562", "timestamp_epoch": "1533964903.558314000" }, { "udp_stream": 155, "frame_number": 14641, "display_filter": "frame.number == 14641", "timestamp_epoch": "1533964904.664048000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-9456c528ae852398161ed5c0", "type": "ipv4", "value": "35.164.52.21", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 181, "frame_number": 17890, "display_filter": "frame.number == 17890", "timestamp_epoch": "1533964957.470463000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8d832c3ace1393b7d9a2e619", "type": "ipv4", "value": "35.165.34.205", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 145, "frame_number": 13562, "display_filter": "frame.number == 13562", "timestamp_epoch": "1533964903.558314000" }, { "udp_stream": 155, "frame_number": 14641, "display_filter": "frame.number == 14641", "timestamp_epoch": "1533964904.664048000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-aee0223ec68332c194d14015", "type": "ipv4", "value": "35.166.4.4", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 290, "frame_number": 32701, "display_filter": "frame.number == 32701", "timestamp_epoch": "1533965134.862529000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-70e8b0651079c30048014568", "type": "ipv4", "value": "35.168.109.209", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 258, "frame_number": 27323, "display_filter": "frame.number == 27323", "timestamp_epoch": "1533965035.406624000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-252e8f41151ee9b9ca1a86fc", "type": "ipv4", "value": "35.169.19.220", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 190, "frame_number": 18568, "display_filter": "frame.number == 18568", "timestamp_epoch": "1533964959.365164000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-9e61a302989b39757a2fe5e6", "type": "ipv4", "value": "35.169.196.58", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 117, "frame_number": 11114, "display_filter": "frame.number == 11114", "timestamp_epoch": "1533964901.056360000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-34afb266f9a3013a70ae302f", "type": "ipv4", "value": "35.169.72.130", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 300, "frame_number": 33970, "display_filter": "frame.number == 33970", "timestamp_epoch": "1533965157.910445000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-34095736b5dfd674ce23436f", "type": "ipv4", "value": "35.171.120.51", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 259, "frame_number": 27332, "display_filter": "frame.number == 27332", "timestamp_epoch": "1533965035.434545000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-39d7f9d835f3eb3078953db9", "type": "ipv4", "value": "35.171.141.177", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 179, "frame_number": 17349, "display_filter": "frame.number == 17349", "timestamp_epoch": "1533964956.315471000" }, { "udp_stream": 182, "frame_number": 17855, "display_filter": "frame.number == 17855", "timestamp_epoch": "1533964957.358759000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f53e5d9b7de8a706cdb9b803", "type": "ipv4", "value": "35.185.199.249", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 99, "frame_number": 8979, "display_filter": "frame.number == 8979", "timestamp_epoch": "1533964898.946941000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-76b3383e73ae96315a5b403d", "type": "ipv4", "value": "35.185.211.128", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 99, "frame_number": 8979, "display_filter": "frame.number == 8979", "timestamp_epoch": "1533964898.946941000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-07df4427156a4b9bec3a987b", "type": "ipv4", "value": "35.185.219.146", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 99, "frame_number": 8979, "display_filter": "frame.number == 8979", "timestamp_epoch": "1533964898.946941000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1f9a89c96157cd66e41d64de", "type": "ipv4", "value": "35.185.232.105", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 99, "frame_number": 8979, "display_filter": "frame.number == 8979", "timestamp_epoch": "1533964898.946941000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-aae220ff0c13b18a77427581", "type": "ipv4", "value": "35.185.241.45", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 99, "frame_number": 8979, "display_filter": "frame.number == 8979", "timestamp_epoch": "1533964898.946941000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1eb9063d31b45d713108ca1d", "type": "ipv4", "value": "35.185.244.37", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 99, "frame_number": 8979, "display_filter": "frame.number == 8979", "timestamp_epoch": "1533964898.946941000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-86cf2e9f3d9dbeb205105b37", "type": "ipv4", "value": "35.185.245.217", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 99, "frame_number": 8979, "display_filter": "frame.number == 8979", "timestamp_epoch": "1533964898.946941000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-76ab575c9b15c4b34d3bc0e9", "type": "ipv4", "value": "35.185.250.254", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 99, "frame_number": 8979, "display_filter": "frame.number == 8979", "timestamp_epoch": "1533964898.946941000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-19074ef722769ecb53676603", "type": "ipv4", "value": "35.185.251.80", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 99, "frame_number": 8979, "display_filter": "frame.number == 8979", "timestamp_epoch": "1533964898.946941000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2e213667bf2722b4728a6de7", "type": "ipv4", "value": "35.186.202.217", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 263, "frame_number": 27526, "display_filter": "frame.number == 27526", "timestamp_epoch": "1533965035.690931000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5ebba28d009fb48bc50441d9", "type": "ipv4", "value": "35.186.208.100", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 109, "frame_number": 10021, "display_filter": "frame.number == 10021", "timestamp_epoch": "1533964899.857368000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8695223ef6b5a72b99890967", "type": "ipv4", "value": "35.186.239.238", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 299, "frame_number": 33923, "display_filter": "frame.number == 33923", "timestamp_epoch": "1533965157.846245000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-518b0bacfbcde3f15cddabff", "type": "ipv4", "value": "35.190.74.53", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 251, "frame_number": 26729, "display_filter": "frame.number == 26729", "timestamp_epoch": "1533965033.481704000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5c4c15fc4aa9ffeb15b63583", "type": "ipv4", "value": "35.190.91.160", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 220, "frame_number": 20725, "display_filter": "frame.number == 20725", "timestamp_epoch": "1533964966.306264000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-496226d13929c138dedd6d6f", "type": "ipv4", "value": "35.201.123.46", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 302, "frame_number": 35521, "display_filter": "frame.number == 35521", "timestamp_epoch": "1533965160.354413000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-dda6da9158530dfa5d6000fd", "type": "ipv4", "value": "35.227.197.177", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 211, "frame_number": 20032, "display_filter": "frame.number == 20032", "timestamp_epoch": "1533964964.154372000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7ed394a44425bfe35575b7f1", "type": "ipv4", "value": "37.157.2.234", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 235, "frame_number": 23649, "display_filter": "frame.number == 23649", "timestamp_epoch": "1533964997.831687000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-56739ebd4b99ee2484d600c8", "type": "ipv4", "value": "37.157.4.39", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 235, "frame_number": 23649, "display_filter": "frame.number == 23649", "timestamp_epoch": "1533964997.831687000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-01ba4b1dae3691498679407e", "type": "ipv4", "value": "37.157.4.40", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 235, "frame_number": 23649, "display_filter": "frame.number == 23649", "timestamp_epoch": "1533964997.831687000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d9702c1b04d698dfe28062a2", "type": "ipv4", "value": "37.157.6.245", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 235, "frame_number": 23649, "display_filter": "frame.number == 23649", "timestamp_epoch": "1533964997.831687000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-be4ab9db58c2ee7ea06a2238", "type": "ipv4", "value": "37.157.6.251", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 235, "frame_number": 23649, "display_filter": "frame.number == 23649", "timestamp_epoch": "1533964997.831687000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-58799499cf5cd9711b558cfe", "type": "ipv4", "value": "38.106.10.132", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 268, "frame_number": 27576, "display_filter": "frame.number == 27576", "timestamp_epoch": "1533965035.747687000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-148f36b505180a8ff442f845", "type": "ipv4", "value": "38.106.34.104", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 257, "frame_number": 27357, "display_filter": "frame.number == 27357", "timestamp_epoch": "1533965035.496495000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-21365f259a05880c826f8ac6", "type": "ipv4", "value": "38.106.34.105", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 257, "frame_number": 27357, "display_filter": "frame.number == 27357", "timestamp_epoch": "1533965035.496495000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2f7e0eb8495b5b5874bc8f8c", "type": "ipv4", "value": "38.106.34.125", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 257, "frame_number": 27357, "display_filter": "frame.number == 27357", "timestamp_epoch": "1533965035.496495000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0f44f762586edde9e6326439", "type": "ipv4", "value": "38.106.34.142", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 257, "frame_number": 27357, "display_filter": "frame.number == 27357", "timestamp_epoch": "1533965035.496495000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1672a1c90df4cccff1816bf5", "type": "ipv4", "value": "38.106.34.155", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 257, "frame_number": 27357, "display_filter": "frame.number == 27357", "timestamp_epoch": "1533965035.496495000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d246300e6e08696888d5210d", "type": "ipv4", "value": "38.106.34.160", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 257, "frame_number": 27357, "display_filter": "frame.number == 27357", "timestamp_epoch": "1533965035.496495000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2765506c51ffbdbbb0934b34", "type": "ipv4", "value": "38.106.34.163", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 257, "frame_number": 27357, "display_filter": "frame.number == 27357", "timestamp_epoch": "1533965035.496495000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-09135e634dbb79c69ca8c95d", "type": "ipv4", "value": "38.106.34.164", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 257, "frame_number": 27357, "display_filter": "frame.number == 27357", "timestamp_epoch": "1533965035.496495000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2863319e50d31c2dbc4bef1c", "type": "ipv4", "value": "4.78.226.232", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 153, "frame_number": 14611, "display_filter": "frame.number == 14611", "timestamp_epoch": "1533964904.637605000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e04236cc6da757bb076a887e", "type": "ipv4", "value": "4.78.226.233", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 224, "frame_number": 23034, "display_filter": "frame.number == 23034", "timestamp_epoch": "1533964996.474895000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d25d9b257c34980d6bc80789", "type": "ipv4", "value": "4.78.226.234", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 230, "frame_number": 23300, "display_filter": "frame.number == 23300", "timestamp_epoch": "1533964997.294014000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5e5fd9905743b4e064476266", "type": "ipv4", "value": "46.161.36.4", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 122, "frame_number": 11789, "display_filter": "frame.number == 11789", "timestamp_epoch": "1533964901.574246000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ffda9ebf7cdbfaae8f408a33", "type": "ipv4", "value": "46.161.36.6", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 122, "frame_number": 11789, "display_filter": "frame.number == 11789", "timestamp_epoch": "1533964901.574246000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-54fd62277162d4dc1c99a816", "type": "ipv4", "value": "46.161.36.8", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 122, "frame_number": 11789, "display_filter": "frame.number == 11789", "timestamp_epoch": "1533964901.574246000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-cf846570f09c1f6699c5cfa8", "type": "ipv4", "value": "46.51.169.56", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 285, "frame_number": 31674, "display_filter": "frame.number == 31674", "timestamp_epoch": "1533965100.796522000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e0d23477dba7154b43092e14", "type": "ipv4", "value": "46.51.174.75", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 285, "frame_number": 31674, "display_filter": "frame.number == 31674", "timestamp_epoch": "1533965100.796522000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-9cba802271afb88608af966c", "type": "ipv4", "value": "46.51.193.164", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 173, "frame_number": 16524, "display_filter": "frame.number == 16524", "timestamp_epoch": "1533964909.718959000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-452bb27f69878b4bce77025f", "type": "ipv4", "value": "5.39.44.194", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 269, "frame_number": 27577, "display_filter": "frame.number == 27577", "timestamp_epoch": "1533965035.747708000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-57024d05517a705d7d489d8f", "type": "ipv4", "value": "5.39.44.195", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 269, "frame_number": 27577, "display_filter": "frame.number == 27577", "timestamp_epoch": "1533965035.747708000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ca372d506ba75028a8014c7c", "type": "ipv4", "value": "50.16.185.226", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 82, "frame_number": 6148, "display_filter": "frame.number == 6148", "timestamp_epoch": "1533964559.906110000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-34a77509307bf3fe735b61d4", "type": "ipv4", "value": "50.16.201.198", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 82, "frame_number": 6148, "display_filter": "frame.number == 6148", "timestamp_epoch": "1533964559.906110000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-fdaa97f7c8b79855e4385467", "type": "ipv4", "value": "50.16.204.65", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 82, "frame_number": 6148, "display_filter": "frame.number == 6148", "timestamp_epoch": "1533964559.906110000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-35f0e022b7b5c729b00bf6ca", "type": "ipv4", "value": "50.16.205.103", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 82, "frame_number": 6148, "display_filter": "frame.number == 6148", "timestamp_epoch": "1533964559.906110000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-39c148a915e3a2e9e1ff89d3", "type": "ipv4", "value": "50.16.223.11", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 82, "frame_number": 6148, "display_filter": "frame.number == 6148", "timestamp_epoch": "1533964559.906110000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d9fb6035f9eb88e7e4ef9349", "type": "ipv4", "value": "50.16.230.124", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 82, "frame_number": 6148, "display_filter": "frame.number == 6148", "timestamp_epoch": "1533964559.906110000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f5eb2bea6b31017fa5b11654", "type": "ipv4", "value": "50.18.110.80", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 154, "frame_number": 14640, "display_filter": "frame.number == 14640", "timestamp_epoch": "1533964904.663956000" }, { "udp_stream": 364, "frame_number": 46080, "display_filter": "frame.number == 46080", "timestamp_epoch": "1533965789.714227000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3bfc2b66a542f9d481562910", "type": "ipv4", "value": "50.18.173.83", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 260, "frame_number": 27324, "display_filter": "frame.number == 27324", "timestamp_epoch": "1533965035.406855000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7a1f66b92fdcd16c51e1d869", "type": "ipv4", "value": "50.18.61.120", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 260, "frame_number": 27324, "display_filter": "frame.number == 27324", "timestamp_epoch": "1533965035.406855000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d238906899bd0969d7f2fac0", "type": "ipv4", "value": "50.18.61.141", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 260, "frame_number": 27324, "display_filter": "frame.number == 27324", "timestamp_epoch": "1533965035.406855000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-15644cc772f7ee4399f6cb14", "type": "ipv4", "value": "50.19.167.223", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 280, "frame_number": 31704, "display_filter": "frame.number == 31704", "timestamp_epoch": "1533965100.817951000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-99372f0001c98bdcf0d4b2b5", "type": "ipv4", "value": "50.19.205.30", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 117, "frame_number": 11114, "display_filter": "frame.number == 11114", "timestamp_epoch": "1533964901.056360000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c52bdb7491d9facc2b665124", "type": "ipv4", "value": "50.19.51.56", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 120, "frame_number": 23682, "display_filter": "frame.number == 23682", "timestamp_epoch": "1533964997.887170000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5749833c834315adde3a3bca", "type": "ipv4", "value": "52.0.134.142", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 273, "frame_number": 30652, "display_filter": "frame.number == 30652", "timestamp_epoch": "1533965099.045919000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-87f2f06f54fb8a96f16e13d0", "type": "ipv4", "value": "52.0.244.217", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 266, "frame_number": 27558, "display_filter": "frame.number == 27558", "timestamp_epoch": "1533965035.720501000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f666b4ee856681468cb552c7", "type": "ipv4", "value": "52.11.229.48", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 252, "frame_number": 26736, "display_filter": "frame.number == 26736", "timestamp_epoch": "1533965033.496493000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b70fcded377d7b36b3efdd06", "type": "ipv4", "value": "52.11.6.29", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 296, "frame_number": 32987, "display_filter": "frame.number == 32987", "timestamp_epoch": "1533965136.794310000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-06feb3d09e0040e1f887e184", "type": "ipv4", "value": "52.11.73.127", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 290, "frame_number": 32701, "display_filter": "frame.number == 32701", "timestamp_epoch": "1533965134.862529000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-bf9a068fc0ced0ee3a13cf5d", "type": "ipv4", "value": "52.11.94.156", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 222, "frame_number": 23033, "display_filter": "frame.number == 23033", "timestamp_epoch": "1533964996.474799000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b81fe7c400aadae24d76085c", "type": "ipv4", "value": "52.15.253.50", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 293, "frame_number": 32841, "display_filter": "frame.number == 32841", "timestamp_epoch": "1533965136.087192000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0c485aea30f16f0fd9298091", "type": "ipv4", "value": "52.15.46.161", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 293, "frame_number": 32841, "display_filter": "frame.number == 32841", "timestamp_epoch": "1533965136.087192000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e91b2e6fc1ef86384c8d84fc", "type": "ipv4", "value": "52.16.89.247", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 173, "frame_number": 16524, "display_filter": "frame.number == 16524", "timestamp_epoch": "1533964909.718959000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a9e08f33296634a8a6e64ca1", "type": "ipv4", "value": "52.17.182.129", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 173, "frame_number": 16524, "display_filter": "frame.number == 16524", "timestamp_epoch": "1533964909.718959000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ac016ee126007731c9a4e7ca", "type": "ipv4", "value": "52.20.201.251", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 117, "frame_number": 11114, "display_filter": "frame.number == 11114", "timestamp_epoch": "1533964901.056360000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e49ba89113912acdfed35acd", "type": "ipv4", "value": "52.20.63.23", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 234, "frame_number": 23623, "display_filter": "frame.number == 23623", "timestamp_epoch": "1533964997.803829000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ccf76845ef0b527d523b6628", "type": "ipv4", "value": "52.200.135.6", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 248, "frame_number": 26728, "display_filter": "frame.number == 26728", "timestamp_epoch": "1533965033.481510000" }, { "udp_stream": 254, "frame_number": 27021, "display_filter": "frame.number == 27021", "timestamp_epoch": "1533965034.135661000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a63b9d8c062c3d4c6071f372", "type": "ipv4", "value": "52.201.177.113", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 280, "frame_number": 31704, "display_filter": "frame.number == 31704", "timestamp_epoch": "1533965100.817951000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-cdd4f2c21e4aee07da20dc16", "type": "ipv4", "value": "52.202.121.146", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 117, "frame_number": 11114, "display_filter": "frame.number == 11114", "timestamp_epoch": "1533964901.056360000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e6b51cdfa4e595121e3f1e56", "type": "ipv4", "value": "52.202.36.55", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 259, "frame_number": 27332, "display_filter": "frame.number == 27332", "timestamp_epoch": "1533965035.434545000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0141b31e6eca4e5167110921", "type": "ipv4", "value": "52.202.74.78", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 280, "frame_number": 31704, "display_filter": "frame.number == 31704", "timestamp_epoch": "1533965100.817951000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6941973e2a52833ae4a41e4e", "type": "ipv4", "value": "52.203.113.55", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 259, "frame_number": 27332, "display_filter": "frame.number == 27332", "timestamp_epoch": "1533965035.434545000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-de7c9b1993d626ea110b97d7", "type": "ipv4", "value": "52.203.152.20", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 273, "frame_number": 30652, "display_filter": "frame.number == 30652", "timestamp_epoch": "1533965099.045919000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d1d5de2b2a80f1e2cc2c1518", "type": "ipv4", "value": "52.203.231.138", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 248, "frame_number": 26728, "display_filter": "frame.number == 26728", "timestamp_epoch": "1533965033.481510000" }, { "udp_stream": 254, "frame_number": 27021, "display_filter": "frame.number == 27021", "timestamp_epoch": "1533965034.135661000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-019eb35b5a70ff60d66bc5a9", "type": "ipv4", "value": "52.203.238.185", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 166, "frame_number": 16032, "display_filter": "frame.number == 16032", "timestamp_epoch": "1533964908.406611000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e5ea9cd9eaa2be2ed713c3d4", "type": "ipv4", "value": "52.204.11.61", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 227, "frame_number": 23293, "display_filter": "frame.number == 23293", "timestamp_epoch": "1533964997.291196000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c46e10656f9008597493e8b2", "type": "ipv4", "value": "52.204.188.86", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 227, "frame_number": 23293, "display_filter": "frame.number == 23293", "timestamp_epoch": "1533964997.291196000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e3c14792694c4a86f71fde59", "type": "ipv4", "value": "52.205.207.146", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 240, "frame_number": 24040, "display_filter": "frame.number == 24040", "timestamp_epoch": "1533964999.467395000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2bcc73771a1a14bd87080fe4", "type": "ipv4", "value": "52.206.139.43", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 234, "frame_number": 23623, "display_filter": "frame.number == 23623", "timestamp_epoch": "1533964997.803829000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-11d9807ab403353312975a16", "type": "ipv4", "value": "52.206.38.25", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 227, "frame_number": 23293, "display_filter": "frame.number == 23293", "timestamp_epoch": "1533964997.291196000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e2861ad094fb4673f35c4348", "type": "ipv4", "value": "52.206.55.46", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 166, "frame_number": 16032, "display_filter": "frame.number == 16032", "timestamp_epoch": "1533964908.406611000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d6c829335001d4d38186649f", "type": "ipv4", "value": "52.207.120.98", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 148, "frame_number": 14376, "display_filter": "frame.number == 14376", "timestamp_epoch": "1533964904.333194000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-47f74216c062b657c4b01753", "type": "ipv4", "value": "52.207.61.182", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 190, "frame_number": 18568, "display_filter": "frame.number == 18568", "timestamp_epoch": "1533964959.365164000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-995a8a36202622486ed18c03", "type": "ipv4", "value": "52.209.191.106", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 73, "frame_number": 5860, "display_filter": "frame.number == 5860", "timestamp_epoch": "1533964559.445991000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-43ee04eaa59f7cd391a2c505", "type": "ipv4", "value": "52.21.201.75", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 120, "frame_number": 23682, "display_filter": "frame.number == 23682", "timestamp_epoch": "1533964997.887170000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-28a6ad1919172eebc85666e3", "type": "ipv4", "value": "52.211.165.177", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 305, "frame_number": 35537, "display_filter": "frame.number == 35537", "timestamp_epoch": "1533965160.370309000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-27dea6e4b37d746050f95120", "type": "ipv4", "value": "52.212.134.173", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 305, "frame_number": 35537, "display_filter": "frame.number == 35537", "timestamp_epoch": "1533965160.370309000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5f3b44042a7e1094936be9c6", "type": "ipv4", "value": "52.212.137.44", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 305, "frame_number": 35537, "display_filter": "frame.number == 35537", "timestamp_epoch": "1533965160.370309000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f2681bbea8fd2d34dfb5300b", "type": "ipv4", "value": "52.22.107.11", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 166, "frame_number": 16032, "display_filter": "frame.number == 16032", "timestamp_epoch": "1533964908.406611000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1f0e2e0a86bdec7383ba86c9", "type": "ipv4", "value": "52.22.112.153", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 259, "frame_number": 27332, "display_filter": "frame.number == 27332", "timestamp_epoch": "1533965035.434545000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3a9afc527f5cfb37143147de", "type": "ipv4", "value": "52.22.146.31", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 227, "frame_number": 23293, "display_filter": "frame.number == 23293", "timestamp_epoch": "1533964997.291196000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-af6b10bb86e4097af11a1950", "type": "ipv4", "value": "52.22.167.180", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 205, "frame_number": 19619, "display_filter": "frame.number == 19619", "timestamp_epoch": "1533964962.605621000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-9f464c6941868146a9a01685", "type": "ipv4", "value": "52.22.246.227", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 207, "frame_number": 19702, "display_filter": "frame.number == 19702", "timestamp_epoch": "1533964962.896098000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-aca1db89651a19716ac639a0", "type": "ipv4", "value": "52.22.78.109", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 273, "frame_number": 30652, "display_filter": "frame.number == 30652", "timestamp_epoch": "1533965099.045919000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c26001e2dec8854f0d0401be", "type": "ipv4", "value": "52.221.28.32", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 225, "frame_number": 23149, "display_filter": "frame.number == 23149", "timestamp_epoch": "1533964996.948203000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-9c53acbb21b043f94fb83545", "type": "ipv4", "value": "52.221.38.91", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 225, "frame_number": 23149, "display_filter": "frame.number == 23149", "timestamp_epoch": "1533964996.948203000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-71f472ca8a364f6e186753fc", "type": "ipv4", "value": "52.23.112.47", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 166, "frame_number": 16032, "display_filter": "frame.number == 16032", "timestamp_epoch": "1533964908.406611000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2524d7e1f2efc0697b3a0036", "type": "ipv4", "value": "52.24.120.129", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 252, "frame_number": 26736, "display_filter": "frame.number == 26736", "timestamp_epoch": "1533965033.496493000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-594c61f84faea0890bbad123", "type": "ipv4", "value": "52.24.137.134", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 156, "frame_number": 14613, "display_filter": "frame.number == 14613", "timestamp_epoch": "1533964904.637787000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-22044c2f0e20ceba17750c23", "type": "ipv4", "value": "52.24.57.89", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 150, "frame_number": 14614, "display_filter": "frame.number == 14614", "timestamp_epoch": "1533964904.637907000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d4cada7f939bdf03a6e6484d", "type": "ipv4", "value": "52.24.61.237", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 290, "frame_number": 32701, "display_filter": "frame.number == 32701", "timestamp_epoch": "1533965134.862529000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f9b06c24b674531b42557ace", "type": "ipv4", "value": "52.25.151.172", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 156, "frame_number": 14613, "display_filter": "frame.number == 14613", "timestamp_epoch": "1533964904.637787000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-656a41eaeae867c87bccae47", "type": "ipv4", "value": "52.25.20.224", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 296, "frame_number": 32987, "display_filter": "frame.number == 32987", "timestamp_epoch": "1533965136.794310000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-882056bb1423e9ad376f2c1f", "type": "ipv4", "value": "52.25.205.181", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 180, "frame_number": 17691, "display_filter": "frame.number == 17691", "timestamp_epoch": "1533964957.010961000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-de686498b0de1e22e16391b7", "type": "ipv4", "value": "52.25.41.120", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 181, "frame_number": 17890, "display_filter": "frame.number == 17890", "timestamp_epoch": "1533964957.470463000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a5ff037a719c83660fb06d54", "type": "ipv4", "value": "52.25.46.76", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 180, "frame_number": 17691, "display_filter": "frame.number == 17691", "timestamp_epoch": "1533964957.010961000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-805885c7fc341b553164189c", "type": "ipv4", "value": "52.25.98.6", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 296, "frame_number": 32987, "display_filter": "frame.number == 32987", "timestamp_epoch": "1533965136.794310000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7c7707e87cb91bb422304b94", "type": "ipv4", "value": "52.26.10.3", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 180, "frame_number": 17691, "display_filter": "frame.number == 17691", "timestamp_epoch": "1533964957.010961000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8fbe6f170fdff9abe11ae3f5", "type": "ipv4", "value": "52.26.143.166", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 270, "frame_number": 27927, "display_filter": "frame.number == 27927", "timestamp_epoch": "1533965036.249006000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4275a0ccd0e75429a69749a3", "type": "ipv4", "value": "52.26.246.54", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 180, "frame_number": 17691, "display_filter": "frame.number == 17691", "timestamp_epoch": "1533964957.010961000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-731c74b88099cf6250dc64f1", "type": "ipv4", "value": "52.26.87.58", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 185, "frame_number": 18200, "display_filter": "frame.number == 18200", "timestamp_epoch": "1533964958.477773000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f5c21071b5fd5fef0d0464cf", "type": "ipv4", "value": "52.27.237.90", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 180, "frame_number": 17691, "display_filter": "frame.number == 17691", "timestamp_epoch": "1533964957.010961000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f12557d4106d173602d6c6da", "type": "ipv4", "value": "52.27.59.211", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 180, "frame_number": 17691, "display_filter": "frame.number == 17691", "timestamp_epoch": "1533964957.010961000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c5b97c94c44307ccd29a3821", "type": "ipv4", "value": "52.27.97.168", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 98, "frame_number": 8958, "display_filter": "frame.number == 8958", "timestamp_epoch": "1533964898.930359000" }, { "udp_stream": 231, "frame_number": 23599, "display_filter": "frame.number == 23599", "timestamp_epoch": "1533964997.757167000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e14d22076bd839feedcedd05", "type": "ipv4", "value": "52.29.182.113", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 261, "frame_number": 27339, "display_filter": "frame.number == 27339", "timestamp_epoch": "1533965035.445254000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e1f82b4ab452f069576e1124", "type": "ipv4", "value": "52.3.158.250", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 248, "frame_number": 26728, "display_filter": "frame.number == 26728", "timestamp_epoch": "1533965033.481510000" }, { "udp_stream": 254, "frame_number": 27021, "display_filter": "frame.number == 27021", "timestamp_epoch": "1533965034.135661000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-cd3e2a5d6add88993e93392d", "type": "ipv4", "value": "52.3.167.150", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 258, "frame_number": 27323, "display_filter": "frame.number == 27323", "timestamp_epoch": "1533965035.406624000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c524ccbee165d70cdaa4bf77", "type": "ipv4", "value": "52.3.171.209", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 205, "frame_number": 19619, "display_filter": "frame.number == 19619", "timestamp_epoch": "1533964962.605621000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-96cef92c0c7b434c5055aedc", "type": "ipv4", "value": "52.3.24.219", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 258, "frame_number": 27323, "display_filter": "frame.number == 27323", "timestamp_epoch": "1533965035.406624000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a51fbebcaeeb52bbb3f0a33e", "type": "ipv4", "value": "52.3.56.159", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 207, "frame_number": 19702, "display_filter": "frame.number == 19702", "timestamp_epoch": "1533964962.896098000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c32d650fc7727bc465ac4794", "type": "ipv4", "value": "52.32.112.140", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 180, "frame_number": 17691, "display_filter": "frame.number == 17691", "timestamp_epoch": "1533964957.010961000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c599a1e0667d5bffbcc19081", "type": "ipv4", "value": "52.32.135.110", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 180, "frame_number": 17691, "display_filter": "frame.number == 17691", "timestamp_epoch": "1533964957.010961000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f4b6da9a41641f2d6ee74b7d", "type": "ipv4", "value": "52.32.152.21", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 150, "frame_number": 14614, "display_filter": "frame.number == 14614", "timestamp_epoch": "1533964904.637907000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6b191428766459266858c5b8", "type": "ipv4", "value": "52.33.181.135", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 155, "frame_number": 14641, "display_filter": "frame.number == 14641", "timestamp_epoch": "1533964904.664048000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-12e3fe34645eaee93470a71e", "type": "ipv4", "value": "52.33.44.132", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 296, "frame_number": 32987, "display_filter": "frame.number == 32987", "timestamp_epoch": "1533965136.794310000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ef27e7d21198e70e74d6e4dc", "type": "ipv4", "value": "52.33.53.65", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 244, "frame_number": 26411, "display_filter": "frame.number == 26411", "timestamp_epoch": "1533965032.677118000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-20b29e26e7bd4c69c2f5b2d1", "type": "ipv4", "value": "52.34.250.5", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 215, "frame_number": 20229, "display_filter": "frame.number == 20229", "timestamp_epoch": "1533964965.012616000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-72515161ef2de953ab44f376", "type": "ipv4", "value": "52.34.60.103", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 290, "frame_number": 32701, "display_filter": "frame.number == 32701", "timestamp_epoch": "1533965134.862529000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ddb77241b90276ce55542127", "type": "ipv4", "value": "52.34.79.42", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 290, "frame_number": 32701, "display_filter": "frame.number == 32701", "timestamp_epoch": "1533965134.862529000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f1325efc6b985186252ac445", "type": "ipv4", "value": "52.35.100.30", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 290, "frame_number": 32701, "display_filter": "frame.number == 32701", "timestamp_epoch": "1533965134.862529000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-413a7b0137bc4651962f12b4", "type": "ipv4", "value": "52.35.138.60", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 296, "frame_number": 32987, "display_filter": "frame.number == 32987", "timestamp_epoch": "1533965136.794310000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-baf0db8fcaa5aa96982aa423", "type": "ipv4", "value": "52.35.251.146", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 296, "frame_number": 32987, "display_filter": "frame.number == 32987", "timestamp_epoch": "1533965136.794310000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3027edf003fe6e1a681ad9cb", "type": "ipv4", "value": "52.35.48.81", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 296, "frame_number": 32987, "display_filter": "frame.number == 32987", "timestamp_epoch": "1533965136.794310000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-508575253f218ea74e9f40b3", "type": "ipv4", "value": "52.36.101.222", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 239, "frame_number": 24037, "display_filter": "frame.number == 24037", "timestamp_epoch": "1533964999.457617000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-db4594523558cfc58cf9b496", "type": "ipv4", "value": "52.36.116.231", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 239, "frame_number": 24037, "display_filter": "frame.number == 24037", "timestamp_epoch": "1533964999.457617000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5c04f194c88914c3dab1a764", "type": "ipv4", "value": "52.36.228.150", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 155, "frame_number": 14641, "display_filter": "frame.number == 14641", "timestamp_epoch": "1533964904.664048000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5e85af5b9a2fbc665243d20e", "type": "ipv4", "value": "52.36.43.94", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 155, "frame_number": 14641, "display_filter": "frame.number == 14641", "timestamp_epoch": "1533964904.664048000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ce89d986266ef4b535d879a5", "type": "ipv4", "value": "52.37.19.179", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 156, "frame_number": 14613, "display_filter": "frame.number == 14613", "timestamp_epoch": "1533964904.637787000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a40b5a3e674d64f5d44e92d9", "type": "ipv4", "value": "52.38.108.180", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 156, "frame_number": 14613, "display_filter": "frame.number == 14613", "timestamp_epoch": "1533964904.637787000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0083b3d579d3ac15c6f63d20", "type": "ipv4", "value": "52.39.151.69", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 222, "frame_number": 23033, "display_filter": "frame.number == 23033", "timestamp_epoch": "1533964996.474799000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3a0f2918475d56bc9f5c9074", "type": "ipv4", "value": "52.4.123.24", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 258, "frame_number": 27323, "display_filter": "frame.number == 27323", "timestamp_epoch": "1533965035.406624000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b2d46b1530cdbc526406ced3", "type": "ipv4", "value": "52.4.138.39", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 227, "frame_number": 23293, "display_filter": "frame.number == 23293", "timestamp_epoch": "1533964997.291196000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-83b94f56ff507b3b80d214f7", "type": "ipv4", "value": "52.4.175.160", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 300, "frame_number": 33970, "display_filter": "frame.number == 33970", "timestamp_epoch": "1533965157.910445000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-489ac2a53f0d25851debfb66", "type": "ipv4", "value": "52.4.188.134", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 207, "frame_number": 19702, "display_filter": "frame.number == 19702", "timestamp_epoch": "1533964962.896098000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b0a33c4537001bf625905f8f", "type": "ipv4", "value": "52.4.234.47", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 273, "frame_number": 30652, "display_filter": "frame.number == 30652", "timestamp_epoch": "1533965099.045919000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8090b0e3fb932327df81ba93", "type": "ipv4", "value": "52.4.92.244", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 227, "frame_number": 23293, "display_filter": "frame.number == 23293", "timestamp_epoch": "1533964997.291196000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-cc66c034c5bed8a686b15c56", "type": "ipv4", "value": "52.40.188.201", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 98, "frame_number": 8958, "display_filter": "frame.number == 8958", "timestamp_epoch": "1533964898.930359000" }, { "udp_stream": 231, "frame_number": 23599, "display_filter": "frame.number == 23599", "timestamp_epoch": "1533964997.757167000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1e364be4895796bb3d281234", "type": "ipv4", "value": "52.40.243.130", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 156, "frame_number": 14613, "display_filter": "frame.number == 14613", "timestamp_epoch": "1533964904.637787000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-97e7e8925d71e88a2c890b8f", "type": "ipv4", "value": "52.41.250.17", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 150, "frame_number": 14614, "display_filter": "frame.number == 14614", "timestamp_epoch": "1533964904.637907000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6049d478f1da0b5130d952ff", "type": "ipv4", "value": "52.42.116.214", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 244, "frame_number": 26411, "display_filter": "frame.number == 26411", "timestamp_epoch": "1533965032.677118000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5281c3137ea667a72014cb1f", "type": "ipv4", "value": "52.42.185.39", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 290, "frame_number": 32701, "display_filter": "frame.number == 32701", "timestamp_epoch": "1533965134.862529000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ad61b3140230690ec1b2c3f5", "type": "ipv4", "value": "52.43.107.250", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 156, "frame_number": 14613, "display_filter": "frame.number == 14613", "timestamp_epoch": "1533964904.637787000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c702b8ce0d6151888595ac89", "type": "ipv4", "value": "52.43.21.121", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 239, "frame_number": 24037, "display_filter": "frame.number == 24037", "timestamp_epoch": "1533964999.457617000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f3867c0eb0a189c8ea145eec", "type": "ipv4", "value": "52.43.30.37", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 65, "frame_number": 5141, "display_filter": "frame.number == 5141", "timestamp_epoch": "1533964556.025527000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5124d979bf719179c0af4444", "type": "ipv4", "value": "52.43.42.188", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 296, "frame_number": 32987, "display_filter": "frame.number == 32987", "timestamp_epoch": "1533965136.794310000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e81e526ef6635997e6ac57b6", "type": "ipv4", "value": "52.44.153.144", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 227, "frame_number": 23293, "display_filter": "frame.number == 23293", "timestamp_epoch": "1533964997.291196000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d1ff3e00747cf018c8b2ef08", "type": "ipv4", "value": "52.44.165.199", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 179, "frame_number": 17349, "display_filter": "frame.number == 17349", "timestamp_epoch": "1533964956.315471000" }, { "udp_stream": 182, "frame_number": 17855, "display_filter": "frame.number == 17855", "timestamp_epoch": "1533964957.358759000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5bf72395b868b89509266d12", "type": "ipv4", "value": "52.44.175.211", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 207, "frame_number": 19702, "display_filter": "frame.number == 19702", "timestamp_epoch": "1533964962.896098000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-fc8ef82ac16a88bc142f1faa", "type": "ipv4", "value": "52.44.213.64", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 166, "frame_number": 16032, "display_filter": "frame.number == 16032", "timestamp_epoch": "1533964908.406611000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8fa1f07d35a58afdf6ecd0ab", "type": "ipv4", "value": "52.44.246.171", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 306, "frame_number": 35556, "display_filter": "frame.number == 35556", "timestamp_epoch": "1533965160.381946000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7995e2f7f7dfa19bb5951096", "type": "ipv4", "value": "52.44.44.54", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 166, "frame_number": 16032, "display_filter": "frame.number == 16032", "timestamp_epoch": "1533964908.406611000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-36c9b4172842496193eace34", "type": "ipv4", "value": "52.44.93.202", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 248, "frame_number": 26728, "display_filter": "frame.number == 26728", "timestamp_epoch": "1533965033.481510000" }, { "udp_stream": 254, "frame_number": 27021, "display_filter": "frame.number == 27021", "timestamp_epoch": "1533965034.135661000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0e142ec94ce3b7662ace3ef4", "type": "ipv4", "value": "52.45.111.226", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 227, "frame_number": 23293, "display_filter": "frame.number == 23293", "timestamp_epoch": "1533964997.291196000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-9fc7074b75482d8320feeb79", "type": "ipv4", "value": "52.45.217.171", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 120, "frame_number": 23682, "display_filter": "frame.number == 23682", "timestamp_epoch": "1533964997.887170000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1ec047c6abd6a072676d35e8", "type": "ipv4", "value": "52.45.218.154", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 259, "frame_number": 27332, "display_filter": "frame.number == 27332", "timestamp_epoch": "1533965035.434545000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-02fe9360a2e8a153f7861cce", "type": "ipv4", "value": "52.48.134.100", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 73, "frame_number": 5860, "display_filter": "frame.number == 5860", "timestamp_epoch": "1533964559.445991000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d55f678f539a812abefa2e70", "type": "ipv4", "value": "52.48.186.5", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 305, "frame_number": 35537, "display_filter": "frame.number == 35537", "timestamp_epoch": "1533965160.370309000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-cf707ac028e5bd7bb99c0991", "type": "ipv4", "value": "52.51.131.19", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 173, "frame_number": 16524, "display_filter": "frame.number == 16524", "timestamp_epoch": "1533964909.718959000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8369b321fa39477fdbe45092", "type": "ipv4", "value": "52.52.130.100", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 277, "frame_number": 30810, "display_filter": "frame.number == 30810", "timestamp_epoch": "1533965099.289135000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-85d6acfd9c04def89e2be25d", "type": "ipv4", "value": "52.52.136.196", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 212, "frame_number": 20071, "display_filter": "frame.number == 20071", "timestamp_epoch": "1533964964.450971000" }, { "udp_stream": 242, "frame_number": 24228, "display_filter": "frame.number == 24228", "timestamp_epoch": "1533965001.681775000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6a9c5e009a885bd7508fb82e", "type": "ipv4", "value": "52.52.14.142", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 154, "frame_number": 14640, "display_filter": "frame.number == 14640", "timestamp_epoch": "1533964904.663956000" }, { "udp_stream": 364, "frame_number": 46080, "display_filter": "frame.number == 46080", "timestamp_epoch": "1533965789.714227000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0c1ee1eb4be5f78d68a250c9", "type": "ipv4", "value": "52.52.177.27", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 197, "frame_number": 19066, "display_filter": "frame.number == 19066", "timestamp_epoch": "1533964960.516077000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f84c77d598da94018cf93632", "type": "ipv4", "value": "52.53.134.30", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 212, "frame_number": 20071, "display_filter": "frame.number == 20071", "timestamp_epoch": "1533964964.450971000" }, { "udp_stream": 242, "frame_number": 24228, "display_filter": "frame.number == 24228", "timestamp_epoch": "1533965001.681775000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ca5361e96c1efd2b349a8a05", "type": "ipv4", "value": "52.54.127.128", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 166, "frame_number": 16032, "display_filter": "frame.number == 16032", "timestamp_epoch": "1533964908.406611000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ce6c3c55be719f72ba7ca601", "type": "ipv4", "value": "52.54.208.77", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 166, "frame_number": 16032, "display_filter": "frame.number == 16032", "timestamp_epoch": "1533964908.406611000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-77d4f2fc8036138da238effb", "type": "ipv4", "value": "52.55.152.195", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 120, "frame_number": 23682, "display_filter": "frame.number == 23682", "timestamp_epoch": "1533964997.887170000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8467c1d2ff8d17b3fb14352a", "type": "ipv4", "value": "52.55.182.21", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 207, "frame_number": 19702, "display_filter": "frame.number == 19702", "timestamp_epoch": "1533964962.896098000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b1d4da6c7420fe31e3de44e6", "type": "ipv4", "value": "52.58.174.155", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 261, "frame_number": 27339, "display_filter": "frame.number == 27339", "timestamp_epoch": "1533965035.445254000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-90f4966fb6e2a0d90eb07165", "type": "ipv4", "value": "52.7.157.238", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 250, "frame_number": 26727, "display_filter": "frame.number == 26727", "timestamp_epoch": "1533965033.481280000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f70099dc04559d269d4e1f13", "type": "ipv4", "value": "52.7.2.46", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 240, "frame_number": 24040, "display_filter": "frame.number == 24040", "timestamp_epoch": "1533964999.467395000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f847d56b684ec949f8ededa7", "type": "ipv4", "value": "52.70.11.152", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 234, "frame_number": 23623, "display_filter": "frame.number == 23623", "timestamp_epoch": "1533964997.803829000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ad799f46b61475c6b76db4c8", "type": "ipv4", "value": "52.70.2.4", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 250, "frame_number": 26727, "display_filter": "frame.number == 26727", "timestamp_epoch": "1533965033.481280000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4006c1e83c2216ff57df81f3", "type": "ipv4", "value": "52.71.116.75", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 273, "frame_number": 30652, "display_filter": "frame.number == 30652", "timestamp_epoch": "1533965099.045919000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ad7ddcfb7afb3fab760a87aa", "type": "ipv4", "value": "52.71.249.74", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 250, "frame_number": 26727, "display_filter": "frame.number == 26727", "timestamp_epoch": "1533965033.481280000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6825abc9e0673670f46f8f0c", "type": "ipv4", "value": "52.72.198.167", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 179, "frame_number": 17349, "display_filter": "frame.number == 17349", "timestamp_epoch": "1533964956.315471000" }, { "udp_stream": 182, "frame_number": 17855, "display_filter": "frame.number == 17855", "timestamp_epoch": "1533964957.358759000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-9a8600c0534e79c7d4cb889d", "type": "ipv4", "value": "52.72.75.34", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 250, "frame_number": 26727, "display_filter": "frame.number == 26727", "timestamp_epoch": "1533965033.481280000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ad0271c2ae3178546f1f900c", "type": "ipv4", "value": "52.73.123.67", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 120, "frame_number": 23682, "display_filter": "frame.number == 23682", "timestamp_epoch": "1533964997.887170000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-12d2b8e3bfc757f0ebf2c04f", "type": "ipv4", "value": "52.73.148.73", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 179, "frame_number": 17349, "display_filter": "frame.number == 17349", "timestamp_epoch": "1533964956.315471000" }, { "udp_stream": 182, "frame_number": 17855, "display_filter": "frame.number == 17855", "timestamp_epoch": "1533964957.358759000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-45adaa7ffc9ba4809122db1e", "type": "ipv4", "value": "52.73.178.249", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 120, "frame_number": 23682, "display_filter": "frame.number == 23682", "timestamp_epoch": "1533964997.887170000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-03d0b5c174437987678f4c66", "type": "ipv4", "value": "52.73.182.32", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 120, "frame_number": 23682, "display_filter": "frame.number == 23682", "timestamp_epoch": "1533964997.887170000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d47f632f4e6d6e7084b0a5d3", "type": "ipv4", "value": "52.74.108.147", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 225, "frame_number": 23149, "display_filter": "frame.number == 23149", "timestamp_epoch": "1533964996.948203000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-16c743e1b3c8762adf5fc574", "type": "ipv4", "value": "52.8.138.67", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 154, "frame_number": 14640, "display_filter": "frame.number == 14640", "timestamp_epoch": "1533964904.663956000" }, { "udp_stream": 364, "frame_number": 46080, "display_filter": "frame.number == 46080", "timestamp_epoch": "1533965789.714227000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-bc41c4aa9cd8292826c487eb", "type": "ipv4", "value": "52.8.189.11", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 141, "frame_number": 13494, "display_filter": "frame.number == 13494", "timestamp_epoch": "1533964903.481649000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-52a9e8273e01a15f4b6f5f3b", "type": "ipv4", "value": "52.8.197.244", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 197, "frame_number": 19066, "display_filter": "frame.number == 19066", "timestamp_epoch": "1533964960.516077000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0ed2101b590220797b2dfa0a", "type": "ipv4", "value": "52.8.202.139", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 212, "frame_number": 20071, "display_filter": "frame.number == 20071", "timestamp_epoch": "1533964964.450971000" }, { "udp_stream": 242, "frame_number": 24228, "display_filter": "frame.number == 24228", "timestamp_epoch": "1533965001.681775000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4a16a7f8e366cf7fcbfda235", "type": "ipv4", "value": "52.8.226.99", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 274, "frame_number": 30691, "display_filter": "frame.number == 30691", "timestamp_epoch": "1533965099.093757000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-77a20e42bed45b0c4ccb4dda", "type": "ipv4", "value": "52.8.251.186", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 212, "frame_number": 20071, "display_filter": "frame.number == 20071", "timestamp_epoch": "1533964964.450971000" }, { "udp_stream": 242, "frame_number": 24228, "display_filter": "frame.number == 24228", "timestamp_epoch": "1533965001.681775000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c730c49e2116c225c1581f9d", "type": "ipv4", "value": "52.8.70.179", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 197, "frame_number": 19066, "display_filter": "frame.number == 19066", "timestamp_epoch": "1533964960.516077000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4b26c87b8ef8c9a15e6fd1dc", "type": "ipv4", "value": "52.86.196.91", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 205, "frame_number": 19619, "display_filter": "frame.number == 19619", "timestamp_epoch": "1533964962.605621000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-9bf25433c2ade97205beb57f", "type": "ipv4", "value": "52.87.104.142", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 205, "frame_number": 19619, "display_filter": "frame.number == 19619", "timestamp_epoch": "1533964962.605621000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-eda040ad72613546b905ffb9", "type": "ipv4", "value": "52.88.205.160", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 222, "frame_number": 23033, "display_filter": "frame.number == 23033", "timestamp_epoch": "1533964996.474799000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-487312f6ddfab4ffebd89f67", "type": "ipv4", "value": "52.88.9.91", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 181, "frame_number": 17890, "display_filter": "frame.number == 17890", "timestamp_epoch": "1533964957.470463000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5e23d0ac9437e8fe9aff5ed4", "type": "ipv4", "value": "52.89.134.163", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 222, "frame_number": 23033, "display_filter": "frame.number == 23033", "timestamp_epoch": "1533964996.474799000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-79e4f2b80091dbdf15515bb3", "type": "ipv4", "value": "52.89.90.109", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 98, "frame_number": 8958, "display_filter": "frame.number == 8958", "timestamp_epoch": "1533964898.930359000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7ce647c0aaa8463cbe717a22", "type": "ipv4", "value": "52.89.92.187", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 270, "frame_number": 27927, "display_filter": "frame.number == 27927", "timestamp_epoch": "1533965036.249006000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6902a05e5808d3a2ed0d4500", "type": "ipv4", "value": "52.9.0.53", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 197, "frame_number": 19066, "display_filter": "frame.number == 19066", "timestamp_epoch": "1533964960.516077000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8f52bf0d0416aa0c88333ce9", "type": "ipv4", "value": "52.9.113.206", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 154, "frame_number": 14640, "display_filter": "frame.number == 14640", "timestamp_epoch": "1533964904.663956000" }, { "udp_stream": 364, "frame_number": 46080, "display_filter": "frame.number == 46080", "timestamp_epoch": "1533965789.714227000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5381ef590d7c482a33b32bcf", "type": "ipv4", "value": "52.9.116.187", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 274, "frame_number": 30691, "display_filter": "frame.number == 30691", "timestamp_epoch": "1533965099.093757000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1fe060e34cb25f84f1c0e957", "type": "ipv4", "value": "52.9.158.123", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 217, "frame_number": 20227, "display_filter": "frame.number == 20227", "timestamp_epoch": "1533964965.012520000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a0f5bdba320a71a6b5513d0e", "type": "ipv4", "value": "52.9.185.0", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 212, "frame_number": 20071, "display_filter": "frame.number == 20071", "timestamp_epoch": "1533964964.450971000" }, { "udp_stream": 242, "frame_number": 24228, "display_filter": "frame.number == 24228", "timestamp_epoch": "1533965001.681775000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0883636a62e5ee974b0aa8a3", "type": "ipv4", "value": "52.9.204.110", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 197, "frame_number": 19066, "display_filter": "frame.number == 19066", "timestamp_epoch": "1533964960.516077000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ac063cd55bec8d3da0489802", "type": "ipv4", "value": "52.9.59.235", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 277, "frame_number": 30810, "display_filter": "frame.number == 30810", "timestamp_epoch": "1533965099.289135000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2ed05feff070e888f13fafc0", "type": "ipv4", "value": "52.9.74.88", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 197, "frame_number": 19066, "display_filter": "frame.number == 19066", "timestamp_epoch": "1533964960.516077000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f9dd193e0860d59fb15f6449", "type": "ipv4", "value": "52.9.78.114", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 154, "frame_number": 14640, "display_filter": "frame.number == 14640", "timestamp_epoch": "1533964904.663956000" }, { "udp_stream": 364, "frame_number": 46080, "display_filter": "frame.number == 46080", "timestamp_epoch": "1533965789.714227000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e022c14922369b9f683c4f97", "type": "ipv4", "value": "52.9.96.194", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 154, "frame_number": 14640, "display_filter": "frame.number == 14640", "timestamp_epoch": "1533964904.663956000" }, { "udp_stream": 364, "frame_number": 46080, "display_filter": "frame.number == 46080", "timestamp_epoch": "1533965789.714227000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6c6a66a6462d2c07a175e564", "type": "ipv4", "value": "52.94.232.32", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 101, "frame_number": 8957, "display_filter": "frame.number == 8957", "timestamp_epoch": "1533964898.930358000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-962d1d34b1f2f3215a934c85", "type": "ipv4", "value": "54.148.121.12", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 150, "frame_number": 14614, "display_filter": "frame.number == 14614", "timestamp_epoch": "1533964904.637907000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d6fdb704e5db078d62ad3ce8", "type": "ipv4", "value": "54.148.146.218", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 239, "frame_number": 24037, "display_filter": "frame.number == 24037", "timestamp_epoch": "1533964999.457617000" }, { "udp_stream": 264, "frame_number": 27522, "display_filter": "frame.number == 27522", "timestamp_epoch": "1533965035.690340000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-31863a77fc0432ae7d260c98", "type": "ipv4", "value": "54.149.127.255", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 264, "frame_number": 27522, "display_filter": "frame.number == 27522", "timestamp_epoch": "1533965035.690340000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-15dfe1372a688b8399428ac4", "type": "ipv4", "value": "54.149.176.112", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 222, "frame_number": 23033, "display_filter": "frame.number == 23033", "timestamp_epoch": "1533964996.474799000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b86dddff7e18fd7f1c827aab", "type": "ipv4", "value": "54.149.221.157", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 270, "frame_number": 27927, "display_filter": "frame.number == 27927", "timestamp_epoch": "1533965036.249006000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-9bc494675bc4337ed6f75366", "type": "ipv4", "value": "54.149.32.18", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 65, "frame_number": 5141, "display_filter": "frame.number == 5141", "timestamp_epoch": "1533964556.025527000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3b2af74d1b12f1a8c62ca573", "type": "ipv4", "value": "54.164.252.1", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 234, "frame_number": 23623, "display_filter": "frame.number == 23623", "timestamp_epoch": "1533964997.803829000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-29866ce56f613352d0a89e9c", "type": "ipv4", "value": "54.165.0.72", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 205, "frame_number": 19619, "display_filter": "frame.number == 19619", "timestamp_epoch": "1533964962.605621000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-25e31c3c39639a3080801ec0", "type": "ipv4", "value": "54.165.113.198", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 117, "frame_number": 11114, "display_filter": "frame.number == 11114", "timestamp_epoch": "1533964901.056360000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b4064bfc9be0fd4141bd2f5b", "type": "ipv4", "value": "54.165.9.33", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 300, "frame_number": 33970, "display_filter": "frame.number == 33970", "timestamp_epoch": "1533965157.910445000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ab59f8d211f3c137d7f38f86", "type": "ipv4", "value": "54.173.10.244", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 259, "frame_number": 27332, "display_filter": "frame.number == 27332", "timestamp_epoch": "1533965035.434545000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a20651b716d3ae849646f751", "type": "ipv4", "value": "54.173.104.93", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 266, "frame_number": 27558, "display_filter": "frame.number == 27558", "timestamp_epoch": "1533965035.720501000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-306348588e7088547999a648", "type": "ipv4", "value": "54.175.110.202", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 117, "frame_number": 11114, "display_filter": "frame.number == 11114", "timestamp_epoch": "1533964901.056360000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-fa86216648ea6941656ca452", "type": "ipv4", "value": "54.175.140.118", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 179, "frame_number": 17349, "display_filter": "frame.number == 17349", "timestamp_epoch": "1533964956.315471000" }, { "udp_stream": 182, "frame_number": 17855, "display_filter": "frame.number == 17855", "timestamp_epoch": "1533964957.358759000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-34e2ffc35f5dd8e531fe7111", "type": "ipv4", "value": "54.175.180.42", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 280, "frame_number": 31704, "display_filter": "frame.number == 31704", "timestamp_epoch": "1533965100.817951000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a95d058df01cf746c4bef8cc", "type": "ipv4", "value": "54.176.157.57", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 129, "frame_number": 12104, "display_filter": "frame.number == 12104", "timestamp_epoch": "1533964901.906766000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0ad9f9ee2503fdcc8f9b123c", "type": "ipv4", "value": "54.176.31.176", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 129, "frame_number": 12104, "display_filter": "frame.number == 12104", "timestamp_epoch": "1533964901.906766000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c0c1e11f86192c40abf26583", "type": "ipv4", "value": "54.177.34.72", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 217, "frame_number": 20227, "display_filter": "frame.number == 20227", "timestamp_epoch": "1533964965.012520000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-57bf02508a34ddfebbbc2039", "type": "ipv4", "value": "54.183.102.11", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 217, "frame_number": 20227, "display_filter": "frame.number == 20227", "timestamp_epoch": "1533964965.012520000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f3803fa853964e7ee69e8b42", "type": "ipv4", "value": "54.183.154.61", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 217, "frame_number": 20227, "display_filter": "frame.number == 20227", "timestamp_epoch": "1533964965.012520000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8d467e0c251cffee161ab947", "type": "ipv4", "value": "54.183.210.45", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 197, "frame_number": 19066, "display_filter": "frame.number == 19066", "timestamp_epoch": "1533964960.516077000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b42161c14dce378dedd88031", "type": "ipv4", "value": "54.183.248.197", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 217, "frame_number": 20227, "display_filter": "frame.number == 20227", "timestamp_epoch": "1533964965.012520000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-673a24154812fe5a92a0c479", "type": "ipv4", "value": "54.183.95.126", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 102, "frame_number": 8976, "display_filter": "frame.number == 8976", "timestamp_epoch": "1533964898.938935000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0f177f23f5644e02f25d0322", "type": "ipv4", "value": "54.186.116.83", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 65, "frame_number": 5141, "display_filter": "frame.number == 5141", "timestamp_epoch": "1533964556.025527000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1846c7d36cf4fd3d5ffcf397", "type": "ipv4", "value": "54.186.237.130", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 156, "frame_number": 14613, "display_filter": "frame.number == 14613", "timestamp_epoch": "1533964904.637787000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6f8def799300ed5c9422aaf0", "type": "ipv4", "value": "54.187.102.150", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 150, "frame_number": 14614, "display_filter": "frame.number == 14614", "timestamp_epoch": "1533964904.637907000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4225f6dfcb070aea3e9e8902", "type": "ipv4", "value": "54.187.167.76", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 270, "frame_number": 27927, "display_filter": "frame.number == 27927", "timestamp_epoch": "1533965036.249006000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-658dad5c2ca448ebe56e13f9", "type": "ipv4", "value": "54.187.181.128", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 65, "frame_number": 5141, "display_filter": "frame.number == 5141", "timestamp_epoch": "1533964556.025527000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4a430282c79fff2129fcf5f8", "type": "ipv4", "value": "54.187.200.180", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 264, "frame_number": 27522, "display_filter": "frame.number == 27522", "timestamp_epoch": "1533965035.690340000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b8c0640106033639aaff4ef9", "type": "ipv4", "value": "54.187.213.9", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 264, "frame_number": 27522, "display_filter": "frame.number == 27522", "timestamp_epoch": "1533965035.690340000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-588bc75bdfcf0961d9f9f9e1", "type": "ipv4", "value": "54.187.42.255", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 264, "frame_number": 27522, "display_filter": "frame.number == 27522", "timestamp_epoch": "1533965035.690340000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-39812596beceb9a26a2d4c94", "type": "ipv4", "value": "54.191.120.89", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 252, "frame_number": 26736, "display_filter": "frame.number == 26736", "timestamp_epoch": "1533965033.496493000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7e07f4566979d055956317cf", "type": "ipv4", "value": "54.191.20.146", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 215, "frame_number": 20229, "display_filter": "frame.number == 20229", "timestamp_epoch": "1533964965.012616000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-94fbfb4d70c535df5dc622ff", "type": "ipv4", "value": "54.191.223.36", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 239, "frame_number": 24037, "display_filter": "frame.number == 24037", "timestamp_epoch": "1533964999.457617000" }, { "udp_stream": 264, "frame_number": 27522, "display_filter": "frame.number == 27522", "timestamp_epoch": "1533965035.690340000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2e4bf9a1861b41196a61fecc", "type": "ipv4", "value": "54.191.224.161", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 252, "frame_number": 26736, "display_filter": "frame.number == 26736", "timestamp_epoch": "1533965033.496493000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-72d0da305d189bbaa1e9ae61", "type": "ipv4", "value": "54.191.4.242", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 150, "frame_number": 14614, "display_filter": "frame.number == 14614", "timestamp_epoch": "1533964904.637907000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d87c85880e289b3efb5ee611", "type": "ipv4", "value": "54.193.113.6", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 262, "frame_number": 27340, "display_filter": "frame.number == 27340", "timestamp_epoch": "1533965035.445360000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2aedebdf1b37bf03c2cdfdc0", "type": "ipv4", "value": "54.193.14.224", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 102, "frame_number": 8976, "display_filter": "frame.number == 8976", "timestamp_epoch": "1533964898.938935000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4b916056fa3832bb4db10943", "type": "ipv4", "value": "54.193.27.242", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 102, "frame_number": 8976, "display_filter": "frame.number == 8976", "timestamp_epoch": "1533964898.938935000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2177029723f55999a429709e", "type": "ipv4", "value": "54.193.79.237", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 197, "frame_number": 19066, "display_filter": "frame.number == 19066", "timestamp_epoch": "1533964960.516077000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-702dff3b73afae166dc2027c", "type": "ipv4", "value": "54.193.88.44", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 262, "frame_number": 27340, "display_filter": "frame.number == 27340", "timestamp_epoch": "1533965035.445360000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0ca8c2c8b5498c76535b793e", "type": "ipv4", "value": "54.196.242.147", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 233, "frame_number": 23633, "display_filter": "frame.number == 23633", "timestamp_epoch": "1533964997.811829000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-26b3c98aae9f123888131e56", "type": "ipv4", "value": "54.200.173.146", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 244, "frame_number": 26411, "display_filter": "frame.number == 26411", "timestamp_epoch": "1533965032.677118000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3ba29849927cc86da42f867e", "type": "ipv4", "value": "54.200.4.214", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 239, "frame_number": 24037, "display_filter": "frame.number == 24037", "timestamp_epoch": "1533964999.457617000" }, { "udp_stream": 264, "frame_number": 27522, "display_filter": "frame.number == 27522", "timestamp_epoch": "1533965035.690340000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0ffcf54c08f7d0c796c4a86b", "type": "ipv4", "value": "54.201.23.177", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 222, "frame_number": 23033, "display_filter": "frame.number == 23033", "timestamp_epoch": "1533964996.474799000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-bfd22d9682a55f792ea7a826", "type": "ipv4", "value": "54.203.249.16", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 162, "frame_number": 15556, "display_filter": "frame.number == 15556", "timestamp_epoch": "1533964906.746311000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-dd6177e43cee8d02103bacd5", "type": "ipv4", "value": "54.209.142.208", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 207, "frame_number": 19702, "display_filter": "frame.number == 19702", "timestamp_epoch": "1533964962.896098000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-82decfe34a787d49c7f5c3d8", "type": "ipv4", "value": "54.209.175.132", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 250, "frame_number": 26727, "display_filter": "frame.number == 26727", "timestamp_epoch": "1533965033.481280000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-481cb7b46c2e99ad7eae95d5", "type": "ipv4", "value": "54.209.175.196", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 179, "frame_number": 17349, "display_filter": "frame.number == 17349", "timestamp_epoch": "1533964956.315471000" }, { "udp_stream": 182, "frame_number": 17855, "display_filter": "frame.number == 17855", "timestamp_epoch": "1533964957.358759000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d9b30efc9a481859c50ac5f8", "type": "ipv4", "value": "54.209.46.223", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 207, "frame_number": 19702, "display_filter": "frame.number == 19702", "timestamp_epoch": "1533964962.896098000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-702aef77e04cd424e9e68c7e", "type": "ipv4", "value": "54.209.71.223", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 112, "frame_number": 10606, "display_filter": "frame.number == 10606", "timestamp_epoch": "1533964900.584234000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c0e45c50fbc6d6b6c136578c", "type": "ipv4", "value": "54.210.242.59", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 207, "frame_number": 19702, "display_filter": "frame.number == 19702", "timestamp_epoch": "1533964962.896098000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-bc973b86063f9d97408fc03a", "type": "ipv4", "value": "54.210.250.119", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 280, "frame_number": 31704, "display_filter": "frame.number == 31704", "timestamp_epoch": "1533965100.817951000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-76988637353c474e7387b2bd", "type": "ipv4", "value": "54.210.58.162", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 190, "frame_number": 18568, "display_filter": "frame.number == 18568", "timestamp_epoch": "1533964959.365164000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e44edde17c00b00fd906f19f", "type": "ipv4", "value": "54.214.11.239", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 162, "frame_number": 15556, "display_filter": "frame.number == 15556", "timestamp_epoch": "1533964906.746311000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-00a2aa2a9c4679140ddb26d9", "type": "ipv4", "value": "54.214.247.4", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 162, "frame_number": 15556, "display_filter": "frame.number == 15556", "timestamp_epoch": "1533964906.746311000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3b88e9c369fbb6b96b9fcab6", "type": "ipv4", "value": "54.214.30.198", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 162, "frame_number": 15556, "display_filter": "frame.number == 15556", "timestamp_epoch": "1533964906.746311000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ec32f74d0f46743769015cc3", "type": "ipv4", "value": "54.215.177.163", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 102, "frame_number": 8976, "display_filter": "frame.number == 8976", "timestamp_epoch": "1533964898.938935000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e99e186af81eb062c86e3414", "type": "ipv4", "value": "54.215.190.205", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 102, "frame_number": 8976, "display_filter": "frame.number == 8976", "timestamp_epoch": "1533964898.938935000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-9cdadca08a9f3b20f4601eaf", "type": "ipv4", "value": "54.217.209.217", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 285, "frame_number": 31674, "display_filter": "frame.number == 31674", "timestamp_epoch": "1533965100.796522000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3f2cdcb984f12b5566780801", "type": "ipv4", "value": "54.217.217.143", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 285, "frame_number": 31674, "display_filter": "frame.number == 31674", "timestamp_epoch": "1533965100.796522000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-35e40db894ac3706b8a4c133", "type": "ipv4", "value": "54.217.228.98", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 285, "frame_number": 31674, "display_filter": "frame.number == 31674", "timestamp_epoch": "1533965100.796522000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-efa14573be4441a47ee7b727", "type": "ipv4", "value": "54.217.236.197", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 285, "frame_number": 31674, "display_filter": "frame.number == 31674", "timestamp_epoch": "1533965100.796522000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-600dc3a1cce721f9c374b84c", "type": "ipv4", "value": "54.228.184.13", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 285, "frame_number": 31674, "display_filter": "frame.number == 31674", "timestamp_epoch": "1533965100.796522000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0ef2937cbd07ece3edd64d28", "type": "ipv4", "value": "54.228.212.156", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 285, "frame_number": 31674, "display_filter": "frame.number == 31674", "timestamp_epoch": "1533965100.796522000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e75b6f24cee18addd3227c06", "type": "ipv4", "value": "54.236.143.74", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 240, "frame_number": 24040, "display_filter": "frame.number == 24040", "timestamp_epoch": "1533964999.467395000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-74870aa007904c720c6826ac", "type": "ipv4", "value": "54.236.168.144", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 205, "frame_number": 19619, "display_filter": "frame.number == 19619", "timestamp_epoch": "1533964962.605621000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-811d336be6c56477bff29e18", "type": "ipv4", "value": "54.236.177.89", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 250, "frame_number": 26727, "display_filter": "frame.number == 26727", "timestamp_epoch": "1533965033.481280000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7114b0821292e2887952dd73", "type": "ipv4", "value": "54.236.222.119", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 266, "frame_number": 27558, "display_filter": "frame.number == 27558", "timestamp_epoch": "1533965035.720501000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1d62a34407800397a39cdf83", "type": "ipv4", "value": "54.241.143.220", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 102, "frame_number": 8976, "display_filter": "frame.number == 8976", "timestamp_epoch": "1533964898.938935000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8d33d7204ac38bd8e38d2097", "type": "ipv4", "value": "54.241.145.51", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 102, "frame_number": 8976, "display_filter": "frame.number == 8976", "timestamp_epoch": "1533964898.938935000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-727d514e278bf2b815072736", "type": "ipv4", "value": "54.241.184.236", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 262, "frame_number": 27340, "display_filter": "frame.number == 27340", "timestamp_epoch": "1533965035.445360000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-11542b87bbadaaa0e07a7ab6", "type": "ipv4", "value": "54.241.31.242", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 260, "frame_number": 27324, "display_filter": "frame.number == 27324", "timestamp_epoch": "1533965035.406855000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3707e64197e83c9452e2ff0e", "type": "ipv4", "value": "54.244.243.41", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 162, "frame_number": 15556, "display_filter": "frame.number == 15556", "timestamp_epoch": "1533964906.746311000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0b4a4e0b808b6cb7bab0573a", "type": "ipv4", "value": "54.244.245.107", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 162, "frame_number": 15556, "display_filter": "frame.number == 15556", "timestamp_epoch": "1533964906.746311000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f0b66162802a0121efe85a7e", "type": "ipv4", "value": "54.246.133.167", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 173, "frame_number": 16524, "display_filter": "frame.number == 16524", "timestamp_epoch": "1533964909.718959000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-98c8096a8f84e88d2c73e128", "type": "ipv4", "value": "54.64.58.164", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 304, "frame_number": 35517, "display_filter": "frame.number == 35517", "timestamp_epoch": "1533965160.353225000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-271ededa53b2794e47edaf27", "type": "ipv4", "value": "54.64.66.233", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 304, "frame_number": 35517, "display_filter": "frame.number == 35517", "timestamp_epoch": "1533965160.353225000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-36109b85b666b3549a53de30", "type": "ipv4", "value": "54.65.114.208", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 304, "frame_number": 35517, "display_filter": "frame.number == 35517", "timestamp_epoch": "1533965160.353225000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d94d286b0dc0c8516459b37b", "type": "ipv4", "value": "54.67.106.41", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 277, "frame_number": 30810, "display_filter": "frame.number == 30810", "timestamp_epoch": "1533965099.289135000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c1bdfc07ed284c17727b90f3", "type": "ipv4", "value": "54.68.131.249", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 65, "frame_number": 5141, "display_filter": "frame.number == 5141", "timestamp_epoch": "1533964556.025527000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-bf67beaa8651ac2d2f40783c", "type": "ipv4", "value": "54.68.251.4", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 270, "frame_number": 27927, "display_filter": "frame.number == 27927", "timestamp_epoch": "1533965036.249006000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4f0079a4aeeb42d858c9e556", "type": "ipv4", "value": "54.68.83.10", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 65, "frame_number": 5141, "display_filter": "frame.number == 5141", "timestamp_epoch": "1533964556.025527000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8cb25072bbba4051d6398dc6", "type": "ipv4", "value": "54.68.84.37", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 65, "frame_number": 5141, "display_filter": "frame.number == 5141", "timestamp_epoch": "1533964556.025527000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-52e47c41fda0d201e54ca92e", "type": "ipv4", "value": "54.68.91.165", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 145, "frame_number": 13562, "display_filter": "frame.number == 13562", "timestamp_epoch": "1533964903.558314000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-da64b37d3213bff2b68b5579", "type": "ipv4", "value": "54.69.174.218", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 231, "frame_number": 23599, "display_filter": "frame.number == 23599", "timestamp_epoch": "1533964997.757167000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f61857651693821df0111dda", "type": "ipv4", "value": "54.69.219.111", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 239, "frame_number": 24037, "display_filter": "frame.number == 24037", "timestamp_epoch": "1533964999.457617000" }, { "udp_stream": 264, "frame_number": 27522, "display_filter": "frame.number == 27522", "timestamp_epoch": "1533965035.690340000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-752736fb55b883341c899a6b", "type": "ipv4", "value": "54.69.22.79", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 239, "frame_number": 24037, "display_filter": "frame.number == 24037", "timestamp_epoch": "1533964999.457617000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ae15c8c0e383a590a2bd28e5", "type": "ipv4", "value": "54.69.25.207", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 270, "frame_number": 27927, "display_filter": "frame.number == 27927", "timestamp_epoch": "1533965036.249006000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-fec070af895fe97c7370e6f1", "type": "ipv4", "value": "54.69.70.7", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 98, "frame_number": 8958, "display_filter": "frame.number == 8958", "timestamp_epoch": "1533964898.930359000" }, { "udp_stream": 231, "frame_number": 23599, "display_filter": "frame.number == 23599", "timestamp_epoch": "1533964997.757167000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3a30d195a01588057c7446ec", "type": "ipv4", "value": "54.69.93.253", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 98, "frame_number": 8958, "display_filter": "frame.number == 8958", "timestamp_epoch": "1533964898.930359000" }, { "udp_stream": 231, "frame_number": 23599, "display_filter": "frame.number == 23599", "timestamp_epoch": "1533964997.757167000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3f5725cdf349251b4c962676", "type": "ipv4", "value": "54.70.199.124", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 145, "frame_number": 13562, "display_filter": "frame.number == 13562", "timestamp_epoch": "1533964903.558314000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-18a39b8a1e8a5d78d39d5289", "type": "ipv4", "value": "54.71.113.104", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 98, "frame_number": 8958, "display_filter": "frame.number == 8958", "timestamp_epoch": "1533964898.930359000" }, { "udp_stream": 231, "frame_number": 23599, "display_filter": "frame.number == 23599", "timestamp_epoch": "1533964997.757167000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-854d48a11e2f0fd192f48eca", "type": "ipv4", "value": "54.82.13.247", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 273, "frame_number": 30652, "display_filter": "frame.number == 30652", "timestamp_epoch": "1533965099.045919000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1b76a1f0f40604c73d394033", "type": "ipv4", "value": "54.84.105.44", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 240, "frame_number": 24040, "display_filter": "frame.number == 24040", "timestamp_epoch": "1533964999.467395000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-cc7b81e9fc19ce348c097b8e", "type": "ipv4", "value": "54.84.37.167", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 190, "frame_number": 18568, "display_filter": "frame.number == 18568", "timestamp_epoch": "1533964959.365164000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4cfa1172775acd1c34d66865", "type": "ipv4", "value": "54.92.93.205", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 304, "frame_number": 35517, "display_filter": "frame.number == 35517", "timestamp_epoch": "1533965160.353225000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3bcd568fe9b5ae7182a7cf78", "type": "ipv4", "value": "63.251.109.87", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 295, "frame_number": 32962, "display_filter": "frame.number == 32962", "timestamp_epoch": "1533965136.678702000" }, { "udp_stream": 297, "frame_number": 33093, "display_filter": "frame.number == 33093", "timestamp_epoch": "1533965137.114452000" }, { "udp_stream": 298, "frame_number": 33377, "display_filter": "frame.number == 33377", "timestamp_epoch": "1533965137.904526000" }, { "udp_stream": 307, "frame_number": 38809, "display_filter": "frame.number == 38809", "timestamp_epoch": "1533965240.205005000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0a099613f76588b890f09ff9", "type": "ipv4", "value": "63.251.252.12", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 216, "frame_number": 20234, "display_filter": "frame.number == 20234", "timestamp_epoch": "1533964965.013702000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6fcd67125f3051f8a2b9a785", "type": "ipv4", "value": "63.251.253.231", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 282, "frame_number": 31833, "display_filter": "frame.number == 31833", "timestamp_epoch": "1533965100.973117000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d8866312a684198ef76baa60", "type": "ipv4", "value": "63.251.253.232", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 282, "frame_number": 31833, "display_filter": "frame.number == 31833", "timestamp_epoch": "1533965100.973117000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-57abb6e8ec4642e39878b394", "type": "ipv4", "value": "63.251.95.2", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 142, "frame_number": 13537, "display_filter": "frame.number == 13537", "timestamp_epoch": "1533964903.535108000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ccba202c16c5f14b2f1e5816", "type": "ipv4", "value": "63.251.95.3", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 142, "frame_number": 13537, "display_filter": "frame.number == 13537", "timestamp_epoch": "1533964903.535108000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-39350972ea69ce4d81fb8891", "type": "ipv4", "value": "63.251.95.4", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 142, "frame_number": 13537, "display_filter": "frame.number == 13537", "timestamp_epoch": "1533964903.535108000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6b35643c27a83f5e670d00bc", "type": "ipv4", "value": "64.125.223.109", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 288, "frame_number": 32219, "display_filter": "frame.number == 32219", "timestamp_epoch": "1533965102.184319000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5d8d21d22a05e9a0f15c8ff4", "type": "ipv4", "value": "64.233.161.120", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 151, "frame_number": 14626, "display_filter": "frame.number == 14626", "timestamp_epoch": "1533964904.641770000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-edae78360d2be19f029260f9", "type": "ipv4", "value": "64.233.161.94", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 151, "frame_number": 14626, "display_filter": "frame.number == 14626", "timestamp_epoch": "1533964904.641770000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b2e2c1287bbbfb50bcf1e3b3", "type": "ipv4", "value": "64.233.171.120", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 151, "frame_number": 14626, "display_filter": "frame.number == 14626", "timestamp_epoch": "1533964904.641770000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7e8b9352c862f7bcb123e460", "type": "ipv4", "value": "64.233.171.94", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 151, "frame_number": 14626, "display_filter": "frame.number == 14626", "timestamp_epoch": "1533964904.641770000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b28e3c83bd87e207501c9b19", "type": "ipv4", "value": "64.233.184.120", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 151, "frame_number": 14626, "display_filter": "frame.number == 14626", "timestamp_epoch": "1533964904.641770000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f1064ed1a69598839a2ca0df", "type": "ipv4", "value": "64.233.184.94", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 151, "frame_number": 14626, "display_filter": "frame.number == 14626", "timestamp_epoch": "1533964904.641770000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c0d27db1a0877b9380b89947", "type": "ipv4", "value": "64.38.119.27", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 275, "frame_number": 30649, "display_filter": "frame.number == 30649", "timestamp_epoch": "1533965099.045804000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6b11426fca27e8a67ddd5f41", "type": "ipv4", "value": "64.41.197.55", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 135, "frame_number": 12799, "display_filter": "frame.number == 12799", "timestamp_epoch": "1533964902.763199000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-470aee9fc573ff1fe369e140", "type": "ipv4", "value": "64.41.197.60", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 135, "frame_number": 12799, "display_filter": "frame.number == 12799", "timestamp_epoch": "1533964902.763199000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-49b77e0e18b015741218dd73", "type": "ipv4", "value": "64.7.200.2", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 142, "frame_number": 13537, "display_filter": "frame.number == 13537", "timestamp_epoch": "1533964903.535108000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-01efa668bd26c00640bbc8d9", "type": "ipv4", "value": "64.7.200.3", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 142, "frame_number": 13537, "display_filter": "frame.number == 13537", "timestamp_epoch": "1533964903.535108000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-9a0a5eb8264730f0ca59f104", "type": "ipv4", "value": "64.7.200.4", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 142, "frame_number": 13537, "display_filter": "frame.number == 13537", "timestamp_epoch": "1533964903.535108000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3c9bcb03db1dbf2848bbe936", "type": "ipv4", "value": "64.7.200.5", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 142, "frame_number": 13537, "display_filter": "frame.number == 13537", "timestamp_epoch": "1533964903.535108000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-71e2ebbb332abcdf14bf148b", "type": "ipv4", "value": "64.7.201.2", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 142, "frame_number": 13537, "display_filter": "frame.number == 13537", "timestamp_epoch": "1533964903.535108000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c2e84bfeaa8465437332ebc3", "type": "ipv4", "value": "64.7.201.3", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 142, "frame_number": 13537, "display_filter": "frame.number == 13537", "timestamp_epoch": "1533964903.535108000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-17bfaf935f64e5fbe665afa0", "type": "ipv4", "value": "64.7.201.4", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 142, "frame_number": 13537, "display_filter": "frame.number == 13537", "timestamp_epoch": "1533964903.535108000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-57070dfc7d2e629dca557f3f", "type": "ipv4", "value": "64.7.201.5", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 142, "frame_number": 13537, "display_filter": "frame.number == 13537", "timestamp_epoch": "1533964903.535108000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-775083b89577e0a4aa974e78", "type": "ipv4", "value": "64.7.205.2", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 142, "frame_number": 13537, "display_filter": "frame.number == 13537", "timestamp_epoch": "1533964903.535108000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-cd2da6469743ebdeea4fa4dd", "type": "ipv4", "value": "67.195.229.45", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 81, "frame_number": 6113, "display_filter": "frame.number == 6113", "timestamp_epoch": "1533964559.840586000" }, { "udp_stream": 85, "frame_number": 6273, "display_filter": "frame.number == 6273", "timestamp_epoch": "1533964560.304978000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7068cfeb333bd65da1b22a0c", "type": "ipv4", "value": "69.168.106.81", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 219, "frame_number": 20551, "display_filter": "frame.number == 20551", "timestamp_epoch": "1533964965.682355000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f4c102db0976aed41e44ef09", "type": "ipv4", "value": "69.174.248.224", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 228, "frame_number": 23321, "display_filter": "frame.number == 23321", "timestamp_epoch": "1533964997.328339000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f999d5bc317fa9b8c1f96ebb", "type": "ipv4", "value": "69.174.248.228", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 77, "frame_number": 5866, "display_filter": "frame.number == 5866", "timestamp_epoch": "1533964559.464580000" }, { "udp_stream": 80, "frame_number": 6137, "display_filter": "frame.number == 6137", "timestamp_epoch": "1533964559.872487000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-74f879bff1c4d911a68379d0", "type": "ipv4", "value": "69.194.244.11", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 62, "frame_number": 5145, "display_filter": "frame.number == 5145", "timestamp_epoch": "1533964556.026779000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2c670dcfc0aa8037853ad80c", "type": "ipv4", "value": "70.42.132.5", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 281, "frame_number": 31703, "display_filter": "frame.number == 31703", "timestamp_epoch": "1533965100.814252000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5f5a3f6ad056427a4962d51b", "type": "ipv4", "value": "72.21.81.200", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 86, "frame_number": 6513, "display_filter": "frame.number == 6513", "timestamp_epoch": "1533964574.365861000" }, { "udp_stream": 366, "frame_number": 46919, "display_filter": "frame.number == 46919", "timestamp_epoch": "1533965798.750795000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2015ff731618f98609ef5b64", "type": "ipv4", "value": "72.21.91.113", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 204, "frame_number": 19335, "display_filter": "frame.number == 19335", "timestamp_epoch": "1533964961.815071000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f91ed4cef3562179f8f28f67", "type": "ipv4", "value": "72.5.64.63", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 253, "frame_number": 26821, "display_filter": "frame.number == 26821", "timestamp_epoch": "1533965033.693499000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-977962eadce3483aefb46cca", "type": "ipv4", "value": "74.119.117.100", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 338, "frame_number": 43659, "display_filter": "frame.number == 43659", "timestamp_epoch": "1533965783.084459000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e90165ced29ebd8a28917130", "type": "ipv4", "value": "74.119.117.129", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 161, "frame_number": 15402, "display_filter": "frame.number == 15402", "timestamp_epoch": "1533964906.564513000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-503bc9b0064e5ec900b14608", "type": "ipv4", "value": "74.119.117.70", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 143, "frame_number": 13517, "display_filter": "frame.number == 13517", "timestamp_epoch": "1533964903.515128000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2782a69ec685fa5e0f316f95", "type": "ipv4", "value": "74.119.117.94", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 167, "frame_number": 15991, "display_filter": "frame.number == 15991", "timestamp_epoch": "1533964908.383676000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-9fa1127a0b17628d20f8923f", "type": "ipv4", "value": "74.121.136.131", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 61, "frame_number": 5120, "display_filter": "frame.number == 5120", "timestamp_epoch": "1533964555.984165000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-63212db3891673008f57406b", "type": "ipv4", "value": "74.125.126.120", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 151, "frame_number": 14626, "display_filter": "frame.number == 14626", "timestamp_epoch": "1533964904.641770000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-013b786627fb3c5bfdb18a74", "type": "ipv4", "value": "74.125.126.94", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 151, "frame_number": 14626, "display_filter": "frame.number == 14626", "timestamp_epoch": "1533964904.641770000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a9cac9058dcd5fed3c4fb945", "type": "ipv4", "value": "74.125.195.154", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 57, "frame_number": 4326, "display_filter": "frame.number == 4326", "timestamp_epoch": "1533964554.232211000" }, { "udp_stream": 289, "frame_number": 32653, "display_filter": "frame.number == 32653", "timestamp_epoch": "1533965134.234653000" }, { "udp_stream": 355, "frame_number": 45074, "display_filter": "frame.number == 45074", "timestamp_epoch": "1533965786.808030000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-73df03384a9a4780cd485eee", "type": "ipv4", "value": "74.125.195.155", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 57, "frame_number": 4326, "display_filter": "frame.number == 4326", "timestamp_epoch": "1533964554.232211000" }, { "udp_stream": 289, "frame_number": 32653, "display_filter": "frame.number == 32653", "timestamp_epoch": "1533965134.234653000" }, { "udp_stream": 355, "frame_number": 45074, "display_filter": "frame.number == 45074", "timestamp_epoch": "1533965786.808030000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1fe148a3aa09bc651c8a666e", "type": "ipv4", "value": "74.125.195.156", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 57, "frame_number": 4326, "display_filter": "frame.number == 4326", "timestamp_epoch": "1533964554.232211000" }, { "udp_stream": 289, "frame_number": 32653, "display_filter": "frame.number == 32653", "timestamp_epoch": "1533965134.234653000" }, { "udp_stream": 355, "frame_number": 45074, "display_filter": "frame.number == 45074", "timestamp_epoch": "1533965786.808030000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ec083a1bbc668d0296ab1a54", "type": "ipv4", "value": "74.125.195.157", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 57, "frame_number": 4326, "display_filter": "frame.number == 4326", "timestamp_epoch": "1533964554.232211000" }, { "udp_stream": 289, "frame_number": 32653, "display_filter": "frame.number == 32653", "timestamp_epoch": "1533965134.234653000" }, { "udp_stream": 355, "frame_number": 45074, "display_filter": "frame.number == 45074", "timestamp_epoch": "1533965786.808030000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-fa58b1db6b21751df6dec6f7", "type": "ipv4", "value": "74.125.200.120", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 151, "frame_number": 14626, "display_filter": "frame.number == 14626", "timestamp_epoch": "1533964904.641770000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-356f70f0ac544bf156dc62a8", "type": "ipv4", "value": "74.125.200.94", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 151, "frame_number": 14626, "display_filter": "frame.number == 14626", "timestamp_epoch": "1533964904.641770000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-cd9b749be1762153677779c4", "type": "ipv4", "value": "74.125.23.120", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 151, "frame_number": 14626, "display_filter": "frame.number == 14626", "timestamp_epoch": "1533964904.641770000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-fdb2408a3655a79d8eeece3f", "type": "ipv4", "value": "74.125.23.94", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 151, "frame_number": 14626, "display_filter": "frame.number == 14626", "timestamp_epoch": "1533964904.641770000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-60dda77a9eff23c4f2732415", "type": "ipv4", "value": "74.125.28.120", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 151, "frame_number": 14626, "display_filter": "frame.number == 14626", "timestamp_epoch": "1533964904.641770000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1e9e131d8aab0cbd9cd804b1", "type": "ipv4", "value": "74.125.28.94", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 151, "frame_number": 14626, "display_filter": "frame.number == 14626", "timestamp_epoch": "1533964904.641770000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f21f67b77af244feb066130d", "type": "ipv4", "value": "74.214.196.133", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 144, "frame_number": 13593, "display_filter": "frame.number == 13593", "timestamp_epoch": "1533964903.573032000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4822415353743f64abee4b0b", "type": "ipv4", "value": "74.214.196.134", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 144, "frame_number": 13593, "display_filter": "frame.number == 13593", "timestamp_epoch": "1533964903.573032000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-cb9a7b5315595eee242f997e", "type": "ipv4", "value": "74.217.250.126", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 278, "frame_number": 30782, "display_filter": "frame.number == 30782", "timestamp_epoch": "1533965099.269249000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-adb94aae525ba243831ca0e4", "type": "ipv4", "value": "74.6.34.27", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 64, "frame_number": 5121, "display_filter": "frame.number == 5121", "timestamp_epoch": "1533964555.984478000" }, { "udp_stream": 363, "frame_number": 46038, "display_filter": "frame.number == 46038", "timestamp_epoch": "1533965789.567878000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-baa1ac3d771d33f876e2c065", "type": "ipv4", "value": "77.88.21.119", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 52, "frame_number": 3310, "display_filter": "frame.number == 3310", "timestamp_epoch": "1533964552.683616000" }, { "udp_stream": 344, "frame_number": 43729, "display_filter": "frame.number == 43729", "timestamp_epoch": "1533965783.276443000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-128824625206f8b46095a377", "type": "ipv4", "value": "77.88.21.38", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 88, "frame_number": 7089, "display_filter": "frame.number == 7089", "timestamp_epoch": "1533964677.421170000" }, { "udp_stream": 319, "frame_number": 39904, "display_filter": "frame.number == 39904", "timestamp_epoch": "1533965605.965885000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d9cfaf09ac939c262dd4f5ac", "type": "ipv4", "value": "77.88.21.90", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 44, "frame_number": 3197, "display_filter": "frame.number == 3197", "timestamp_epoch": "1533964552.405569000" }, { "udp_stream": 337, "frame_number": 43651, "display_filter": "frame.number == 43651", "timestamp_epoch": "1533965783.060399000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8b362f38418bb924b1ca6f55", "type": "ipv4", "value": "8.247.90.250", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 107, "frame_number": 9794, "display_filter": "frame.number == 9794", "timestamp_epoch": "1533964899.640925000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-61396f391c29efe596973a1b", "type": "ipv4", "value": "8.39.36.142", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 175, "frame_number": 16602, "display_filter": "frame.number == 16602", "timestamp_epoch": "1533964910.201908000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1d032869ee18836dfa74749a", "type": "ipv4", "value": "8.39.36.143", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 175, "frame_number": 16602, "display_filter": "frame.number == 16602", "timestamp_epoch": "1533964910.201908000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-cf137e388fe78b75c56e873a", "type": "ipv4", "value": "8.39.36.144", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 158, "frame_number": 14749, "display_filter": "frame.number == 14749", "timestamp_epoch": "1533964904.736366000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-52782c45b52436b2f208ea77", "type": "ipv4", "value": "8.39.36.145", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 158, "frame_number": 14749, "display_filter": "frame.number == 14749", "timestamp_epoch": "1533964904.736366000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3a01de346cb79cfe14cc28f1", "type": "ipv4", "value": "8.39.36.172", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 174, "frame_number": 16558, "display_filter": "frame.number == 16558", "timestamp_epoch": "1533964910.093175000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-60c4872b89e9b3f83c1eb6fd", "type": "ipv4", "value": "8.39.36.173", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 174, "frame_number": 16558, "display_filter": "frame.number == 16558", "timestamp_epoch": "1533964910.093175000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-79fae6b71a41dfce4bd8d228", "type": "ipv4", "value": "8.41.222.241", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 186, "frame_number": 18183, "display_filter": "frame.number == 18183", "timestamp_epoch": "1533964958.434721000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c57fa17cde42bd21d4c76b73", "type": "ipv4", "value": "85.114.159.118", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 301, "frame_number": 35520, "display_filter": "frame.number == 35520", "timestamp_epoch": "1533965160.354275000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6b096a4639118c048df4c3ae", "type": "ipv4", "value": "85.114.159.93", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 301, "frame_number": 35520, "display_filter": "frame.number == 35520", "timestamp_epoch": "1533965160.354275000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0ce6dbe582438056a0d3e7f2", "type": "ipv4", "value": "87.240.129.133", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:49:00.146530+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:00.143999+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 34, "frame_number": 614, "display_filter": "frame.number == 614", "timestamp_epoch": "1533964545.653915000" }, { "udp_stream": 323, "frame_number": 40120, "display_filter": "frame.number == 40120", "timestamp_epoch": "1533965770.136548000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:49:00.141099+00:00" }, { "observable_id": "observable-2dda969d1be000e22c2609a4", "type": "ipv4", "value": "87.240.129.71", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 34, "frame_number": 614, "display_filter": "frame.number == 614", "timestamp_epoch": "1533964545.653915000" }, { "udp_stream": 323, "frame_number": 40120, "display_filter": "frame.number == 40120", "timestamp_epoch": "1533965770.136548000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-9c1adb2b6e8bfea6b034bf90", "type": "ipv4", "value": "87.240.180.136", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 34, "frame_number": 614, "display_filter": "frame.number == 614", "timestamp_epoch": "1533964545.653915000" }, { "udp_stream": 323, "frame_number": 40120, "display_filter": "frame.number == 40120", "timestamp_epoch": "1533965770.136548000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e25b7b968a3fd05e18e36539", "type": "ipv4", "value": "87.240.182.224", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 34, "frame_number": 614, "display_filter": "frame.number == 614", "timestamp_epoch": "1533964545.653915000" }, { "udp_stream": 323, "frame_number": 40120, "display_filter": "frame.number == 40120", "timestamp_epoch": "1533965770.136548000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d77aa6a6d8ae8e8e96d1e559", "type": "ipv4", "value": "87.250.250.119", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 52, "frame_number": 3310, "display_filter": "frame.number == 3310", "timestamp_epoch": "1533964552.683616000" }, { "udp_stream": 344, "frame_number": 43729, "display_filter": "frame.number == 43729", "timestamp_epoch": "1533965783.276443000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d7a49598f768fd5941026415", "type": "ipv4", "value": "87.250.250.38", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 88, "frame_number": 7089, "display_filter": "frame.number == 7089", "timestamp_epoch": "1533964677.421170000" }, { "udp_stream": 319, "frame_number": 39904, "display_filter": "frame.number == 39904", "timestamp_epoch": "1533965605.965885000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-806f32d1a7b2154f89077794", "type": "ipv4", "value": "87.250.250.90", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 44, "frame_number": 3197, "display_filter": "frame.number == 3197", "timestamp_epoch": "1533964552.405569000" }, { "udp_stream": 337, "frame_number": 43651, "display_filter": "frame.number == 43651", "timestamp_epoch": "1533965783.060399000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-cf01ddf0b26c905c02aaece3", "type": "ipv4", "value": "87.250.251.119", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 52, "frame_number": 3310, "display_filter": "frame.number == 3310", "timestamp_epoch": "1533964552.683616000" }, { "udp_stream": 344, "frame_number": 43729, "display_filter": "frame.number == 43729", "timestamp_epoch": "1533965783.276443000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f6631ac4fca61ebaf4fec8f5", "type": "ipv4", "value": "87.250.251.37", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 87, "frame_number": 6567, "display_filter": "frame.number == 6567", "timestamp_epoch": "1533964577.203660000" }, { "udp_stream": 318, "frame_number": 39814, "display_filter": "frame.number == 39814", "timestamp_epoch": "1533965567.514714000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ac96f854054632eb466b5fa9", "type": "ipv4", "value": "88.212.196.101", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 49, "frame_number": 3296, "display_filter": "frame.number == 3296", "timestamp_epoch": "1533964552.626454000" }, { "udp_stream": 340, "frame_number": 43654, "display_filter": "frame.number == 43654", "timestamp_epoch": "1533965783.076721000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c003dc4dd1acb682267a3bb3", "type": "ipv4", "value": "88.212.196.102", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 49, "frame_number": 3296, "display_filter": "frame.number == 3296", "timestamp_epoch": "1533964552.626454000" }, { "udp_stream": 340, "frame_number": 43654, "display_filter": "frame.number == 43654", "timestamp_epoch": "1533965783.076721000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-bd65affb9030d5fbea630e4d", "type": "ipv4", "value": "88.212.196.103", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 49, "frame_number": 3296, "display_filter": "frame.number == 3296", "timestamp_epoch": "1533964552.626454000" }, { "udp_stream": 340, "frame_number": 43654, "display_filter": "frame.number == 43654", "timestamp_epoch": "1533965783.076721000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-9f687975633ba3d4774960e7", "type": "ipv4", "value": "88.212.196.104", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 49, "frame_number": 3296, "display_filter": "frame.number == 3296", "timestamp_epoch": "1533964552.626454000" }, { "udp_stream": 340, "frame_number": 43654, "display_filter": "frame.number == 43654", "timestamp_epoch": "1533965783.076721000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-73d9fca28c2dcd12d4724d07", "type": "ipv4", "value": "88.212.196.105", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 49, "frame_number": 3296, "display_filter": "frame.number == 3296", "timestamp_epoch": "1533964552.626454000" }, { "udp_stream": 340, "frame_number": 43654, "display_filter": "frame.number == 43654", "timestamp_epoch": "1533965783.076721000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7681c5cc62a1b75c7ba6a8d8", "type": "ipv4", "value": "88.212.196.122", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 49, "frame_number": 3296, "display_filter": "frame.number == 3296", "timestamp_epoch": "1533964552.626454000" }, { "udp_stream": 340, "frame_number": 43654, "display_filter": "frame.number == 43654", "timestamp_epoch": "1533965783.076721000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-99cb4e6c8144c9bab6dc5f13", "type": "ipv4", "value": "88.212.196.123", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 49, "frame_number": 3296, "display_filter": "frame.number == 3296", "timestamp_epoch": "1533964552.626454000" }, { "udp_stream": 340, "frame_number": 43654, "display_filter": "frame.number == 43654", "timestamp_epoch": "1533965783.076721000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-43578ae382f42bf247aa4eb7", "type": "ipv4", "value": "88.212.196.124", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 49, "frame_number": 3296, "display_filter": "frame.number == 3296", "timestamp_epoch": "1533964552.626454000" }, { "udp_stream": 340, "frame_number": 43654, "display_filter": "frame.number == 43654", "timestamp_epoch": "1533965783.076721000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4aae51b38312b6ec3daf541f", "type": "ipv4", "value": "88.212.196.66", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 49, "frame_number": 3296, "display_filter": "frame.number == 3296", "timestamp_epoch": "1533964552.626454000" }, { "udp_stream": 340, "frame_number": 43654, "display_filter": "frame.number == 43654", "timestamp_epoch": "1533965783.076721000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-136652b072d43f49012fba15", "type": "ipv4", "value": "88.212.196.69", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 49, "frame_number": 3296, "display_filter": "frame.number == 3296", "timestamp_epoch": "1533964552.626454000" }, { "udp_stream": 340, "frame_number": 43654, "display_filter": "frame.number == 43654", "timestamp_epoch": "1533965783.076721000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0c5c73af7f0b2b67cad6f731", "type": "ipv4", "value": "88.212.196.72", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 49, "frame_number": 3296, "display_filter": "frame.number == 3296", "timestamp_epoch": "1533964552.626454000" }, { "udp_stream": 340, "frame_number": 43654, "display_filter": "frame.number == 43654", "timestamp_epoch": "1533965783.076721000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0567c831d9fe032fb822ba36", "type": "ipv4", "value": "88.212.196.75", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 49, "frame_number": 3296, "display_filter": "frame.number == 3296", "timestamp_epoch": "1533964552.626454000" }, { "udp_stream": 340, "frame_number": 43654, "display_filter": "frame.number == 43654", "timestamp_epoch": "1533965783.076721000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-af88ead8553c1ae19150e86f", "type": "ipv4", "value": "88.212.196.77", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 49, "frame_number": 3296, "display_filter": "frame.number == 3296", "timestamp_epoch": "1533964552.626454000" }, { "udp_stream": 340, "frame_number": 43654, "display_filter": "frame.number == 43654", "timestamp_epoch": "1533965783.076721000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-df8f406cfe44a0267c8b02b6", "type": "ipv4", "value": "88.212.201.193", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 49, "frame_number": 3296, "display_filter": "frame.number == 3296", "timestamp_epoch": "1533964552.626454000" }, { "udp_stream": 340, "frame_number": 43654, "display_filter": "frame.number == 43654", "timestamp_epoch": "1533965783.076721000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-31d357366cea0426cb5cec8b", "type": "ipv4", "value": "88.212.201.194", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 49, "frame_number": 3296, "display_filter": "frame.number == 3296", "timestamp_epoch": "1533964552.626454000" }, { "udp_stream": 340, "frame_number": 43654, "display_filter": "frame.number == 43654", "timestamp_epoch": "1533965783.076721000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-abdbebf3dea87840b30976ec", "type": "ipv4", "value": "88.212.201.195", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 49, "frame_number": 3296, "display_filter": "frame.number == 3296", "timestamp_epoch": "1533964552.626454000" }, { "udp_stream": 340, "frame_number": 43654, "display_filter": "frame.number == 43654", "timestamp_epoch": "1533965783.076721000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1e8f133e1212322df98e5715", "type": "ipv4", "value": "88.212.201.196", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 49, "frame_number": 3296, "display_filter": "frame.number == 3296", "timestamp_epoch": "1533964552.626454000" }, { "udp_stream": 340, "frame_number": 43654, "display_filter": "frame.number == 43654", "timestamp_epoch": "1533965783.076721000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2086181ab66706cad5c306e9", "type": "ipv4", "value": "88.212.201.197", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 49, "frame_number": 3296, "display_filter": "frame.number == 3296", "timestamp_epoch": "1533964552.626454000" }, { "udp_stream": 340, "frame_number": 43654, "display_filter": "frame.number == 43654", "timestamp_epoch": "1533965783.076721000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d2fe92dbed966b147efea5a8", "type": "ipv4", "value": "88.212.201.199", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 49, "frame_number": 3296, "display_filter": "frame.number == 3296", "timestamp_epoch": "1533964552.626454000" }, { "udp_stream": 340, "frame_number": 43654, "display_filter": "frame.number == 43654", "timestamp_epoch": "1533965783.076721000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-cb448c3a75b1a53e78ca2997", "type": "ipv4", "value": "88.212.201.205", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 49, "frame_number": 3296, "display_filter": "frame.number == 3296", "timestamp_epoch": "1533964552.626454000" }, { "udp_stream": 340, "frame_number": 43654, "display_filter": "frame.number == 43654", "timestamp_epoch": "1533965783.076721000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4be9f05da879a53c58b11890", "type": "ipv4", "value": "88.212.201.207", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 49, "frame_number": 3296, "display_filter": "frame.number == 3296", "timestamp_epoch": "1533964552.626454000" }, { "udp_stream": 340, "frame_number": 43654, "display_filter": "frame.number == 43654", "timestamp_epoch": "1533965783.076721000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2b759bf8abf168f1588d2538", "type": "ipv4", "value": "88.212.201.208", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 49, "frame_number": 3296, "display_filter": "frame.number == 3296", "timestamp_epoch": "1533964552.626454000" }, { "udp_stream": 340, "frame_number": 43654, "display_filter": "frame.number == 43654", "timestamp_epoch": "1533965783.076721000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b323beeeb202c42dd4dec554", "type": "ipv4", "value": "88.212.252.69", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 122, "frame_number": 11789, "display_filter": "frame.number == 11789", "timestamp_epoch": "1533964901.574246000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-43a27b88853edc7622d439ff", "type": "ipv4", "value": "88.212.252.70", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 122, "frame_number": 11789, "display_filter": "frame.number == 11789", "timestamp_epoch": "1533964901.574246000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-db8ddc94ac99a686a33baf2c", "type": "ipv4", "value": "88.212.252.78", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 122, "frame_number": 11789, "display_filter": "frame.number == 11789", "timestamp_epoch": "1533964901.574246000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-cbc54f6dfc5b0b9f057681a0", "type": "ipv4", "value": "88.99.210.183", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 105, "frame_number": 9340, "display_filter": "frame.number == 9340", "timestamp_epoch": "1533964899.269568000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7dbf89bd69d6b3e94d8300e5", "type": "ipv4", "value": "88.99.232.10", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 105, "frame_number": 9340, "display_filter": "frame.number == 9340", "timestamp_epoch": "1533964899.269568000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-91ad5f832dc8e7ac5aa00851", "type": "ipv4", "value": "88.99.5.37", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 358, "frame_number": 45340, "display_filter": "frame.number == 45340", "timestamp_epoch": "1533965787.454378000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ee70debf204f955a93268bb2", "type": "ipv4", "value": "88.99.56.120", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 122, "frame_number": 11789, "display_filter": "frame.number == 11789", "timestamp_epoch": "1533964901.574246000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d24a59a81e3f431f4bb0b644", "type": "ipv4", "value": "88.99.95.120", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 105, "frame_number": 9340, "display_filter": "frame.number == 9340", "timestamp_epoch": "1533964899.269568000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-adfdd305a8424d11080c9350", "type": "ipv4", "value": "88.99.95.121", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 105, "frame_number": 9340, "display_filter": "frame.number == 9340", "timestamp_epoch": "1533964899.269568000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-710e764d08c6926e11147cfa", "type": "ipv4", "value": "89.223.92.202", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-02cc2e4a6842cf5218b530ec", "type": "ipv4", "value": "91.216.130.21", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 325, "frame_number": 40223, "display_filter": "frame.number == 40223", "timestamp_epoch": "1533965770.569360000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-cf54b032607a10d120d9e193", "type": "ipv4", "value": "91.216.130.22", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 327, "frame_number": 40215, "display_filter": "frame.number == 40215", "timestamp_epoch": "1533965770.562042000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-737980035506723ee67811f4", "type": "ipv4", "value": "93.158.134.119", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 52, "frame_number": 3310, "display_filter": "frame.number == 3310", "timestamp_epoch": "1533964552.683616000" }, { "udp_stream": 344, "frame_number": 43729, "display_filter": "frame.number == 43729", "timestamp_epoch": "1533965783.276443000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4b31d34a848774b74f08ac41", "type": "ipv4", "value": "93.158.134.37", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 87, "frame_number": 6567, "display_filter": "frame.number == 6567", "timestamp_epoch": "1533964577.203660000" }, { "udp_stream": 318, "frame_number": 39814, "display_filter": "frame.number == 39814", "timestamp_epoch": "1533965567.514714000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8be49e4ac0e7df28b90b01c5", "type": "ipv4", "value": "93.158.134.38", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 88, "frame_number": 7089, "display_filter": "frame.number == 7089", "timestamp_epoch": "1533964677.421170000" }, { "udp_stream": 319, "frame_number": 39904, "display_filter": "frame.number == 39904", "timestamp_epoch": "1533965605.965885000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5821db4f7c96b9b8728f06d5", "type": "ipv4", "value": "93.158.134.90", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 44, "frame_number": 3197, "display_filter": "frame.number == 3197", "timestamp_epoch": "1533964552.405569000" }, { "udp_stream": 337, "frame_number": 43651, "display_filter": "frame.number == 43651", "timestamp_epoch": "1533965783.060399000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7692164ed165458536062483", "type": "ipv4", "value": "94.31.29.138", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 178, "frame_number": 17309, "display_filter": "frame.number == 17309", "timestamp_epoch": "1533964955.900897000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f46bcfe3edfdc068bcde9176", "type": "ipv4", "value": "94.31.29.250", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 189, "frame_number": 18270, "display_filter": "frame.number == 18270", "timestamp_epoch": "1533964958.600112000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c35613eea8bfd327dc7af273", "type": "ipv4", "value": "95.142.20.17", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 96, "frame_number": 8628, "display_filter": "frame.number == 8628", "timestamp_epoch": "1533964898.548203000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ea7a441b70f8874e5b9df293", "type": "ipv4", "value": "95.142.20.29", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 115, "frame_number": 10632, "display_filter": "frame.number == 10632", "timestamp_epoch": "1533964900.643556000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f35f8f27a06bab48555515e1", "type": "ipv4", "value": "95.213.222.11", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 122, "frame_number": 11789, "display_filter": "frame.number == 11789", "timestamp_epoch": "1533964901.574246000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6d46486541a1cce7b75b2dbf", "type": "ipv4", "value": "95.213.222.13", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 122, "frame_number": 11789, "display_filter": "frame.number == 11789", "timestamp_epoch": "1533964901.574246000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-567b3c67e7a45d4e735e073d", "type": "ipv4", "value": "95.213.222.17", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 122, "frame_number": 11789, "display_filter": "frame.number == 11789", "timestamp_epoch": "1533964901.574246000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2b239530509173dda09eb1c0", "type": "ipv4", "value": "95.213.222.27", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 122, "frame_number": 11789, "display_filter": "frame.number == 11789", "timestamp_epoch": "1533964901.574246000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d029e37042f7fe5e6c2d216d", "type": "ipv4", "value": "95.213.222.29", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 122, "frame_number": 11789, "display_filter": "frame.number == 11789", "timestamp_epoch": "1533964901.574246000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5cc7e4e2d671eb720d19faf5", "type": "ipv4", "value": "95.213.222.9", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 122, "frame_number": 11789, "display_filter": "frame.number == 11789", "timestamp_epoch": "1533964901.574246000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f9c235eba1265c5b01796853", "type": "ipv4", "value": "95.216.24.148", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 358, "frame_number": 45340, "display_filter": "frame.number == 45340", "timestamp_epoch": "1533965787.454378000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-00973c38f4f86204a789f912", "type": "ipv4", "value": "95.216.24.149", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 358, "frame_number": 45340, "display_filter": "frame.number == 45340", "timestamp_epoch": "1533965787.454378000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-89d4c37435f131bacd4d3313", "type": "ipv4", "value": "95.216.24.150", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 358, "frame_number": 45340, "display_filter": "frame.number == 45340", "timestamp_epoch": "1533965787.454378000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-605d2eedec6f24502096ded3", "type": "ipv4", "value": "98.136.101.121", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 81, "frame_number": 6113, "display_filter": "frame.number == 6113", "timestamp_epoch": "1533964559.840586000" }, { "udp_stream": 85, "frame_number": 6273, "display_filter": "frame.number == 6273", "timestamp_epoch": "1533964560.304978000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e4008e17fc072754e50cc6ee", "type": "sha256", "value": "025bb8d092d17ec94d16f6a602b61447faf64f3260c93a4650e9b77b9003a3f9", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2e3aa27302953e738285e815", "type": "sha256", "value": "03a8abd21deffa815518744425ed7da2e391745f22d80ecd2a98ece7e42644e3", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ca55531c3c295405a64d7819", "type": "sha256", "value": "044e4bccabac4f77e55d287724125fd5e1df18597c7e1d38cf690aefdae255b4", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-dd51c01f3d936446223ccb02", "type": "sha256", "value": "05879b64ff801a2c6fbc4e43a1872c6a0ab6a67d3839d1eb3ed8e4852d4d58bd", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-142ca96e39fa5d99a587d8ae", "type": "sha256", "value": "09c4d94ef1b017b75ff5e2b9e68bcab620ec852cde6b08b21fb46f6d3ce8c904", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ca486dec2e8d45dcfb05728e", "type": "sha256", "value": "110c07b1c1d0b56bb1755a621024babe4a7f60cacd8ffe605ef41826d3fe6784", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8fba68d3b27fd8f0f325fc4c", "type": "sha256", "value": "1434636c458ad8cda52b2e1cb38178b63d9af59579d7259a36a436c9c6a11a72", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-9450a805c8ceceb6cf5c9f43", "type": "sha256", "value": "154c433c491929c5ef686e838e323664a00e6a0d822ccc958fb4dab03e49a08f", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3af0e1c36df3611b0688960a", "type": "sha256", "value": "17f91f2405171b6857a93cb8c9b306144951f1e272a039a61a7753ba04eb0b52", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6d2c6f59a9919ac79daab160", "type": "sha256", "value": "1b416e5dd993831d9e9f5073f76034d5d1485b7eeec0be5c57c3c408b9ca8f14", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7e46f20f6fb270311c1f736f", "type": "sha256", "value": "1b78a08c32d00ced18d679a004b133df54370f1f1d359f29b64c44256aaf8302", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-88a4da4c048e903108a23007", "type": "sha256", "value": "1baf84b9f47c61803a5ea556eb3541f6ba74fc6e3c5261aac798aa19773e5cf1", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1c8cbc8a2feb26e33dbc1e23", "type": "sha256", "value": "1d762c3dcf8ec1d7cf68b813aed274886103a60b67c11ff9f166398e96fdedaf", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:53.425006+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:53.225287+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:53.221151+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:53.216084+00:00" }, { "observable_id": "observable-335f7f0cc0d92ba2f01fc09f", "type": "sha256", "value": "1dc9f4fe16b9590b8044c7389d2d1c37fb18ef5dad0ef801a6071f4df7c7a9d5", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0d3185fd8be331ba5ef55056", "type": "sha256", "value": "1ed6dac934e53a42db49242075dee716837fe4115d998e45f5c52d4ae96923a2", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-80406c6b9140c62404c98004", "type": "sha256", "value": "1fc3656d141db778f4636a6beb9eb0623e7b2a072ddce6013ed96f44988b78b5", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-469955a2e09f0ab1c8be025d", "type": "sha256", "value": "225bd232b88e6072f4601058ebf7a0db0fa5cb3bf7537350c7de0bf5f2f5c54a", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:54.135663+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:53.924814+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:53.916622+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:53.910393+00:00" }, { "observable_id": "observable-ffee51b917a1f938a892bb05", "type": "sha256", "value": "2361c69cc160246a46ecca25b6b50d825c2d950c39328c29aa1a168018640b11", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f2b73ec9d7a804f92c2e7c85", "type": "sha256", "value": "25af58ca16a2bfb18ae772716df14b4c656b39ccdcb4b9fae9bca1634e505007", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2a0ff939b4f20ad7c76bf74b", "type": "sha256", "value": "2a44910e028b6d330cacd3462a0252019ce6c016805a1b16c1c9c52b5c1caa46", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0bb8d53dfe184ba6ae8108d0", "type": "sha256", "value": "2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-56f6716c634f1279e47d4b00", "type": "sha256", "value": "2ea3ff820ddb55c4c951ff1c0fbfe8590ebff986b806fb351f2f32aded2fefc4", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7b7db46a83a24f9105d5ceb8", "type": "sha256", "value": "2ffb9c700e123b950ec5913c37c94fdd8fbb16d072458bfd5a99b57a43233417", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3b057cf9fa83bdba8b75c308", "type": "sha256", "value": "3715612c143dd7fbcd9db512e0cbd31334fe349c77f5ac4921d0646ca8bb6fdf", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a80d7d06bb404ba5b3c25157", "type": "sha256", "value": "3836255ada8bd1d6a0ac85b332623efd56c48a84e44be7cdf39482e5e1fa9e3c", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0f6fb3dc9e59d1b06e9c8173", "type": "sha256", "value": "387ad007219e458d5db35423310dcbc61b583b2611fde57a36879e31b3fb1d99", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4c93b5488955934f5fdd020f", "type": "sha256", "value": "38a2d4f024e57004e2d2324eead0ae08341ea9490151a439d6531132a5d2c2d5", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0710bcddfd4b32a7c4a044d0", "type": "sha256", "value": "38b9ae4c8fe738059ad5faf084677b448bd9333fc6286e3440cfc09be2bb18d5", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-9aab18b66031d5a2ce83ec2d", "type": "sha256", "value": "39f55c0059bfa765dbc67836a3c694c4257e3880c5323e14a2874d78f4de5582", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-85f4b68cae4e29d2ef0c83fa", "type": "sha256", "value": "3ab30e780c8b0bcc4998b838a5b30c3bfe28edead312906dc3c12271fae0699a", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6e120facaedf35968ce80baf", "type": "sha256", "value": "3cdffc1fdda52774a1ee46fcd7244b0ee88b11df0f7ddce7dc725609bd1f2a90", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8ad6605715da3e8e9817585e", "type": "sha256", "value": "3f7411e6cfd233d77fd01564a545084b986ae36e1c385c5999df93f5f430d65b", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-934a2bd9d1e1588a2971ed34", "type": "sha256", "value": "403f055d841332e37c429d5a4f0699e95a960529853388d36e4ef51e4309ebd0", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-75e36dd9a8256de514ea7c08", "type": "sha256", "value": "44509da8c1e070e58d174497add5449046af4bd1a1b62aa38152d73c9372a394", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4b7b861fbee2dc4ba68f36ae", "type": "sha256", "value": "468e579fe1210fa55525b1c470ed2d1958404512a2dd4fb972cac5ce0ff00b1f", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-23b52a6af952fcf00881d190", "type": "sha256", "value": "4e4d1d22150544836181502bf5004097fe8d90b3cb647455a4d601153b39eeb7", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-47e791baf38c0939b86ca09b", "type": "sha256", "value": "4efb8677134ae61413bf441d88c2e912ca065a68bb4566b30f935cae34f5a98e", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7a57d24b3bbf89dc4d3078c9", "type": "sha256", "value": "4f32d5dc00f715250abcc486511e37f501a899deb3bf7ea8adbbd3aef1c412da", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1942d7ea1efd279a4ef4a81c", "type": "sha256", "value": "5aa35acedcb1d276b3b3a71371eb51bc910b970deb8a3c6111fa99959fe6c9c7", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-51a19ccbe0b138a1439a45f8", "type": "sha256", "value": "6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a64617d67e90408902bc3591", "type": "sha256", "value": "61c6caebd23921741fb5ffe6603f16634fca9840c2bf56ac8201e9264d6daccf", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c3245c8b331595f55678a81b", "type": "sha256", "value": "6281b1e2ea6a5d13e0fd8766295444b52867bc3298d5c2b6b55b1b22420f230c", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3739a3bb238636c0558767cd", "type": "sha256", "value": "67dcf7446d48b5a0cb944a63bd3b69470cc6a48c024223aeff0252cc5b4f11b5", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5b5aff26126691b2170ba2c1", "type": "sha256", "value": "6865cb6b98a7a93856092e5a4f0d44d6564e74513f685a1eef824a2f7ea77438", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-bf1decf2e0fcced6917ce915", "type": "sha256", "value": "6db9e00a697b239f66e81bff6d475a80c885dd2e533c93ddeed3e5883a79b8e1", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d660e86ab6fc2b0c533200c4", "type": "sha256", "value": "7a44293f37ed3ab18757c89dc76b673aa3ff923e31933ba1bdae740fb0e7ddd4", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a7e7bb261232af490440aec6", "type": "sha256", "value": "7a788d144a48f85a8f0ffd046f90c7ae89208a52463f9e5ba27833ab2085a291", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1b8b17a9019b172091fef03e", "type": "sha256", "value": "7d856e9985a83e2e6fa80ea41c6e67c8db9e19d9f30ce8d0a8d87ad942a00a31", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-29526c90ec493804d73efe38", "type": "sha256", "value": "826da83425629535790ab944e227e02a597999af91f0a662bcfb4351c950d274", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-eaead8b72c55ed59f71b1c7c", "type": "sha256", "value": "8380f10fcacb3780a860531c45384ab3bfdc2ab6a9b8ada7b38551448f69d889", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-aad0f48bea60a169e80d9275", "type": "sha256", "value": "8500d605a74853787e140b8e1fcc945de816b28bda06093a3a9d3a9fe00b9b6e", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7f59b34c1404b2804edcb2f2", "type": "sha256", "value": "87da7fce38fb944279568a460f952df3009b4398083bbe5dedb489fde5f46814", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:54.766174+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:54.584832+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:54.582794+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:54.580522+00:00" }, { "observable_id": "observable-dff181f262a287c73de16caf", "type": "sha256", "value": "8bf7a76576baee734a750ad21b0a8a583de9ef4312e41f7043594910e6649eed", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f78e0b44df436f2789a18ec2", "type": "sha256", "value": "8ed18faec0943d33882e94cf8e4f01b732ff4e7c84294a9852dbed7cbb07afd7", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f391393ca52867bcf147fef4", "type": "sha256", "value": "8ed22d97053651c1bf38b50de0630657e03c9dc1b82f2c80241d72dd68c34fc8", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:55.304777+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:55.118127+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:55.116313+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:55.114041+00:00" }, { "observable_id": "observable-444dd11e3d378730ebaec1ce", "type": "sha256", "value": "8f34acb688aeae2e39704c35a59767aa10f9b6b99d81f681b8398b23c2d56f22", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-fa5082585fa4beb433f75448", "type": "sha256", "value": "9346b79af539d6aa4f72a0499ca1459c42e1a6e2becf0d015ba2f4237f0a9eab", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-541713d83e37fa75ff6398eb", "type": "sha256", "value": "96bc02edb88af74dfe132e8341ef9a8694400d86bf0deb6fd93d06591bc5fa8d", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d92d0bb43acb97336b07910e", "type": "sha256", "value": "99fb918a282d39d585d3d759f7903f7508925d0f78ae80e427cec27378c5b71b", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-9240ed6286fa2c23ad6ba950", "type": "sha256", "value": "9a3425a07bbde19cc69878e803f30c78d60b61f49049265a20a01841a1028350", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-687ad259fb50956e1995cb4c", "type": "sha256", "value": "9d0bbca6eb531759098a56914524f615a1d5a75a1b2c429d7b238973c2610c7a", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-48caf17309371c5fa2fd15ee", "type": "sha256", "value": "a002c9d3c0bfd9a9ff3c9ff2b1dbd79beb6bf0af5b45933ccad66337bc6864eb", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6ccea4ba3fff84a57c808595", "type": "sha256", "value": "a131c2b10883bc8647bffa08b4a6b27f04b376bbddb267a4d0c9d3e8ea851aa0", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-814a595ba31f4b8953fc9d9f", "type": "sha256", "value": "a1dbd5350e586eab4363644e8a82826a3032bc4f83694543d50fb6498ea6e82e", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-9bdda0aa0508bc21616c1677", "type": "sha256", "value": "a2ce3a0fa7d2a833d1801e01ec48e35b70d84f3467cc9f8fab370386e13879c7", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b594505c2b5f5055a2cd3b61", "type": "sha256", "value": "a6dd05c22e36e46f367bb82192f989ccf6b9f5407e61addeaab44b7c53e30a00", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-641671af1bb36f8886479078", "type": "sha256", "value": "aa81dc4dfa58c4040d0e5c08813a963dd3e8a8a16fd1c76ed758e703b62761f2", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-47b43a8c68843fe4df4ee680", "type": "sha256", "value": "ad927cfd47a633c08193fec7881a927102c04802a42fa9d880c34dcba5d473ed", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c8248b770d4c98bf8daa857b", "type": "sha256", "value": "ad984172bbde72d905cb477edf2775b567580976ef1327612313d7490a3d30ae", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b1c78ac699f5236954202662", "type": "sha256", "value": "ae4f99d83e633923748305e0dd6434264babf605d56deb7d05345710796038fa", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-216499ede0f639ca64308445", "type": "sha256", "value": "af5e4f327b79424352a42bf43df71e6a2f52d6f8948b82d6a42b4c2e97f7bfea", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3c51fa0db7a1560105868f65", "type": "sha256", "value": "b3719e3eda456a7457adfe13e6eed36fcef0901b0c31c22cc8ff48629ce8dcee", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-73a745c2efd2e6b4a103536c", "type": "sha256", "value": "b824ce476646a4ea83e2e7b3ccff9864cb702bf597c05656a470ec609954f9db", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b5c07290196fcd67e84edaad", "type": "sha256", "value": "b84161c9fbf7520cd14e7019f92120bd87a928a074156e91a992eba9fc9436e8", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-adb255911d18e7d3b23f4927", "type": "sha256", "value": "b908d9b1001d0a39ba92501c086b1c25b05b171eeda035ae9f3e129d2776a314", "classification": "suspicious", "ioc_candidate": true, "reasons": [ { "kind": "static-review", "artifact_id": "artifact-b8c70bac7d2ead3799659b33", "features": [ "dynamic-evaluation", "powershell-download" ], "interpretation": "Suspicious static features, not execution or malware proof" } ], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:52.845478+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:52.657913+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:52.656090+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Candidate requires analyst validation", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:52.654281+00:00" }, { "observable_id": "observable-bf135081606734b07b12c7f8", "type": "sha256", "value": "bc1fc69f9747dc034ece7d9bb795c5e596d9be6ca71efe75c6c0fd18f3cbfbf5", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:55.867820+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:55.659352+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:55.653017+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:55.647069+00:00" }, { "observable_id": "observable-a1e63b6f998929d2c2bbdfb8", "type": "sha256", "value": "beff9a913c0887163fd4a17d037f2188ed9e93f6c57f770448c2f7046ca7d141", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:56.412307+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:56.215443+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:56.210887+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:56.205775+00:00" }, { "observable_id": "observable-51124e568e4eea087652aafc", "type": "sha256", "value": "c0d599b80025a70004d813d62b587af4f8ae8abd64f514f280b6e4899436623f", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:56.972335+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:56.779811+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:56.774680+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:56.770025+00:00" }, { "observable_id": "observable-634077ba73808b24c345a9f4", "type": "sha256", "value": "c0f37380971fb93ecb0cfa3c2bd6d91cc77f254f0a6ca41edeff47fda0e409cc", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b4bf7cf5daa4adaa7fb705a5", "type": "sha256", "value": "c6e69e2ac48274e5650b25984db96e9b8c85f8c92941900207abb3d41b423cf7", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-80e4bc93f577cbd8c0ab98a4", "type": "sha256", "value": "c735ac343470ff44195d0167c35e9cb3e0bc43a7c749b67f50fb662300f73d9f", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4bee935118d7c5c57eb94087", "type": "sha256", "value": "c87f78fc36289e69a164914c940e5cecd31024d0a06089c2fab4dcd23e507ae6", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b65c464f4f2c8b413600e5f0", "type": "sha256", "value": "cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-98db67d28bca873eb1f1b27a", "type": "sha256", "value": "cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-96c79fa78eb9e19f47873623", "type": "sha256", "value": "cc59dfc0669d00ad2b72411ff19cf555e4d0f1b940f0c674904004c73a3edb07", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b71b1081e78d55f5f7f2fb81", "type": "sha256", "value": "cd649c61b13497605100760e8bf986b569254a716cc2b21612b8b4f09051a732", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-38d8d966a57eff253b88617b", "type": "sha256", "value": "ced5c873136c4fab4584c0c6d26dcd530c748303d7ed9b7a7966b2fe1d6f5915", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0e37fda133d6e4a20b568c70", "type": "sha256", "value": "cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-044828bfa4ce69e3039fe105", "type": "sha256", "value": "d1b728e19d551b8bc4f3f2d0c12541e7d8950358f95ae31e610b6ab46cb6ec96", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d7d1e4e9a32f1db50a192903", "type": "sha256", "value": "d4735e3a265e16eee03f59718b9b5d03019c07d8b6c51f90da3a666eec13ab35", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-15300bb69453b961e51687f1", "type": "sha256", "value": "d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d66b66ebcdb2dfab90657bd1", "type": "sha256", "value": "d84fb0e64ee9f712fb6a808e9caa959903068ae7d7805bd0ce5f4782a37422f4", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d3ea8098ef2a4ba9cbd9a825", "type": "sha256", "value": "d9e7bfb8aeed3257872096e5f7f09eb683adb4541c0fca3446823bea4a7c2168", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-fdd8eb18f5c8b53b11698d28", "type": "sha256", "value": "e2b232bd93d4faa6bd4156d3e31b542a24ac3afe877c6f7faf23c1f474eaf52a", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5054b7d15d9ed7f55bd3cbe1", "type": "sha256", "value": "e49188fece61523b27d736f94bccb9b04d8a3f018fe0a770fc5cf9b6c734fd0a", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b249292f69108bddf849eec8", "type": "sha256", "value": "e4c763b60274fbb4f5ebfb43603452f0c592aedf39647951ce87182fdb702955", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-323e688c3089cd1fa7e19be1", "type": "sha256", "value": "e56be3ba3f85b78893bce2432a38aad1afda3d3032ee8667589dd44ee9ed0cc1", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7d7efdfcf61d068f12b299ad", "type": "sha256", "value": "e6145cbc4aac4c3d685d04d508cee083e4e4a8a727af838ed46de8f0384b6119", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6c8d1f7fa83903de1ce7849a", "type": "sha256", "value": "e9d0f873040fb0ee7b073debbc6dfbfdbc80c0c17518d38b04b277a54e5fb275", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5e88a803b009d55b0b9dab9c", "type": "sha256", "value": "ea843998fbbcd38dd92e228250a9bf15521391a26c88cb25a16b162d7f35d0e1", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2a927173c7ddf7102c156f35", "type": "sha256", "value": "ebdab894f319fe12a1b14f3dc8c883d45caf4c15e389fb9d6568145f926f4126", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-386d4396306cea488de6c4a1", "type": "sha256", "value": "f1c1b50ae5a20dd8030ec9f6bc24823dd367b5255759b4e71b61fce9f7375d73", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8145f780af2c2e5e007d7e97", "type": "sha256", "value": "f2addf74a79c54d648ed7d227042c992f8d500dd95f072528f9e55c168cf97ad", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-46c1348259ea7666f727756d", "type": "sha256", "value": "f33c27745f2bd87344be790465ef984a972fd539dc83bd4f61d4242c607ef1ee", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-227b8be72f3cf5241facdb74", "type": "sha256", "value": "f379ea3023b93c6e5d2fe2945774dcf7c85a116326d9eb8f3274de541403811b", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e80d00594dc530ff2cf8336e", "type": "sha256", "value": "f59b3fd3d4f882d5c2154e3b8aa5e535416a696f482996ec2a134e7a6978c333", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ed1d367c9da4a9b8ed426245", "type": "sha256", "value": "f8e7288c0e055bff074b4d2f64cf687fa49de2e08955cd2cdb00d55eaacb3a61", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-212cc599b4b994cdee685cf1", "type": "sha256", "value": "f9496faf384dba29602fe3072688892f2dcf7738eecb77208c51de0eaa12562a", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7e6d602b3913ec1c58cf28c0", "type": "sha256", "value": "fa523f248a332cb89ae3ad8cf51d840153e0f96bcc2a4c8db736e02a340dab48", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-01688be6d59bc3dec4f7faf1", "type": "sha256", "value": "fb03a6b96e7aa8dc5c4e079289c84f446a7374d65f7bb79a734c34c9fb8e7703", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:57.529282+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:57.336025+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:57.334072+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:57.331870+00:00" }, { "observable_id": "observable-153c6ce86ff09322f8ea1b7f", "type": "url", "value": "http://185.68.93.18/dot.php", "classification": "suspicious", "ioc_candidate": true, "reasons": [ { "kind": "behavior", "finding_id": "finding-8798192d6b4571d1d4d40028", "rule_id": "periodic-http-callbacks", "frame_number": 39557 }, { "kind": "behavior", "finding_id": "finding-8798192d6b4571d1d4d40028", "rule_id": "periodic-http-callbacks", "frame_number": 39676 }, { "kind": "behavior", "finding_id": "finding-8798192d6b4571d1d4d40028", "rule_id": "periodic-http-callbacks", "frame_number": 39681 }, { "kind": "behavior", "finding_id": "finding-8798192d6b4571d1d4d40028", "rule_id": "periodic-http-callbacks", "frame_number": 39699 }, { "kind": "behavior", "finding_id": "finding-8798192d6b4571d1d4d40028", "rule_id": "periodic-http-callbacks", "frame_number": 39712 }, { "kind": "behavior", "finding_id": "finding-8798192d6b4571d1d4d40028", "rule_id": "periodic-http-callbacks", "frame_number": 39725 }, { "kind": "behavior", "finding_id": "finding-8798192d6b4571d1d4d40028", "rule_id": "periodic-http-callbacks", "frame_number": 39741 }, { "kind": "behavior", "finding_id": "finding-8798192d6b4571d1d4d40028", "rule_id": "periodic-http-callbacks", "frame_number": 39754 }, { "kind": "behavior", "finding_id": "finding-8798192d6b4571d1d4d40028", "rule_id": "periodic-http-callbacks", "frame_number": 39767 }, { "kind": "behavior", "finding_id": "finding-8798192d6b4571d1d4d40028", "rule_id": "periodic-http-callbacks", "frame_number": 39781 }, { "kind": "behavior", "finding_id": "finding-8798192d6b4571d1d4d40028", "rule_id": "periodic-http-callbacks", "frame_number": 39796 }, { "kind": "behavior", "finding_id": "finding-8798192d6b4571d1d4d40028", "rule_id": "periodic-http-callbacks", "frame_number": 39809 }, { "kind": "behavior", "finding_id": "finding-8798192d6b4571d1d4d40028", "rule_id": "periodic-http-callbacks", "frame_number": 39879 }, { "kind": "behavior", "finding_id": "finding-8798192d6b4571d1d4d40028", "rule_id": "periodic-http-callbacks", "frame_number": 39895 }, { "kind": "behavior", "finding_id": "finding-8798192d6b4571d1d4d40028", "rule_id": "periodic-http-callbacks", "frame_number": 39951 }, { "kind": "behavior", "finding_id": "finding-8798192d6b4571d1d4d40028", "rule_id": "periodic-http-callbacks", "frame_number": 39970 }, { "kind": "behavior", "finding_id": "finding-8798192d6b4571d1d4d40028", "rule_id": "periodic-http-callbacks", "frame_number": 39983 }, { "kind": "behavior", "finding_id": "finding-8798192d6b4571d1d4d40028", "rule_id": "periodic-http-callbacks", "frame_number": 39996 }, { "kind": "behavior", "finding_id": "finding-8798192d6b4571d1d4d40028", "rule_id": "periodic-http-callbacks", "frame_number": 40009 }, { "kind": "behavior", "finding_id": "finding-8798192d6b4571d1d4d40028", "rule_id": "periodic-http-callbacks", "frame_number": 40022 } ], "signals": [], "provider_conflict": false, "ioc_selection_note": "Candidate requires analyst validation", "evidence": [ { "tcp_stream": 1036, "frame_number": 39557, "display_filter": "frame.number == 39557", "timestamp_epoch": "1533965406.977212000" }, { "tcp_stream": 1046, "frame_number": 39676, "display_filter": "frame.number == 39676", "timestamp_epoch": "1533965418.580357000" }, { "tcp_stream": 1046, "frame_number": 39681, "display_filter": "frame.number == 39681", "timestamp_epoch": "1533965419.412338000" }, { "tcp_stream": 1047, "frame_number": 39699, "display_filter": "frame.number == 39699", "timestamp_epoch": "1533965435.576793000" }, { "tcp_stream": 1048, "frame_number": 39712, "display_filter": "frame.number == 39712", "timestamp_epoch": "1533965451.757604000" }, { "tcp_stream": 1049, "frame_number": 39725, "display_filter": "frame.number == 39725", "timestamp_epoch": "1533965467.936416000" }, { "tcp_stream": 1050, "frame_number": 39741, "display_filter": "frame.number == 39741", "timestamp_epoch": "1533965484.293094000" }, { "tcp_stream": 1051, "frame_number": 39754, "display_filter": "frame.number == 39754", "timestamp_epoch": "1533965500.471438000" }, { "tcp_stream": 1052, "frame_number": 39767, "display_filter": "frame.number == 39767", "timestamp_epoch": "1533965516.649335000" }, { "tcp_stream": 1053, "frame_number": 39781, "display_filter": "frame.number == 39781", "timestamp_epoch": "1533965532.902740000" }, { "tcp_stream": 1054, "frame_number": 39796, "display_filter": "frame.number == 39796", "timestamp_epoch": "1533965549.287287000" }, { "tcp_stream": 1055, "frame_number": 39809, "display_filter": "frame.number == 39809", "timestamp_epoch": "1533965565.437819000" }, { "tcp_stream": 1057, "frame_number": 39879, "display_filter": "frame.number == 39879", "timestamp_epoch": "1533965581.646796000" }, { "tcp_stream": 1058, "frame_number": 39895, "display_filter": "frame.number == 39895", "timestamp_epoch": "1533965597.772796000" }, { "tcp_stream": 1060, "frame_number": 39951, "display_filter": "frame.number == 39951", "timestamp_epoch": "1533965613.953658000" }, { "tcp_stream": 1061, "frame_number": 39970, "display_filter": "frame.number == 39970", "timestamp_epoch": "1533965630.124714000" }, { "tcp_stream": 1062, "frame_number": 39983, "display_filter": "frame.number == 39983", "timestamp_epoch": "1533965646.289888000" }, { "tcp_stream": 1063, "frame_number": 39996, "display_filter": "frame.number == 39996", "timestamp_epoch": "1533965662.463461000" }, { "tcp_stream": 1064, "frame_number": 40009, "display_filter": "frame.number == 40009", "timestamp_epoch": "1533965678.767587000" }, { "tcp_stream": 1065, "frame_number": 40022, "display_filter": "frame.number == 40022", "timestamp_epoch": "1533965694.815438000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-07ea1702cd804b1aba2afb7c", "type": "url", "value": "http://apps.identrust.com/roots/dstrootcax3.p7c", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 218, "frame_number": 8633, "display_filter": "frame.number == 8633", "timestamp_epoch": "1533964898.552621000" }, { "tcp_stream": 217, "frame_number": 8637, "display_filter": "frame.number == 8637", "timestamp_epoch": "1533964898.553823000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f55dbbe451be3ba89fb01e7d", "type": "url", "value": "http://cacerts.digicert.com/DigiCertSHA2SecureServerCA.crt", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 665, "frame_number": 23982, "display_filter": "frame.number == 23982", "timestamp_epoch": "1533964998.555480000" }, { "tcp_stream": 664, "frame_number": 23985, "display_filter": "frame.number == 23985", "timestamp_epoch": "1533964998.555964000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c96af3ef186ebf5ef614fd41", "type": "url", "value": "http://comet.tass.ru:8080/poll?channels=en_section_politics,en_section_world,en_section_economy,en_section_defense,en_section_science,en_section_society,en_section_sport,en_section_pressreview,en_section_emergencies&cometsid=--b28c704f1435e1a5ac1a753810d40a57", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1186, "frame_number": 44900, "display_filter": "frame.number == 44900", "timestamp_epoch": "1533965786.473054000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-be3cb1b5e58683afba7d1ce2", "type": "url", "value": "http://connect.facebook.net/en_US/sdk.js", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1151, "frame_number": 43690, "display_filter": "frame.number == 43690", "timestamp_epoch": "1533965783.175343000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b9527ce2a86f4cf8ec7e0296", "type": "url", "value": "http://counter.yadro.ru/hit;TASS_total?r;s1280*768*24;uhttp%3A//tass.com/;0.30934944172652073", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1143, "frame_number": 43744, "display_filter": "frame.number == 43744", "timestamp_epoch": "1533965783.328334000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1c0044cb8eb0bc6b17abefd6", "type": "url", "value": "http://counter.yadro.ru/logo;tass.com?44.6", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1144, "frame_number": 43748, "display_filter": "frame.number == 43748", "timestamp_epoch": "1533965783.334711000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1e3ae10f3b7dda3dfa9b15df", "type": "url", "value": "http://crt.comodoca.com/COMODORSAAddTrustCA.crt", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 296, "frame_number": 11487, "display_filter": "frame.number == 11487", "timestamp_epoch": "1533964901.324527000" }, { "tcp_stream": 297, "frame_number": 11488, "display_filter": "frame.number == 11488", "timestamp_epoch": "1533964901.324607000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4d27990f51a1412de57f88a7", "type": "url", "value": "http://fonts.googleapis.com/css?family=Roboto:300", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1190, "frame_number": 44836, "display_filter": "frame.number == 44836", "timestamp_epoch": "1533965786.409477000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c409456d67d2313bbf07d568", "type": "url", "value": "http://fonts.googleapis.com/css?family=Roboto:700", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1191, "frame_number": 44840, "display_filter": "frame.number == 44840", "timestamp_epoch": "1533965786.410078000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-51099a0fd44444e1301a6589", "type": "url", "value": "http://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmSU5fBBc-.woff", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1197, "frame_number": 45321, "display_filter": "frame.number == 45321", "timestamp_epoch": "1533965787.350307000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-129a95806d2c4009bb8ed9fb", "type": "url", "value": "http://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmWUlfBBc-.woff", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1198, "frame_number": 45320, "display_filter": "frame.number == 45320", "timestamp_epoch": "1533965787.350306000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-985e31f17ec9a6696b27159b", "type": "url", "value": "http://pagead2.googlesyndication.com/pagead/osd.js", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1187, "frame_number": 44800, "display_filter": "frame.number == 44800", "timestamp_epoch": "1533965786.356599000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-09cb824109800ac25a8ef476", "type": "url", "value": "http://platform.twitter.com/widgets.js", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1150, "frame_number": 43698, "display_filter": "frame.number == 43698", "timestamp_epoch": "1533965783.176462000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7da36578320f74fc5b11171a", "type": "url", "value": "http://r53x.com/1.rar", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 178, "frame_number": 7263, "display_filter": "frame.number == 7263", "timestamp_epoch": "1533964850.464296000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ec977cdae9f3ca563dc17c13", "type": "url", "value": "http://r53x.com/1.zip", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 179, "frame_number": 7277, "display_filter": "frame.number == 7277", "timestamp_epoch": "1533964857.855860000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-680ece11f0aaeb527cea500f", "type": "url", "value": "http://r53x.com/a3.dat", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 179, "frame_number": 7280, "display_filter": "frame.number == 7280", "timestamp_epoch": "1533964858.738093000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ee48164997f95dea1251a1f8", "type": "url", "value": "http://rtax.criteo.com/delivery/rta/rta.js?netId=5895&cookieName=crtg_rta&rnd=74932308510&varName=crtg_content", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1146, "frame_number": 43682, "display_filter": "frame.number == 43682", "timestamp_epoch": "1533965783.173153000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1bb9352127fc1cdc7a9f1654", "type": "url", "value": "http://ssl.trustwave.com/issuers/STCA.crt", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 127, "frame_number": 5383, "display_filter": "frame.number == 5383", "timestamp_epoch": "1533964556.494073000" }, { "tcp_stream": 128, "frame_number": 5387, "display_filter": "frame.number == 5387", "timestamp_epoch": "1533964556.515882000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3356a036f0410a3489a5661d", "type": "url", "value": "http://tass.com/", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1071, "frame_number": 40100, "display_filter": "frame.number == 40100", "timestamp_epoch": "1533965768.745327000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3c1caf176f48cee1da790926", "type": "url", "value": "http://tass.com/api/news/lenta?limit=50", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1073, "frame_number": 44285, "display_filter": "frame.number == 44285", "timestamp_epoch": "1533965784.710245000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-941ec3773375f31c17cf64ee", "type": "url", "value": "http://tass.com/assets/14df3cc8/layout.min.css?v=1533913284", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1073, "frame_number": 40173, "display_filter": "frame.number == 40173", "timestamp_epoch": "1533965770.466368000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1461f8c49a3438fded8ed3bf", "type": "url", "value": "http://tass.com/assets/1d1a4a07/socials.min.css?v=1533913284", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1071, "frame_number": 46347, "display_filter": "frame.number == 46347", "timestamp_epoch": "1533965790.969108000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8979e32d49c83b54fc020dde", "type": "url", "value": "http://tass.com/assets/287c4a4b/itar.min.js?v=1533913284", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1072, "frame_number": 42696, "display_filter": "frame.number == 42696", "timestamp_epoch": "1533965776.932397000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3c54828bc11334504e59ad1a", "type": "url", "value": "http://tass.com/assets/43ffdc60/angular.rangeSlider.min.css?v=1533913284", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1071, "frame_number": 40361, "display_filter": "frame.number == 40361", "timestamp_epoch": "1533965770.816258000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2ca5eddfcb080e03fa4e6cf2", "type": "url", "value": "http://tass.com/assets/666a6de7/lenta.min.css?v=1533913284", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1130, "frame_number": 41322, "display_filter": "frame.number == 41322", "timestamp_epoch": "1533965772.824858000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d440e1243fc0c510c3008f2d", "type": "url", "value": "http://tass.com/assets/6f5f919/flags.min.css?v=1533913284", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1075, "frame_number": 40177, "display_filter": "frame.number == 40177", "timestamp_epoch": "1533965770.467225000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-969a2831201f811a9d118246", "type": "url", "value": "http://tass.com/assets/735f4b6e/media-widget.min.css?v=1533913284", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1071, "frame_number": 40737, "display_filter": "frame.number == 40737", "timestamp_epoch": "1533965771.477596000" }, { "tcp_stream": 1070, "frame_number": 46361, "display_filter": "frame.number == 46361", "timestamp_epoch": "1533965790.990826000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-de6812634ccb070383bb7d4f", "type": "url", "value": "http://tass.com/assets/7ce9e0a9/videoWidget.min.css?v=1533913284", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1072, "frame_number": 46345, "display_filter": "frame.number == 46345", "timestamp_epoch": "1533965790.968776000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c8a10d4c04b5076205dff79a", "type": "url", "value": "http://tass.com/assets/842758d5/mainTopSlider.css?v=1533913284", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1071, "frame_number": 40213, "display_filter": "frame.number == 40213", "timestamp_epoch": "1533965770.489095000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b42f96a855d36cc9e5a3353b", "type": "url", "value": "http://tass.com/assets/8665a252/css.css?v=1533913284", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1075, "frame_number": 40562, "display_filter": "frame.number == 40562", "timestamp_epoch": "1533965771.132264000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ffdb273ac62336f7a5219f0f", "type": "url", "value": "http://tass.com/assets/88a00814/material.min.css?v=1533913284", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1133, "frame_number": 46355, "display_filter": "frame.number == 46355", "timestamp_epoch": "1533965790.976473000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2de83178bc465f0666200526", "type": "url", "value": "http://tass.com/assets/8b982e6a/infographics-widget.min.css?v=1533913284", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1073, "frame_number": 46420, "display_filter": "frame.number == 46420", "timestamp_epoch": "1533965791.270108000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7b805850e9f49db331986e04", "type": "url", "value": "http://tass.com/assets/916e0df6/footer.min.css?v=1533913284", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1131, "frame_number": 41324, "display_filter": "frame.number == 41324", "timestamp_epoch": "1533965772.824982000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-abd69486b4ba0467eb1751c2", "type": "url", "value": "http://tass.com/assets/a6d7cd43/cards.min.css?v=1533913284", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1072, "frame_number": 40518, "display_filter": "frame.number == 40518", "timestamp_epoch": "1533965771.072573000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ae20d4f91fdde243a96d1b76", "type": "url", "value": "http://tass.com/assets/bfcd510f/libs.min.js?v=1533913284", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1130, "frame_number": 42524, "display_filter": "frame.number == 42524", "timestamp_epoch": "1533965776.483672000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-07a829369fd17b176c7b538e", "type": "url", "value": "http://tass.com/assets/cb2c53b3/audioWidget.min.css?v=1533913284", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1130, "frame_number": 46343, "display_filter": "frame.number == 46343", "timestamp_epoch": "1533965790.968379000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-436e424872c95ec181583784", "type": "url", "value": "http://tass.com/assets/d45d2990/photoModeCss.css?v=1533913284", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1074, "frame_number": 40165, "display_filter": "frame.number == 40165", "timestamp_epoch": "1533965770.465535000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e3a4d7f5918ccb963de9cbfe", "type": "url", "value": "http://tass.com/assets/e2a326a5/main-slider-widget.min.css?v=1533913284", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1072, "frame_number": 40171, "display_filter": "frame.number == 40171", "timestamp_epoch": "1533965770.466207000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-74f128caedc9b99748c6a281", "type": "url", "value": "http://tass.com/assets/f64f6e6a/zoom.min.css?v=1533913284", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1074, "frame_number": 40510, "display_filter": "frame.number == 40510", "timestamp_epoch": "1533965771.062766000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-cc4d80fdb79ba7435af0b0b1", "type": "url", "value": "http://tass.com/css/before-widescreen.css", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1072, "frame_number": 41034, "display_filter": "frame.number == 41034", "timestamp_epoch": "1533965774.016397000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e76d5c83341f52a526f4ebbf", "type": "url", "value": "http://tass.com/css/doublephoto/css.css?v=1533913284", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1073, "frame_number": 46341, "display_filter": "frame.number == 46341", "timestamp_epoch": "1533965790.968196000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-fd6f64d5c2f2f306bcd0892c", "type": "url", "value": "http://tass.com/css/media-queries.css?_=3", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1070, "frame_number": 41026, "display_filter": "frame.number == 41026", "timestamp_epoch": "1533965774.002334000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b7fb4d19d1d2c3203daee9ec", "type": "url", "value": "http://tass.com/css/mobile.css?_=1", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1073, "frame_number": 41022, "display_filter": "frame.number == 41022", "timestamp_epoch": "1533965773.993678000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8e3f8f23db54008de5fb3226", "type": "url", "value": "http://tass.com/css/print.css?v=1", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1075, "frame_number": 41060, "display_filter": "frame.number == 41060", "timestamp_epoch": "1533965774.048915000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-967478206cb4ec834dc36f56", "type": "url", "value": "http://tass.com/css/widescreen.css", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1074, "frame_number": 41036, "display_filter": "frame.number == 41036", "timestamp_epoch": "1533965774.016484000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e23cd11b45d5cc17f8d7893d", "type": "url", "value": "http://tass.com/economy/1016847", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1070, "frame_number": 46268, "display_filter": "frame.number == 46268", "timestamp_epoch": "1533965790.405757000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2a860b5343e8dba530bbad93", "type": "url", "value": "http://tass.com/favicon.ico?225", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1073, "frame_number": 46258, "display_filter": "frame.number == 46258", "timestamp_epoch": "1533965790.166964000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b9f9cac6731fb4a45d0b116f", "type": "url", "value": "http://tass.com/fonts/icontass/icontass.eot?", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1071, "frame_number": 43657, "display_filter": "frame.number == 43657", "timestamp_epoch": "1533965783.078816000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-36148bd0a55b5a3698d9bbe2", "type": "url", "value": "http://tass.com/i/b-search-icon.png", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1073, "frame_number": 43972, "display_filter": "frame.number == 43972", "timestamp_epoch": "1533965783.863922000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-dd8799d5225cef37a563328d", "type": "url", "value": "http://tass.com/i/loader_animation.gif", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1132, "frame_number": 42753, "display_filter": "frame.number == 42753", "timestamp_epoch": "1533965777.082941000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-70544b3836dfc590f91e2cb0", "type": "url", "value": "http://tass.com/i/loader_animation_lenta_new.gif", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1131, "frame_number": 42759, "display_filter": "frame.number == 42759", "timestamp_epoch": "1533965777.083931000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7bac9d9643e88eb788bcde4a", "type": "url", "value": "http://tass.com/i/mobile-search-header.png", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1130, "frame_number": 43851, "display_filter": "frame.number == 43851", "timestamp_epoch": "1533965783.656953000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-474ef4c2748aab69c901e874", "type": "url", "value": "http://tass.com/i/up-button.png", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1070, "frame_number": 43877, "display_filter": "frame.number == 43877", "timestamp_epoch": "1533965783.726362000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ae6d426d78fbb57905981f94", "type": "url", "value": "http://tass.com/images/appstore.svg", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1133, "frame_number": 44183, "display_filter": "frame.number == 44183", "timestamp_epoch": "1533965784.398106000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a20607758f18f258a2973ef2", "type": "url", "value": "http://tass.com/images/newStyle/normal/foto.png", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1072, "frame_number": 44034, "display_filter": "frame.number == 44034", "timestamp_epoch": "1533965784.001309000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-34d65076ae60504eec64acfc", "type": "url", "value": "http://tass.com/images/newStyle/normal/icon_rybriki_normal.png", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1130, "frame_number": 44024, "display_filter": "frame.number == 44024", "timestamp_epoch": "1533965783.984760000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-86c705fa79b90a3999097077", "type": "url", "value": "http://tass.com/images/newStyle/normal/lenta.png", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1133, "frame_number": 43996, "display_filter": "frame.number == 43996", "timestamp_epoch": "1533965783.906069000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b6a3357f5c76f8bb97a78dc6", "type": "url", "value": "http://tass.com/images/newStyle/normal/logo/logo_footer_print_eng.png", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1073, "frame_number": 42766, "display_filter": "frame.number == 42766", "timestamp_epoch": "1533965777.098461000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-bea7cf3830bf8277fa430eba", "type": "url", "value": "http://tass.com/images/newStyle/normal/logo/logo_futter_web_eng.png", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1070, "frame_number": 44072, "display_filter": "frame.number == 44072", "timestamp_epoch": "1533965784.033493000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-24b75578394731391cd7624f", "type": "url", "value": "http://tass.com/images/newStyle/normal/logo/logo_web_eng.png", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1134, "frame_number": 42704, "display_filter": "frame.number == 42704", "timestamp_epoch": "1533965776.948661000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-53111370f69a6a2f96168eb0", "type": "url", "value": "http://tass.com/images/newStyle/normal/RSS.png", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1133, "frame_number": 43708, "display_filter": "frame.number == 43708", "timestamp_epoch": "1533965783.195452000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-37bfd364badee6803859155c", "type": "url", "value": "http://tass.com/images/newStyle/normal/ru_en.png", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1073, "frame_number": 43710, "display_filter": "frame.number == 43710", "timestamp_epoch": "1533965783.196117000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0a9dbe16af02def60d3fd4f3", "type": "url", "value": "http://tass.com/images/newStyle/normal/social/fb_futter_norma_1.png", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1130, "frame_number": 44220, "display_filter": "frame.number == 44220", "timestamp_epoch": "1533965784.463050000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7adac10735d855cecdb3b007", "type": "url", "value": "http://tass.com/images/newStyle/normal/social/fb_top_norma_1.png", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1072, "frame_number": 43702, "display_filter": "frame.number == 43702", "timestamp_epoch": "1533965783.194825000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-46618f144f10d639c9cfa02b", "type": "url", "value": "http://tass.com/images/newStyle/normal/social/g+_top_norma.png", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1070, "frame_number": 43706, "display_filter": "frame.number == 43706", "timestamp_epoch": "1533965783.195291000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-01476268a8a533dbe2658d38", "type": "url", "value": "http://tass.com/images/newStyle/normal/social/rss_futter_norma_1.png", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1073, "frame_number": 44172, "display_filter": "frame.number == 44172", "timestamp_epoch": "1533965784.386643000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-da1890a27bc507ec0ca3ce70", "type": "url", "value": "http://tass.com/images/newStyle/normal/social/tw_futter_norma_1.png", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1072, "frame_number": 44226, "display_filter": "frame.number == 44226", "timestamp_epoch": "1533965784.464167000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-35df9874750b3ac51b162081", "type": "url", "value": "http://tass.com/images/newStyle/normal/social/tw_top_norma_1.png", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1130, "frame_number": 43704, "display_filter": "frame.number == 43704", "timestamp_epoch": "1533965783.195053000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5af1ba4ed22e4fa9009e8ab3", "type": "url", "value": "http://tass.com/images/newStyle/normal/strelka.png", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1072, "frame_number": 43853, "display_filter": "frame.number == 43853", "timestamp_epoch": "1533965783.657067000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7af173994abead7f6ac3a2fe", "type": "url", "value": "http://tass.com/js/activeViewService.js?v=1533913284", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1135, "frame_number": 42022, "display_filter": "frame.number == 42022", "timestamp_epoch": "1533965775.393893000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-22b787e042bf6bc566a9259d", "type": "url", "value": "http://tass.com/js/adfox.asyn.code.scroll.js", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1075, "frame_number": 42289, "display_filter": "frame.number == 42289", "timestamp_epoch": "1533965775.986796000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b7e1a08162556688630883ea", "type": "url", "value": "http://tass.com/js/angular-1.2.4.min.js?v=1533913284", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1133, "frame_number": 41784, "display_filter": "frame.number == 41784", "timestamp_epoch": "1533965774.640184000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-927af26a6d913379ead7aebb", "type": "url", "value": "http://tass.com/js/audioWidget.js", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1071, "frame_number": 46441, "display_filter": "frame.number == 46441", "timestamp_epoch": "1533965791.370352000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-38a1c15ec2c734fff3385ca1", "type": "url", "value": "http://tass.com/js/common/angular-sanitize.min.js?v=1533913284", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1132, "frame_number": 41781, "display_filter": "frame.number == 41781", "timestamp_epoch": "1533965774.639806000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-cc98a5a1fa4cbb61f2d55e53", "type": "url", "value": "http://tass.com/js/common/angular-touch.js?v=1533913284", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1072, "frame_number": 41353, "display_filter": "frame.number == 41353", "timestamp_epoch": "1533965773.026022000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4bc81a1ff3d819761a681eaa", "type": "url", "value": "http://tass.com/js/common/infinite-scroll.js?v=1533913284", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1073, "frame_number": 41347, "display_filter": "frame.number == 41347", "timestamp_epoch": "1533965773.014142000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f69066c0dbc99e21cb09febf", "type": "url", "value": "http://tass.com/js/common/mainDirect.js?v=1533913284", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1134, "frame_number": 42021, "display_filter": "frame.number == 42021", "timestamp_epoch": "1533965775.393890000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0cecc40d9a73497eb2ed3ab2", "type": "url", "value": "http://tass.com/js/common/mainTopSlider.js?v=1533913284", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1070, "frame_number": 41850, "display_filter": "frame.number == 41850", "timestamp_epoch": "1533965774.796502000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-12879c404d2548e56d5b09cb", "type": "url", "value": "http://tass.com/js/common/mediaBlocksController.js?v=1533913284", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1132, "frame_number": 42230, "display_filter": "frame.number == 42230", "timestamp_epoch": "1533965775.861597000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-653a0761135ec60ac1446f1e", "type": "url", "value": "http://tass.com/js/common/photoModeController.js?v=1533913284", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1073, "frame_number": 41791, "display_filter": "frame.number == 41791", "timestamp_epoch": "1533965774.642796000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ec8854160fc26172d3d824b7", "type": "url", "value": "http://tass.com/js/common/pressCenterCalendar.js?v=1533913284", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1075, "frame_number": 41876, "display_filter": "frame.number == 41876", "timestamp_epoch": "1533965774.845808000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-759814d1da1cd619c480465b", "type": "url", "value": "http://tass.com/js/common/tass.js?v=1533913284", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1075, "frame_number": 41437, "display_filter": "frame.number == 41437", "timestamp_epoch": "1533965773.488179000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ebae22db7275da4d34b0bcbe", "type": "url", "value": "http://tass.com/js/common/textBroadcastController.js?v=1533913284", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1130, "frame_number": 46427, "display_filter": "frame.number == 46427", "timestamp_epoch": "1533965791.295458000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2eb4f469f09c131e8e876123", "type": "url", "value": "http://tass.com/js/doublephoto/doublephoto.js?v=1533913284", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1130, "frame_number": 42049, "display_filter": "frame.number == 42049", "timestamp_epoch": "1533965775.438635000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d718c17b55b7c192943946de", "type": "url", "value": "http://tass.com/js/hammer.min.js?v=1533913284", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1131, "frame_number": 42057, "display_filter": "frame.number == 42057", "timestamp_epoch": "1533965775.442355000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-44125596516c1bb995989de4", "type": "url", "value": "http://tass.com/js/highcharts/highcharts.js?v=1533913284", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1070, "frame_number": 42266, "display_filter": "frame.number == 42266", "timestamp_epoch": "1533965775.928489000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c39d69325a2a9b929a2c0029", "type": "url", "value": "http://tass.com/js/jquery-1.8.3.min.js?v=1533913284", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1070, "frame_number": 40113, "display_filter": "frame.number == 40113", "timestamp_epoch": "1533965770.052650000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c775783562b9152165daadb7", "type": "url", "value": "http://tass.com/js/jquery-ui.min.js?v=1533913284", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1071, "frame_number": 41126, "display_filter": "frame.number == 41126", "timestamp_epoch": "1533965772.393285000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8bb6616e49ac0cc54457e45a", "type": "url", "value": "http://tass.com/js/jquery.cookie.js?v=1533913284", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1073, "frame_number": 42248, "display_filter": "frame.number == 42248", "timestamp_epoch": "1533965775.873952000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5a2250945f7d9841ca7d1f48", "type": "url", "value": "http://tass.com/js/jwplayer7/jwplayer.js", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1072, "frame_number": 46437, "display_filter": "frame.number == 46437", "timestamp_epoch": "1533965791.350526000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-be77194c54689d6a71711032", "type": "url", "value": "http://tass.com/js/mainSliderWidget.js", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1135, "frame_number": 42488, "display_filter": "frame.number == 42488", "timestamp_epoch": "1533965776.394706000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7065842fce050a9b2ec65349", "type": "url", "value": "http://tass.com/js/social/socialDirective.js", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1070, "frame_number": 46484, "display_filter": "frame.number == 46484", "timestamp_epoch": "1533965791.472841000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4311afe49b9dd3c3f04e7790", "type": "url", "value": "http://tass.com/js/videoWidget.js", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1133, "frame_number": 46465, "display_filter": "frame.number == 46465", "timestamp_epoch": "1533965791.437407000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-bf1eddb4776f95e658b19003", "type": "url", "value": "http://tass.com/js/zoom/angular.rangeSlider.js?v=1533913284", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1070, "frame_number": 41365, "display_filter": "frame.number == 41365", "timestamp_epoch": "1533965773.105996000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2ad30590414d0868b4eff6c8", "type": "url", "value": "http://tass.com/js/zoom/ng-pinch-zoom.js?v=1533913284", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1074, "frame_number": 41391, "display_filter": "frame.number == 41391", "timestamp_epoch": "1533965773.250617000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f607558937ea40148bf00969", "type": "url", "value": "http://tass.com/js/zoom/zoomController.js?v=1533913284", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1074, "frame_number": 42204, "display_filter": "frame.number == 42204", "timestamp_epoch": "1533965775.813738000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-af36fa0ad616386092e7bd94", "type": "url", "value": "http://tass.com/site/getCurrencyDynamics?currency=USD", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1070, "frame_number": 44239, "display_filter": "frame.number == 44239", "timestamp_epoch": "1533965784.480473000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-df93778287688af42c54e87b", "type": "url", "value": "http://tpc.googlesyndication.com/safeframe/1-0-29/html/container.html", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1165, "frame_number": 44277, "display_filter": "frame.number == 44277", "timestamp_epoch": "1533965784.655535000" }, { "tcp_stream": 1166, "frame_number": 44398, "display_filter": "frame.number == 44398", "timestamp_epoch": "1533965785.099585000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c097d75e1657927c27d44b3b", "type": "url", "value": "http://vk.com/js/api/openapi.js?v=1533913284", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1076, "frame_number": 40209, "display_filter": "frame.number == 40209", "timestamp_epoch": "1533965770.487843000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4e3b5aa48737bccf00854375", "type": "url", "value": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1034, "frame_number": 39486, "display_filter": "frame.number == 39486", "timestamp_epoch": "1533965401.164021000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f3026828d356b0a60ae1cfcd", "type": "url", "value": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1035, "frame_number": 39496, "display_filter": "frame.number == 39496", "timestamp_epoch": "1533965406.568628000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0d7cbd7146e7b70d63742253", "type": "url", "value": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/D69B561148F01C77C54578C10926DF5B856976AD.crt", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 104, "frame_number": 4331, "display_filter": "frame.number == 4331", "timestamp_epoch": "1533964554.234128000" }, { "tcp_stream": 103, "frame_number": 4350, "display_filter": "frame.number == 4350", "timestamp_epoch": "1533964554.236277000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0d02afeb1125a2804880a40f", "type": "url", "value": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/DF3C24F9BFD666761B268073FE06D1CC8D4F82A4.crt", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 773, "frame_number": 28015, "display_filter": "frame.number == 28015", "timestamp_epoch": "1533965036.696949000" }, { "tcp_stream": 774, "frame_number": 28018, "display_filter": "frame.number == 28018", "timestamp_epoch": "1533965036.700513000" }, { "tcp_stream": 775, "frame_number": 28026, "display_filter": "frame.number == 28026", "timestamp_epoch": "1533965036.752397000" }, { "tcp_stream": 776, "frame_number": 28030, "display_filter": "frame.number == 28030", "timestamp_epoch": "1533965036.807677000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ce4eebb46188d5ebfc88ec85", "type": "url", "value": "http://www.google.com/ads/measurement/l?ebcid=ALh7CaQwkG-IqLuL2aDRnK970v9nGK385P_BkWxEG1yaUS4rlUVqUrlgZf-3JS25GWjS571y2n1JUt5kBztsnVFTQN5y-yC8Tw", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1208, "frame_number": 45898, "display_filter": "frame.number == 45898", "timestamp_epoch": "1533965789.194892000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1fe50dd387c89078c02c8ed4", "type": "url", "value": "http://www.googletagmanager.com/gtm.js?id=GTM-KX9ZXT", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1147, "frame_number": 43686, "display_filter": "frame.number == 43686", "timestamp_epoch": "1533965783.173455000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0ba6045ab36eeca428885917", "type": "url", "value": "http://www.googletagservices.com/tag/js/gpt.js", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1139, "frame_number": 43669, "display_filter": "frame.number == 43669", "timestamp_epoch": "1533965783.098093000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3c493a967583e617bdd93dd5", "type": "url", "value": "http://www.msftncsi.com/ncsi.txt", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 26, "frame_number": 385, "display_filter": "frame.number == 385", "timestamp_epoch": "1533964519.556735000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-643aff7c7625220b31a5675f", "type": "url", "value": "http://www.tns-counter.ru/V13a***R%3E*itartass_com/ru/UTF-8/tmsec=itartass_total/851285090", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1137, "frame_number": 43727, "display_filter": "frame.number == 43727", "timestamp_epoch": "1533965783.254353000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0058f646519d12c02bbb0738", "type": "url", "value": "http://www.tns-counter.ru/V13b***R%3E*itartass_com/ru/UTF-8/tmsec=itartass_total/851285090", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 1137, "frame_number": 43933, "display_filter": "frame.number == 43933", "timestamp_epoch": "1533965783.795213000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-457e49d734a4ccac9e0f7453", "type": "url", "value": "http://x.ss2.us/x.cer", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 158, "frame_number": 6267, "display_filter": "frame.number == 6267", "timestamp_epoch": "1533964560.250312000" }, { "tcp_stream": 159, "frame_number": 6271, "display_filter": "frame.number == 6271", "timestamp_epoch": "1533964560.267322000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null } ], "counts": { "observed": 1450, "suspicious": 3 }, "ioc_candidate_count": 3, "summary": "1453 typed observations; 3 evidence-backed IOC candidates for review, including 0 with direct malicious provider reports. No automatic confirmation or attribution.", "limitations": [ "No detections, no record, missing credentials and provider errors do not mean benign.", "Current reputation may postdate the capture. Shared hosting, DNS resolution and graph overlap do not transfer maliciousness.", "A recovered file is not proof of execution; hashes identify exported bytes, including partial objects.", "Public-looking enterprise domains may still be sensitive: review selected targets before external disclosure." ], "enrichment_plan": { "policy": "evidence-priority-v2", "items": [ { "observable_id": "observable-bb30103ef150f09e844062d3", "type": "domain", "value": "comet.tass.ru", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-11b3d20f8a01d79ad42e0f41", "type": "domain", "value": "contextual.media.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1b0dd5551415606cbe457769", "type": "domain", "value": "cookie.brealtime.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-675e39910228b5dfa2e4c4be", "type": "domain", "value": "cookiex.ngd.yahoo.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-984aee067a4f012bc805745f", "type": "domain", "value": "counter.yadro.ru", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2349944df038289ddc008eb0", "type": "domain", "value": "crt.comodoca.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8191c7cc91a36f601f6d72cd", "type": "domain", "value": "cs.adingo.jp", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-9fcbd8a9e74af65c74f74d50", "type": "domain", "value": "csi.gstatic.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a571e9fad414646fbe746f75", "type": "domain", "value": "d5p.de17a.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e49397f353a16eaec241c135", "type": "domain", "value": "da4pli3l5vc0d.cloudfront.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7d44eb5958550b1af1bf4f38", "type": "domain", "value": "delivery-us-west-1.openx.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3aab5fd9383dd7dd0efe87cf", "type": "domain", "value": "delivery.h.switchadhub.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-57144f135b27540fb905e6a0", "type": "domain", "value": "dh.serving-sys.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-15fda4888440cb6341a63462", "type": "domain", "value": "dis.criteo.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c59d0140ccf47ff5a187766b", "type": "domain", "value": "dmp.brand-display.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2809cf331a30704ba222b1d7", "type": "domain", "value": "dpm.demdex.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ad5003ef9f1e588efc65b737", "type": "domain", "value": "dsp.adfarm1.adition.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8646a5337888a87dad23dd8c", "type": "domain", "value": "dsp.adkernel.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d34ac1f2a7e7cf5d1ea80d22", "type": "domain", "value": "dsum-sec.casalemedia.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e9e3fbf0c31897f0b325f0f2", "type": "domain", "value": "e.nexac.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-43f6b6cbc03ab8c8d6eb3b59", "type": "domain", "value": "e1.emxdgt.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3a87287f435353503defda2f", "type": "domain", "value": "eb2.3lift.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6e1a93f3a9fdaf9a0fae2a5e", "type": "domain", "value": "ebdr3.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2004f81e88e2d4878108d5e9", "type": "domain", "value": "eus.rubiconproject.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-658b4ce6bf3e0568f425fc63", "type": "domain", "value": "fastlane-adv.rubiconproject.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-86579a762a791beb58709c7b", "type": "domain", "value": "fonts.googleapis.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-38d7323de0ab3caba05426f5", "type": "domain", "value": "fonts.gstatic.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-eece0e6729adf5e30e6fe012", "type": "domain", "value": "g2.gumgum.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b46539f1c03a93270a904d89", "type": "domain", "value": "googleads.g.doubleclick.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1b26b832fe1e9f183525ec02", "type": "domain", "value": "googleads4.g.doubleclick.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-65b759360ae29738d045a03a", "type": "domain", "value": "hb-api.omnitagjs.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-514fe42a5d35ec702e480d03", "type": "domain", "value": "hbevents.1rx.io", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b33a85bc3e0787a16f8d4549", "type": "domain", "value": "i.w55c.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a2ed7083552acda83b518aaf", "type": "domain", "value": "i.ytimg.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-89c54be412aee44309eb93a3", "type": "domain", "value": "ib.adnxs.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5145251affaaf1b062a1eb95", "type": "domain", "value": "id.rlcdn.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1375f5fd187dd6cce6d501b9", "type": "domain", "value": "idpix.media6degrees.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7dd1dfd5662aa187f805d9d0", "type": "domain", "value": "idsync.rlcdn.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e3ddf83be5fed8b14c4f0529", "type": "domain", "value": "iecvlist.microsoft.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-97e45d9ecdbff80ce6d5aa31", "type": "domain", "value": "image2.pubmatic.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-86d83f83c0069987d4c0d1bb", "type": "domain", "value": "image4.pubmatic.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7a395a985e651af891743b2d", "type": "domain", "value": "image6.pubmatic.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e96bd415eef27a6b07ef4c69", "type": "domain", "value": "images.outbrainimg.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-57df2292eaf71c1c9f231364", "type": "domain", "value": "images9.engageya.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8e23daf2a60b8358a3ec4c2b", "type": "domain", "value": "imasdk.googleapis.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-73767dc6c15c5c6af99169e2", "type": "domain", "value": "jadserve.postrelease.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e7629a85258e6d7181e0b5ca", "type": "domain", "value": "launcher.spot.im", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0119b6813c2ffccdb1512e66", "type": "domain", "value": "lax1-ib.adnxs.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-dcb34b89c642f47f20d50613", "type": "domain", "value": "load77.exelator.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-da4d673ee98ecb9679f298a8", "type": "domain", "value": "loadm.exelator.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f159deab208209c078c32e02", "type": "domain", "value": "m.adnxs.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6336d79044375aad2294587a", "type": "domain", "value": "magnetic.t.domdex.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-eb53093dcd92781a0e540110", "type": "domain", "value": "match.adsrvr.org", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-88f77ee88a86b19f6eaad083", "type": "domain", "value": "match.basebanner.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7d0bd35cd5022e15a011493d", "type": "domain", "value": "match.bnmla.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f41c4713ec6474ceb8ec1e60", "type": "domain", "value": "match.prod.bidr.io", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-04a87f3a5336e92f3c7df38f", "type": "domain", "value": "match.rundsp.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-adf208c36a5d05a6594f3a86", "type": "domain", "value": "match.sharethrough.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3753d237f7a2c54466a3efa6", "type": "domain", "value": "match.taboola.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-28d9eb110d5f47f41712aebf", "type": "domain", "value": "mc.yandex.ru", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-12942ee8a3001f755940b2ea", "type": "domain", "value": "melia.sp1.convertro.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c311fbc6050e92138c0fbee1", "type": "domain", "value": "mixi.media", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-93946d4a7081431aa283a3c3", "type": "domain", "value": "ml314.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b819e7d36432906e1cf8cf51", "type": "domain", "value": "mm.melia.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-534e5322c4e3bf3e9c43e998", "type": "domain", "value": "net.finam.ru", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e59311c08fb20b8c0af51d4d", "type": "domain", "value": "odb.outbrain.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4eb7c861cb1a62f848425159", "type": "domain", "value": "odr.mookie1.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5bec042dcab7d47937579369", "type": "domain", "value": "optimized-by.rubiconproject.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f60eac8385134cf667ac67e0", "type": "domain", "value": "ox.pxl.ace.advertising.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a99a0437f98e5c3179056703", "type": "domain", "value": "oxp.mxptint.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-911ae72f190fa32e3838772e", "type": "domain", "value": "p.adsymptotic.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-457ed152df621ea4a3e38a52", "type": "domain", "value": "p.rfihub.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ec433021fab82f7eec1a615b", "type": "domain", "value": "p.skimresources.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a8e6105d884d048675107ba0", "type": "domain", "value": "pagead2.googlesyndication.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ad039a0ce30356e0612d5434", "type": "domain", "value": "phototass1.cdnvideo.ru", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-99e3aa0a6d7432906d701cb1", "type": "domain", "value": "phototass2.cdnvideo.ru", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a385b7f9b9a7316f71e6052a", "type": "domain", "value": "phototass3.cdnvideo.ru", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1e0c9a0e45afb8a73414521d", "type": "domain", "value": "phototass4.cdnvideo.ru", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-16f3647d79427cf0605b99b0", "type": "domain", "value": "ping.chartbeat.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f5443057148f474bea8261c0", "type": "domain", "value": "pippio.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-473fc2880296de7bbdab3891", "type": "domain", "value": "pix.impdesk.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1862b8ed5bec246b3f4729bc", "type": "domain", "value": "pix.spot.im", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-301a347df53c17bd6cff0433", "type": "domain", "value": "pixel-a.sitescout.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7c02a893df3a2137c581d763", "type": "domain", "value": "pixel-sc2.adsymptotic.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-04273b1ed743f442b2a7aa0a", "type": "domain", "value": "pixel-sync.sitescout.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-92bfb54320330c5bad6bebba", "type": "domain", "value": "pixel-us-east.rubiconproject.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0b8996a7c95e2b06e026b2c3", "type": "domain", "value": "pixel.advertising.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-df3b20173a6d44e545e69bf4", "type": "domain", "value": "pixel.quantserve.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8d2a1ba9cf1336a35b3deec6", "type": "domain", "value": "pixel.rubiconproject.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5b6ce2b9b56197124f139a25", "type": "domain", "value": "pixel.sitescout.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b39ddba5a08e5303b6cc8064", "type": "domain", "value": "pixel.tapad.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b9abdd413cce01685a02612e", "type": "domain", "value": "pixeltrack.eyeviewads.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3a48bae8cb7731092b62319d", "type": "domain", "value": "platform.twitter.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-348543086827afd346122484", "type": "domain", "value": "pm.w55c.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-627c334137ed87675a3ef4bb", "type": "domain", "value": "pmp.mxptint.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f2d3174c71c159ee60e29404", "type": "domain", "value": "pop.yandex.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7e786227c2c45979014fe7d4", "type": "domain", "value": "pp.lp4.io", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a126fe54f8ce5682702972b1", "type": "domain", "value": "pr-bh.ybp.yahoo.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-657cb93836feea7bb029313f", "type": "domain", "value": "pre-usermatch.targeting.unrulymedia.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0fdc17515adbf7a03fec3559", "type": "domain", "value": "prod.y-medialink.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6047aaca5aa5c37fe84a2c19", "type": "domain", "value": "pubads.g.doubleclick.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d013560856fc443728361e54", "type": "domain", "value": "pubmatic-match.dotomi.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-036721e5f9c08e95b177f8a9", "type": "domain", "value": "pubmatic2waycm-atl.netmng.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e46806fd32691487e29a329d", "type": "domain", "value": "px.adhigh.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7aa890a1dfa0523f7d51e3fb", "type": "domain", "value": "px.moatads.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-423c8b70620caaedf99c3a90", "type": "domain", "value": "px.owneriq.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1d279e8d30452581de430ff3", "type": "domain", "value": "px.powerlinks.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2453d50bb7e4e17ef4c75e82", "type": "domain", "value": "pxl.connexity.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c4fb16c91ff7cd18c93ad7e3", "type": "domain", "value": "qcx.quantserve.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-85b74252da91721d4e1fa8f6", "type": "domain", "value": "r.nexac.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-fbe494ec6ac0c31dc67925bf", "type": "domain", "value": "rbp.mxptint.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ee54ca12a257766bcf294ef1", "type": "domain", "value": "recs.engageya.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f3a959fcb6569669910e9947", "type": "domain", "value": "relap.io", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-65618a4c15665225c61e52c0", "type": "domain", "value": "rp.gwallet.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f601a2cb548db8cb2a783507", "type": "domain", "value": "rtax.criteo.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7da06e59cac063e4b6369bc4", "type": "domain", "value": "rtb-csync.smartadserver.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-237c2cef576f2649250ea083", "type": "domain", "value": "rtb.adentifi.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-02a8995e9e12e950ec006c1c", "type": "domain", "value": "rtb.gumgum.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8863f98a7a5584496b653990", "type": "domain", "value": "rtb.openx.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6a273ea72e2d1b6277c76baa", "type": "domain", "value": "rtb0.doubleverify.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0ea340e5a86e188e0b49e2ba", "type": "domain", "value": "rtr.innovid.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3e0c356a220d1f0120c885fb", "type": "domain", "value": "rub.pxl.ace.advertising.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-28fbb95e7fbbc42a23b96719", "type": "domain", "value": "rubicon-match.dotomi.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-020bfa234b9f3cefb3b7ea83", "type": "domain", "value": "rum-collector-2.pingdom.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-915e90fca04876fbb1627083", "type": "domain", "value": "rum-collector.pingdom.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-45e78d89921aeaaab0f10b80", "type": "domain", "value": "rum-static.pingdom.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-40d7913fa415047f0de38360", "type": "domain", "value": "ruptly-d.openx.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5c78f52c22c49b1611a1a88c", "type": "domain", "value": "s-static.innovid.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f87c37af5eb886e787990dcb", "type": "domain", "value": "s.amazon-adsystem.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-cb643c32a406f574d576366c", "type": "domain", "value": "s.innovid.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-22739733a5ff64406b6cef0b", "type": "domain", "value": "s.thebrighttag.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1df8d2aec8b6709f8fe2484e", "type": "domain", "value": "s.ytimg.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b4c3b0aceb29fffbb1f1ebd9", "type": "domain", "value": "s0.2mdn.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-429583988cd0cd07c1c2c693", "type": "domain", "value": "s2.adform.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ff81727a35b8413b6a99dc70", "type": "domain", "value": "saxp.zedo.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2c913dd76e2486223bad87ba", "type": "domain", "value": "sb.scorecardresearch.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-06294fd4cceddd09616df55e", "type": "domain", "value": "secure-assets.rubiconproject.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-03a0c05ea51d08a8bdc0d39f", "type": "domain", "value": "secure.adnxs.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-9d396da74c91a84e4005ab93", "type": "domain", "value": "securepubads.g.doubleclick.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8c7480a1e7bbc936e8367546", "type": "domain", "value": "simage2.pubmatic.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c541e06dd8fdccadd046d445", "type": "domain", "value": "simage4.pubmatic.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a66177e6ad5bf9afeabc8af0", "type": "domain", "value": "small-video.edgecast.syn-cdn.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-905f3038f62260632373b4b7", "type": "domain", "value": "smi2.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1c52ff59ffc1a921dafa4d9c", "type": "domain", "value": "smi2.ru", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-639421cdbb4a7ac54093323c", "type": "domain", "value": "smtp.yandex.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e970649f782d9ce881145170", "type": "domain", "value": "ss3.zedo.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-15b9d82a9c8a53e806f88827", "type": "domain", "value": "ssl.trustwave.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ce1fd16a4cfab56f335ee427", "type": "domain", "value": "stags.bluekai.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5efb2c47f38bcae101ac79f4", "type": "domain", "value": "stat.media", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-71119eac0fa72837c91c31f6", "type": "domain", "value": "static.chartbeat.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-22d785f45d8af228c076c4f3", "type": "domain", "value": "static.criteo.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-de6d640b8c40ffea9be0bb7e", "type": "domain", "value": "static.doubleclick.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-baeaa698b6eecdba87b814e7", "type": "domain", "value": "static.mixi.media", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d46353b238dfea541613e838", "type": "domain", "value": "static2.mixi.media", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d841dc4fba998a511800844e", "type": "domain", "value": "static4.mixi.media", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0260b6f9624747d3f21c6bdd", "type": "domain", "value": "static5.mixi.media", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e3af2e201ccd463d8408bdc2", "type": "domain", "value": "stats.g.doubleclick.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6830bd86bf151cf528592b13", "type": "domain", "value": "su.addthis.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-60ab8cb6148eddf58a42d90f", "type": "domain", "value": "synacor.autoplay-plugins.static-origin.syn-cdn.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4d8b31486e214b8b299baecb", "type": "domain", "value": "sync-tm.everesttech.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-03cfc4a9abad3c07a273f07a", "type": "domain", "value": "sync.1rx.io", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-077d732115b658a278858ae7", "type": "domain", "value": "sync.adotmob.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3c0b506b1a253b6bd83095b5", "type": "domain", "value": "sync.aralego.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1df51e6d328380bf802f2668", "type": "domain", "value": "sync.crwdcntrl.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d6d20f0e0b8b14e52bec9cb4", "type": "domain", "value": "sync.extend.tv", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-70db6675cba1133cab8a89eb", "type": "domain", "value": "sync.ipredictive.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-637a468a7136b9a0e96224f3", "type": "domain", "value": "sync.ligadx.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f41604ef74c26925619e658d", "type": "domain", "value": "sync.mathtag.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-91d26e2caf83668f569287b7", "type": "domain", "value": "sync.search.spotxchange.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d0ad87d83b940e521dec400b", "type": "domain", "value": "sync.springserve.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8fbf32ad297ed39e32b126c6", "type": "domain", "value": "sync.teads.tv", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f9fa8ac6d816991f38332f0b", "type": "domain", "value": "sync.tidaltv.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b592ac0bf7ba67806fe96635", "type": "domain", "value": "synchroscript.deliveryengine.adswizz.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-737ea5e6401fb1563d580f4c", "type": "domain", "value": "syndication.twitter.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4a651af8135c3e607fee3148", "type": "domain", "value": "t.cwkuki.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6d436e72d60c68bfa80f25b2", "type": "domain", "value": "t.lkqd.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-bfd4f01fb5e9280dec2412ed", "type": "domain", "value": "t.mookie1.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3ac6be24016c5515d382b5c5", "type": "domain", "value": "t.wayfair.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-16864e5fdda2d0203e42c59a", "type": "domain", "value": "tag.1rx.io", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-488dd99b2e3243d1ebc9e36a", "type": "domain", "value": "tags.bluekai.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-59bcde5efce29d9b5252d8a9", "type": "domain", "value": "tags.crwdcntrl.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d36da193eb5ec8e3057b0268", "type": "domain", "value": "target.mixi.media", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-20eabb31357d266f1353b7e1", "type": "domain", "value": "teutorigos-cat.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-77085cead15e1e92cdd71c86", "type": "domain", "value": "thrtle.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a3d92c3b10000f7b9dc41231", "type": "domain", "value": "token.rubiconproject.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-255e87911e59b41153333be3", "type": "domain", "value": "tpc.googlesyndication.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a94419c92ff8df0945c9e032", "type": "domain", "value": "tps.doubleverify.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3d3a664b5fb06d9361a7bdba", "type": "domain", "value": "tps700.doubleverify.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e9cc20913710a8f7ce65a45d", "type": "domain", "value": "tps702.doubleverify.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b9c3760cca1254ca0f41a646", "type": "domain", "value": "track.eyeviewads.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-dded06e97a7431cfd3ca8af4", "type": "domain", "value": "trc.taboola.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f7d7b04b96fc88f0fa96e872", "type": "domain", "value": "tru.am", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3f3240459f55fd88e32b5c06", "type": "domain", "value": "tt.onthe.io", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-61d5bc0985707baae74d7d8e", "type": "domain", "value": "tt1.zedo.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-575e147c253236dde73615a3", "type": "domain", "value": "tt3.zedo.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ae798a2f813a380f8fb83d55", "type": "domain", "value": "uat-net.technoratimedia.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-bd78d613be7025b9ac548b74", "type": "domain", "value": "uat-secure.technoratimedia.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7ddf00bd86473f5ba4fe5bf0", "type": "domain", "value": "ucs02.engageya.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7fb09f1e9b9437ca3b15a0c4", "type": "domain", "value": "um.simpli.fi", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b3e63eba85e4b91e7a7f62e8", "type": "domain", "value": "us-u.openx.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5262bc4a0a545ee10c81f277", "type": "domain", "value": "v.lkqd.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-71ef8a3ce9222a08d8513b22", "type": "domain", "value": "vcdn.adnxs.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6a9d0e2848434463b998229c", "type": "domain", "value": "vid-io.springserve.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-250aa3332cacace8ab00b941", "type": "domain", "value": "vid-io.springserve.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f6be2edc73c2e55fbb01531e", "type": "domain", "value": "vid.springserve.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0ac9009813f07ad6657fce5e", "type": "domain", "value": "vpaid.springserve.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-06a4eb58e2aed2bd3e3716b8", "type": "domain", "value": "widget.engageya.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-9fd76303214145ce412e74d5", "type": "domain", "value": "widgets.outbrain.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f665b34099b63776fd85eb2e", "type": "domain", "value": "www.download.windowsupdate.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-21da2dd0fd56b47ebecaf3d6", "type": "domain", "value": "www.google-analytics.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-fa186fa730f7bbff48167855", "type": "domain", "value": "www.google.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2f4cd8106dd545bea9c25565", "type": "domain", "value": "www.googletagservices.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-cc152019295b5193b24fda22", "type": "domain", "value": "www.msftncsi.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ef286096e361e1968a9523d1", "type": "domain", "value": "www.rt.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1d3c4b53bc5f07778c954ff5", "type": "domain", "value": "www.tns-counter.ru", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e586ef68a407a60bb6b18881", "type": "domain", "value": "www.youtube.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6afafd5a71fc08769c1add69", "type": "domain", "value": "x.bidswitch.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-fe12c54b83f87a28d66ee186", "type": "domain", "value": "x.dlx.addthis.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2479630fb1e6308fe76cc1d5", "type": "domain", "value": "x.skimresources.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e40df2c21da5dbfba56c517c", "type": "domain", "value": "x.ss2.us", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-293b6374167717db2b89f887", "type": "domain", "value": "yastatic.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b51f981b7d92a561278c829f", "type": "domain", "value": "z.moatads.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2c430604a46045bf6acb687f", "type": "domain", "value": "zedo-d.openx.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-fe054b0cdc25182dc089210f", "type": "domain", "value": "www.bing.com", "priority": 45, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0caaf79606fdc5dc37e9590a", "type": "ipv4", "value": "103.5.149.77", "priority": 45, "reasons": [ "http_request-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a037596f43edfed333ec38c1", "type": "ipv4", "value": "104.110.128.239", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a621802d9ba001552cbe2482", "type": "ipv4", "value": "104.16.240.184", "priority": 45, "reasons": [ "http_request-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-608b18b4b08109dee427e4cd", "type": "ipv4", "value": "104.16.90.188", "priority": 45, "reasons": [ "http_request-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-65da8391848ccf80f3fd04af", "type": "ipv4", "value": "104.193.83.156", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ffa75f86e2186028de6256e9", "type": "ipv4", "value": "104.20.21.239", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c84183c56554dea3c309dbcf", "type": "ipv4", "value": "104.24.246.16", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-13b0d87c753b9debdb9e96e9", "type": "ipv4", "value": "104.25.163.34", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0248c44d6d3cc5ba99b1cea1", "type": "ipv4", "value": "104.254.150.179", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-19d1bd043b1eaa1798c9ca6c", "type": "ipv4", "value": "104.254.150.69", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7795e4a894ba0c383de44beb", "type": "ipv4", "value": "104.254.150.77", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-95641815635b924ec8a0258e", "type": "ipv4", "value": "104.36.113.17", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8eeacae169fe041a0233c110", "type": "ipv4", "value": "104.36.113.23", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b57aa0cc1043b689e65ea7da", "type": "ipv4", "value": "104.36.113.24", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a66e65aac432fb8f9c5ba1e8", "type": "ipv4", "value": "107.178.242.85", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-9c8f7bce39f5215993f65879", "type": "ipv4", "value": "107.178.254.65", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-148f89512a04fa71fb41b300", "type": "ipv4", "value": "109.201.156.81", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0903e43d0eecf956699fabc0", "type": "ipv4", "value": "109.232.197.110", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-88a32548d4051118930887f8", "type": "ipv4", "value": "13.107.4.50", "priority": 45, "reasons": [ "http_request-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4b451257b265f47991f3fa71", "type": "ipv4", "value": "13.33.106.254", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-83270b02459a1d5755cf1a29", "type": "ipv4", "value": "13.33.107.160", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ae7470064df29eb6ce78ca84", "type": "ipv4", "value": "13.33.78.101", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2b3451f1322400ec96dc5360", "type": "ipv4", "value": "13.33.78.186", "priority": 45, "reasons": [ "http_request-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b516ddc5c64a715511015154", "type": "ipv4", "value": "13.57.70.199", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-abde429364714712b36bd160", "type": "ipv4", "value": "136.243.151.13", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a1f67a43b4d0328ad2b42709", "type": "ipv4", "value": "136.243.25.70", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8e5668d096ab487d142678da", "type": "ipv4", "value": "136.243.42.249", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2109a3bd4b88c075601377db", "type": "ipv4", "value": "142.93.61.37", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-02bb05cec52c8fae7a4c8e93", "type": "ipv4", "value": "146.20.132.243", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-89a8810622fc743e24be48a8", "type": "ipv4", "value": "146.20.133.87", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-061cd4bb3a6285e0e9e82218", "type": "ipv4", "value": "148.251.82.59", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-fe33be4f5c690aca2164e9f5", "type": "ipv4", "value": "149.174.66.131", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d4e72a469971dba3b5a8d8f0", "type": "ipv4", "value": "151.101.0.166", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8fc6cab21b2d851315f7b759", "type": "ipv4", "value": "151.101.2.2", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e121f2e249a0fdabea83979e", "type": "ipv4", "value": "151.101.2.49", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7dfa23bf13eaf7d72d956b6b", "type": "ipv4", "value": "151.101.41.108", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4e33cc23e91fa3598afad5fc", "type": "ipv4", "value": "151.101.53.108", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-cee83611b8ba8112bcb9594f", "type": "ipv4", "value": "151.236.120.42", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8a2bea20390fba77b5cdd505", "type": "ipv4", "value": "151.236.85.22", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-014964de481a3052c7d6f8dd", "type": "ipv4", "value": "151.236.98.22", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-52622f99b3a8cce37923e030", "type": "ipv4", "value": "152.195.14.112", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-587813915083f68c98e1be61", "type": "ipv4", "value": "156.154.202.36", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-942f9234717f0ecae59f93fd", "type": "ipv4", "value": "161.170.239.188", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a126e0e9cef74f9438e1d7d2", "type": "ipv4", "value": "162.210.199.69", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-52faf923055257c8d1a5ef2a", "type": "ipv4", "value": "172.217.0.42", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-9b1bea06491420ec65a3c29d", "type": "ipv4", "value": "172.217.0.54", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0c9773acbe67157c814a5a61", "type": "ipv4", "value": "172.217.6.66", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1857171736f65c1c8722f450", "type": "ipv4", "value": "172.217.6.78", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ebefae67f94a1451f2f50c30", "type": "ipv4", "value": "173.0.153.44", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-61531f0db337bbd6f0f4748e", "type": "ipv4", "value": "173.239.42.221", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-de221b5755ad6372bc175c44", "type": "ipv4", "value": "173.241.250.104", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-309c7b6ef4fe0172c4dde9de", "type": "ipv4", "value": "173.241.250.143", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2af8523b085bffc65a309ca8", "type": "ipv4", "value": "173.241.250.220", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5a6bd7f6567123003fd2dfef", "type": "ipv4", "value": "178.154.131.215", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5ec7da20798587dc64468638", "type": "ipv4", "value": "18.218.6.11", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-61c0c0ba8b7b063f387a3976", "type": "ipv4", "value": "18.218.60.224", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4943fba9e6b855e4a471b376", "type": "ipv4", "value": "184.26.122.58", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6bdd303f46cee74de2527256", "type": "ipv4", "value": "185.167.164.37", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-538026c3d03b50be81c3fa55", "type": "ipv4", "value": "185.167.164.39", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2cfd40d240524ced25427598", "type": "ipv4", "value": "185.167.166.41", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b2716b498a26bbd71310a7d9", "type": "ipv4", "value": "185.180.13.28", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-9c099f0fd46ef6775f80364f", "type": "ipv4", "value": "185.28.71.53", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3a12d2b7eda868b74f7c1dd2", "type": "ipv4", "value": "185.86.137.43", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6ebcff8c6bdf1799c1a5cf00", "type": "ipv4", "value": "185.99.9.117", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-479266ab680239d5d28915ca", "type": "ipv4", "value": "192.229.163.25", "priority": 45, "reasons": [ "http_request-peer", "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-67640acc70c6d9b8cc78c390", "type": "ipv4", "value": "192.229.210.158", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3ba29e3f71badf83d4c8d746", "type": "ipv4", "value": "192.35.177.64", "priority": 45, "reasons": [ "http_request-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8af1714d721911bf1ba38e75", "type": "ipv4", "value": "194.226.130.228", "priority": 45, "reasons": [ "http_request-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-29cf7a6571d5ab232edfb7ea", "type": "ipv4", "value": "194.226.130.229", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ddc5f546a551755ec81f2e04", "type": "ipv4", "value": "195.244.31.10", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4381840b7c5030bd80c0bd6b", "type": "ipv4", "value": "198.23.90.60", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c95601b6a07791e2e35b2165", "type": "ipv4", "value": "198.54.12.145", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a39279106f37ad2aa60eb510", "type": "ipv4", "value": "198.70.71.144", "priority": 45, "reasons": [ "http_request-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-40cb45cab86c23e6059b6823", "type": "ipv4", "value": "198.70.71.161", "priority": 45, "reasons": [ "http_request-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-74187595b41aea54aa066a74", "type": "ipv4", "value": "199.38.167.128", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1c7f0a807909521e8b4a1789", "type": "ipv4", "value": "199.59.149.201", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6dfeabd0e470fe4d17715343", "type": "ipv4", "value": "204.11.109.68", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-27efd57c37e8e3e5cf52cdb6", "type": "ipv4", "value": "204.2.197.201", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-57ec0a4947bec6d1b7f41c52", "type": "ipv4", "value": "204.2.250.100", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0ed22b80d10e2ad7ec0de9e4", "type": "ipv4", "value": "204.79.197.200", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-afed5841129f5f2873ec4b22", "type": "ipv4", "value": "205.180.87.137", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-083cf6e09d3074b369ffbb44", "type": "ipv4", "value": "205.180.87.204", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3cd0ad3c560ed16ab07ff408", "type": "ipv4", "value": "205.185.216.10", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-621426fac0f69dbad84af286", "type": "ipv4", "value": "205.185.216.42", "priority": 45, "reasons": [ "http_request-peer", "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c6f91e92ba642fd60e7fe1bf", "type": "ipv4", "value": "207.244.102.143", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-07d8a8d7e44d2c4c2e0a6bac", "type": "ipv4", "value": "207.244.80.166", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-80954f0d15033a317ff35eca", "type": "ipv4", "value": "208.185.50.80", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f4933a964c80490792f7e548", "type": "ipv4", "value": "209.191.163.209", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1e65ebe2cbcf6a090e74dbbf", "type": "ipv4", "value": "209.58.136.30", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d4f0d7eed12fb5675adbbdf4", "type": "ipv4", "value": "213.155.156.164", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d280dbeea7eadd96c459f3aa", "type": "ipv4", "value": "213.180.193.90", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-89efe3582775e8524cd7302f", "type": "ipv4", "value": "216.115.100.123", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-413ced18688a4b04daf33a10", "type": "ipv4", "value": "216.200.232.221", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-588b5b87a59e2859fe2d7039", "type": "ipv4", "value": "216.52.31.73", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-087eaafca5f018163e9d5267", "type": "ipv4", "value": "216.58.192.1", "priority": 45, "reasons": [ "http_request-peer", "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a5026c990fc57d42b9dadd45", "type": "ipv4", "value": "216.58.192.10", "priority": 45, "reasons": [ "http_request-peer", "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4fdf79b5f41033dc08c0b6e1", "type": "ipv4", "value": "216.58.192.14", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3ba9ffa3db30fc9ec2ec2df4", "type": "ipv4", "value": "216.58.192.2", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-501e31511bf9be9c26cdd3d4", "type": "ipv4", "value": "216.58.192.3", "priority": 45, "reasons": [ "http_request-peer", "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-79f8f8d2bbd841b4c7808256", "type": "ipv4", "value": "216.58.192.4", "priority": 45, "reasons": [ "http_request-peer", "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-834a319cb7d70fb18ca4b3d7", "type": "ipv4", "value": "216.58.192.6", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f9320887d1145c2a8668ef2c", "type": "ipv4", "value": "216.58.194.162", "priority": 45, "reasons": [ "http_request-peer", "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-582286e9b243895553303f57", "type": "ipv4", "value": "23.108.108.218", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f186b7a30cf188031694b2ce", "type": "ipv4", "value": "23.20.36.175", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2fa8d351ff66ba5af50be524", "type": "ipv4", "value": "23.213.38.151", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-bc3ade17457388cce13da436", "type": "ipv4", "value": "23.220.174.162", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3ea582830ea8d63406aa69d5", "type": "ipv4", "value": "23.220.187.187", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e5585a04b58b30d53a981b24", "type": "ipv4", "value": "23.35.180.245", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b3c7a99710a7492fa18da457", "type": "ipv4", "value": "23.35.182.113", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-bb83a84dd868154fe61699c3", "type": "ipv4", "value": "23.43.176.205", "priority": 45, "reasons": [ "http_request-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-211be56b74ee30b8f8416f60", "type": "ipv4", "value": "23.54.20.214", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-158f297ea5924c7ec244ed46", "type": "ipv4", "value": "23.54.20.74", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a1b055cb5c4deb7816166334", "type": "ipv4", "value": "23.54.21.179", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-87e07cf3725235da23ac596b", "type": "ipv4", "value": "23.54.21.180", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-208a2c6e13a924da61190006", "type": "ipv4", "value": "23.54.21.240", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3cee285db96af4511daf173d", "type": "ipv4", "value": "23.54.22.209", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d5e7a38406e2a1a2ea95bfb6", "type": "ipv4", "value": "23.54.22.27", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ac7791c29f543408d156fa2d", "type": "ipv4", "value": "23.54.23.55", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ae978053ec67a1e5f71b03ce", "type": "ipv4", "value": "23.55.114.34", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-50df5609eb44df3b0625c2ae", "type": "ipv4", "value": "23.55.50.209", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a1f503b2c8038a6b08868043", "type": "ipv4", "value": "23.73.225.194", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-243c45a75531b15a532a4334", "type": "ipv4", "value": "23.73.231.65", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c0bdc0c1e10eb8fcf3bce013", "type": "ipv4", "value": "23.73.239.75", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-013df11602e2be35975e4821", "type": "ipv4", "value": "23.8.170.84", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2f956a2c12a37628b24ac5fe", "type": "ipv4", "value": "34.194.201.62", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-668c8f7f027f8719147d3bca", "type": "ipv4", "value": "34.198.191.149", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6bddecb1968cc4f6c651eb28", "type": "ipv4", "value": "34.207.5.71", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-74bde356b3cdc36e3cdee3ed", "type": "ipv4", "value": "34.211.69.152", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5e405cc774d9b65313d73c6a", "type": "ipv4", "value": "34.213.12.32", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-97f4233851dc0e5d1c9eb795", "type": "ipv4", "value": "34.234.149.11", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-fcf2a0e27cf43820bd2fb734", "type": "ipv4", "value": "34.236.123.105", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-438321f28f2a6b6f753c3eec", "type": "ipv4", "value": "34.236.230.194", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-71d496e51dc8f502bf8c8730", "type": "ipv4", "value": "34.237.234.13", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-00aa0ed8bca45ec6b0f8aa05", "type": "ipv4", "value": "34.246.244.104", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-68610d9c9b7c67f355ff2b87", "type": "ipv4", "value": "35.164.209.30", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-9456c528ae852398161ed5c0", "type": "ipv4", "value": "35.164.52.21", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-39d7f9d835f3eb3078953db9", "type": "ipv4", "value": "35.171.141.177", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1eb9063d31b45d713108ca1d", "type": "ipv4", "value": "35.185.244.37", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2e213667bf2722b4728a6de7", "type": "ipv4", "value": "35.186.202.217", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5ebba28d009fb48bc50441d9", "type": "ipv4", "value": "35.186.208.100", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8695223ef6b5a72b99890967", "type": "ipv4", "value": "35.186.239.238", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-518b0bacfbcde3f15cddabff", "type": "ipv4", "value": "35.190.74.53", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5c4c15fc4aa9ffeb15b63583", "type": "ipv4", "value": "35.190.91.160", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-496226d13929c138dedd6d6f", "type": "ipv4", "value": "35.201.123.46", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-dda6da9158530dfa5d6000fd", "type": "ipv4", "value": "35.227.197.177", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7ed394a44425bfe35575b7f1", "type": "ipv4", "value": "37.157.2.234", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-58799499cf5cd9711b558cfe", "type": "ipv4", "value": "38.106.10.132", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-21365f259a05880c826f8ac6", "type": "ipv4", "value": "38.106.34.105", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2863319e50d31c2dbc4bef1c", "type": "ipv4", "value": "4.78.226.232", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e04236cc6da757bb076a887e", "type": "ipv4", "value": "4.78.226.233", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d25d9b257c34980d6bc80789", "type": "ipv4", "value": "4.78.226.234", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-54fd62277162d4dc1c99a816", "type": "ipv4", "value": "46.161.36.8", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-57024d05517a705d7d489d8f", "type": "ipv4", "value": "5.39.44.195", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-34a77509307bf3fe735b61d4", "type": "ipv4", "value": "50.16.201.198", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f666b4ee856681468cb552c7", "type": "ipv4", "value": "52.11.229.48", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e49ba89113912acdfed35acd", "type": "ipv4", "value": "52.20.63.23", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a63b9d8c062c3d4c6071f372", "type": "ipv4", "value": "52.201.177.113", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d1d5de2b2a80f1e2cc2c1518", "type": "ipv4", "value": "52.203.231.138", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-11d9807ab403353312975a16", "type": "ipv4", "value": "52.206.38.25", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-43ee04eaa59f7cd391a2c505", "type": "ipv4", "value": "52.21.201.75", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-28a6ad1919172eebc85666e3", "type": "ipv4", "value": "52.211.165.177", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1f0e2e0a86bdec7383ba86c9", "type": "ipv4", "value": "52.22.112.153", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d4cada7f939bdf03a6e6484d", "type": "ipv4", "value": "52.24.61.237", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-731c74b88099cf6250dc64f1", "type": "ipv4", "value": "52.26.87.58", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f5c21071b5fd5fef0d0464cf", "type": "ipv4", "value": "52.27.237.90", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-12e3fe34645eaee93470a71e", "type": "ipv4", "value": "52.33.44.132", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0083b3d579d3ac15c6f63d20", "type": "ipv4", "value": "52.39.151.69", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-83b94f56ff507b3b80d214f7", "type": "ipv4", "value": "52.4.175.160", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6049d478f1da0b5130d952ff", "type": "ipv4", "value": "52.42.116.214", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d1ff3e00747cf018c8b2ef08", "type": "ipv4", "value": "52.44.165.199", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7995e2f7f7dfa19bb5951096", "type": "ipv4", "value": "52.44.44.54", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-85d6acfd9c04def89e2be25d", "type": "ipv4", "value": "52.52.136.196", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b1d4da6c7420fe31e3de44e6", "type": "ipv4", "value": "52.58.174.155", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d47f632f4e6d6e7084b0a5d3", "type": "ipv4", "value": "52.74.108.147", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0ed2101b590220797b2dfa0a", "type": "ipv4", "value": "52.8.202.139", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4a16a7f8e366cf7fcbfda235", "type": "ipv4", "value": "52.8.226.99", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-79e4f2b80091dbdf15515bb3", "type": "ipv4", "value": "52.89.90.109", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ac063cd55bec8d3da0489802", "type": "ipv4", "value": "52.9.59.235", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f9dd193e0860d59fb15f6449", "type": "ipv4", "value": "52.9.78.114", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6c6a66a6462d2c07a175e564", "type": "ipv4", "value": "52.94.232.32", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d6fdb704e5db078d62ad3ce8", "type": "ipv4", "value": "54.148.146.218", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-306348588e7088547999a648", "type": "ipv4", "value": "54.175.110.202", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a95d058df01cf746c4bef8cc", "type": "ipv4", "value": "54.176.157.57", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8d467e0c251cffee161ab947", "type": "ipv4", "value": "54.183.210.45", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b42161c14dce378dedd88031", "type": "ipv4", "value": "54.183.248.197", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-673a24154812fe5a92a0c479", "type": "ipv4", "value": "54.183.95.126", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0f177f23f5644e02f25d0322", "type": "ipv4", "value": "54.186.116.83", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1846c7d36cf4fd3d5ffcf397", "type": "ipv4", "value": "54.186.237.130", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4225f6dfcb070aea3e9e8902", "type": "ipv4", "value": "54.187.167.76", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7e07f4566979d055956317cf", "type": "ipv4", "value": "54.191.20.146", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-94fbfb4d70c535df5dc622ff", "type": "ipv4", "value": "54.191.223.36", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-72d0da305d189bbaa1e9ae61", "type": "ipv4", "value": "54.191.4.242", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d87c85880e289b3efb5ee611", "type": "ipv4", "value": "54.193.113.6", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0ca8c2c8b5498c76535b793e", "type": "ipv4", "value": "54.196.242.147", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d9b30efc9a481859c50ac5f8", "type": "ipv4", "value": "54.209.46.223", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-702aef77e04cd424e9e68c7e", "type": "ipv4", "value": "54.209.71.223", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e44edde17c00b00fd906f19f", "type": "ipv4", "value": "54.214.11.239", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3f2cdcb984f12b5566780801", "type": "ipv4", "value": "54.217.217.143", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-811d336be6c56477bff29e18", "type": "ipv4", "value": "54.236.177.89", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-11542b87bbadaaa0e07a7ab6", "type": "ipv4", "value": "54.241.31.242", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f0b66162802a0121efe85a7e", "type": "ipv4", "value": "54.246.133.167", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-fec070af895fe97c7370e6f1", "type": "ipv4", "value": "54.69.70.7", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1b76a1f0f40604c73d394033", "type": "ipv4", "value": "54.84.105.44", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4cfa1172775acd1c34d66865", "type": "ipv4", "value": "54.92.93.205", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3bcd568fe9b5ae7182a7cf78", "type": "ipv4", "value": "63.251.109.87", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0a099613f76588b890f09ff9", "type": "ipv4", "value": "63.251.252.12", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6fcd67125f3051f8a2b9a785", "type": "ipv4", "value": "63.251.253.231", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6b35643c27a83f5e670d00bc", "type": "ipv4", "value": "64.125.223.109", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f1064ed1a69598839a2ca0df", "type": "ipv4", "value": "64.233.184.94", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c0d27db1a0877b9380b89947", "type": "ipv4", "value": "64.38.119.27", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6b11426fca27e8a67ddd5f41", "type": "ipv4", "value": "64.41.197.55", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-775083b89577e0a4aa974e78", "type": "ipv4", "value": "64.7.205.2", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-cd2da6469743ebdeea4fa4dd", "type": "ipv4", "value": "67.195.229.45", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7068cfeb333bd65da1b22a0c", "type": "ipv4", "value": "69.168.106.81", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f4c102db0976aed41e44ef09", "type": "ipv4", "value": "69.174.248.224", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f999d5bc317fa9b8c1f96ebb", "type": "ipv4", "value": "69.174.248.228", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-74f879bff1c4d911a68379d0", "type": "ipv4", "value": "69.194.244.11", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2c670dcfc0aa8037853ad80c", "type": "ipv4", "value": "70.42.132.5", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5f5a3f6ad056427a4962d51b", "type": "ipv4", "value": "72.21.81.200", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2015ff731618f98609ef5b64", "type": "ipv4", "value": "72.21.91.113", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f91ed4cef3562179f8f28f67", "type": "ipv4", "value": "72.5.64.63", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-977962eadce3483aefb46cca", "type": "ipv4", "value": "74.119.117.100", "priority": 45, "reasons": [ "http_request-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e90165ced29ebd8a28917130", "type": "ipv4", "value": "74.119.117.129", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-503bc9b0064e5ec900b14608", "type": "ipv4", "value": "74.119.117.70", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2782a69ec685fa5e0f316f95", "type": "ipv4", "value": "74.119.117.94", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a9cac9058dcd5fed3c4fb945", "type": "ipv4", "value": "74.125.195.154", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-73df03384a9a4780cd485eee", "type": "ipv4", "value": "74.125.195.155", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1fe148a3aa09bc651c8a666e", "type": "ipv4", "value": "74.125.195.156", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f21f67b77af244feb066130d", "type": "ipv4", "value": "74.214.196.133", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-cb9a7b5315595eee242f997e", "type": "ipv4", "value": "74.217.250.126", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-adb94aae525ba243831ca0e4", "type": "ipv4", "value": "74.6.34.27", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-128824625206f8b46095a377", "type": "ipv4", "value": "77.88.21.38", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8b362f38418bb924b1ca6f55", "type": "ipv4", "value": "8.247.90.250", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1d032869ee18836dfa74749a", "type": "ipv4", "value": "8.39.36.143", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-52782c45b52436b2f208ea77", "type": "ipv4", "value": "8.39.36.145", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3a01de346cb79cfe14cc28f1", "type": "ipv4", "value": "8.39.36.172", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-79fae6b71a41dfce4bd8d228", "type": "ipv4", "value": "8.41.222.241", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6b096a4639118c048df4c3ae", "type": "ipv4", "value": "85.114.159.93", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f6631ac4fca61ebaf4fec8f5", "type": "ipv4", "value": "87.250.251.37", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-bd65affb9030d5fbea630e4d", "type": "ipv4", "value": "88.212.196.103", "priority": 45, "reasons": [ "http_request-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-99cb4e6c8144c9bab6dc5f13", "type": "ipv4", "value": "88.212.196.123", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-02cc2e4a6842cf5218b530ec", "type": "ipv4", "value": "91.216.130.21", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-cf54b032607a10d120d9e193", "type": "ipv4", "value": "91.216.130.22", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-737980035506723ee67811f4", "type": "ipv4", "value": "93.158.134.119", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8be49e4ac0e7df28b90b01c5", "type": "ipv4", "value": "93.158.134.38", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5821db4f7c96b9b8728f06d5", "type": "ipv4", "value": "93.158.134.90", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7692164ed165458536062483", "type": "ipv4", "value": "94.31.29.138", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f46bcfe3edfdc068bcde9176", "type": "ipv4", "value": "94.31.29.250", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c35613eea8bfd327dc7af273", "type": "ipv4", "value": "95.142.20.17", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ea7a441b70f8874e5b9df293", "type": "ipv4", "value": "95.142.20.29", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-605d2eedec6f24502096ded3", "type": "ipv4", "value": "98.136.101.121", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e4008e17fc072754e50cc6ee", "type": "sha256", "value": "025bb8d092d17ec94d16f6a602b61447faf64f3260c93a4650e9b77b9003a3f9", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2e3aa27302953e738285e815", "type": "sha256", "value": "03a8abd21deffa815518744425ed7da2e391745f22d80ecd2a98ece7e42644e3", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ca55531c3c295405a64d7819", "type": "sha256", "value": "044e4bccabac4f77e55d287724125fd5e1df18597c7e1d38cf690aefdae255b4", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-dd51c01f3d936446223ccb02", "type": "sha256", "value": "05879b64ff801a2c6fbc4e43a1872c6a0ab6a67d3839d1eb3ed8e4852d4d58bd", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-142ca96e39fa5d99a587d8ae", "type": "sha256", "value": "09c4d94ef1b017b75ff5e2b9e68bcab620ec852cde6b08b21fb46f6d3ce8c904", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ca486dec2e8d45dcfb05728e", "type": "sha256", "value": "110c07b1c1d0b56bb1755a621024babe4a7f60cacd8ffe605ef41826d3fe6784", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8fba68d3b27fd8f0f325fc4c", "type": "sha256", "value": "1434636c458ad8cda52b2e1cb38178b63d9af59579d7259a36a436c9c6a11a72", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-9450a805c8ceceb6cf5c9f43", "type": "sha256", "value": "154c433c491929c5ef686e838e323664a00e6a0d822ccc958fb4dab03e49a08f", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3af0e1c36df3611b0688960a", "type": "sha256", "value": "17f91f2405171b6857a93cb8c9b306144951f1e272a039a61a7753ba04eb0b52", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6d2c6f59a9919ac79daab160", "type": "sha256", "value": "1b416e5dd993831d9e9f5073f76034d5d1485b7eeec0be5c57c3c408b9ca8f14", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7e46f20f6fb270311c1f736f", "type": "sha256", "value": "1b78a08c32d00ced18d679a004b133df54370f1f1d359f29b64c44256aaf8302", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-88a4da4c048e903108a23007", "type": "sha256", "value": "1baf84b9f47c61803a5ea556eb3541f6ba74fc6e3c5261aac798aa19773e5cf1", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-335f7f0cc0d92ba2f01fc09f", "type": "sha256", "value": "1dc9f4fe16b9590b8044c7389d2d1c37fb18ef5dad0ef801a6071f4df7c7a9d5", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0d3185fd8be331ba5ef55056", "type": "sha256", "value": "1ed6dac934e53a42db49242075dee716837fe4115d998e45f5c52d4ae96923a2", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-80406c6b9140c62404c98004", "type": "sha256", "value": "1fc3656d141db778f4636a6beb9eb0623e7b2a072ddce6013ed96f44988b78b5", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ffee51b917a1f938a892bb05", "type": "sha256", "value": "2361c69cc160246a46ecca25b6b50d825c2d950c39328c29aa1a168018640b11", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f2b73ec9d7a804f92c2e7c85", "type": "sha256", "value": "25af58ca16a2bfb18ae772716df14b4c656b39ccdcb4b9fae9bca1634e505007", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2a0ff939b4f20ad7c76bf74b", "type": "sha256", "value": "2a44910e028b6d330cacd3462a0252019ce6c016805a1b16c1c9c52b5c1caa46", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0bb8d53dfe184ba6ae8108d0", "type": "sha256", "value": "2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-56f6716c634f1279e47d4b00", "type": "sha256", "value": "2ea3ff820ddb55c4c951ff1c0fbfe8590ebff986b806fb351f2f32aded2fefc4", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7b7db46a83a24f9105d5ceb8", "type": "sha256", "value": "2ffb9c700e123b950ec5913c37c94fdd8fbb16d072458bfd5a99b57a43233417", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3b057cf9fa83bdba8b75c308", "type": "sha256", "value": "3715612c143dd7fbcd9db512e0cbd31334fe349c77f5ac4921d0646ca8bb6fdf", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a80d7d06bb404ba5b3c25157", "type": "sha256", "value": "3836255ada8bd1d6a0ac85b332623efd56c48a84e44be7cdf39482e5e1fa9e3c", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0f6fb3dc9e59d1b06e9c8173", "type": "sha256", "value": "387ad007219e458d5db35423310dcbc61b583b2611fde57a36879e31b3fb1d99", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4c93b5488955934f5fdd020f", "type": "sha256", "value": "38a2d4f024e57004e2d2324eead0ae08341ea9490151a439d6531132a5d2c2d5", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0710bcddfd4b32a7c4a044d0", "type": "sha256", "value": "38b9ae4c8fe738059ad5faf084677b448bd9333fc6286e3440cfc09be2bb18d5", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-9aab18b66031d5a2ce83ec2d", "type": "sha256", "value": "39f55c0059bfa765dbc67836a3c694c4257e3880c5323e14a2874d78f4de5582", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-85f4b68cae4e29d2ef0c83fa", "type": "sha256", "value": "3ab30e780c8b0bcc4998b838a5b30c3bfe28edead312906dc3c12271fae0699a", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6e120facaedf35968ce80baf", "type": "sha256", "value": "3cdffc1fdda52774a1ee46fcd7244b0ee88b11df0f7ddce7dc725609bd1f2a90", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8ad6605715da3e8e9817585e", "type": "sha256", "value": "3f7411e6cfd233d77fd01564a545084b986ae36e1c385c5999df93f5f430d65b", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-934a2bd9d1e1588a2971ed34", "type": "sha256", "value": "403f055d841332e37c429d5a4f0699e95a960529853388d36e4ef51e4309ebd0", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-75e36dd9a8256de514ea7c08", "type": "sha256", "value": "44509da8c1e070e58d174497add5449046af4bd1a1b62aa38152d73c9372a394", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4b7b861fbee2dc4ba68f36ae", "type": "sha256", "value": "468e579fe1210fa55525b1c470ed2d1958404512a2dd4fb972cac5ce0ff00b1f", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-23b52a6af952fcf00881d190", "type": "sha256", "value": "4e4d1d22150544836181502bf5004097fe8d90b3cb647455a4d601153b39eeb7", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-47e791baf38c0939b86ca09b", "type": "sha256", "value": "4efb8677134ae61413bf441d88c2e912ca065a68bb4566b30f935cae34f5a98e", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7a57d24b3bbf89dc4d3078c9", "type": "sha256", "value": "4f32d5dc00f715250abcc486511e37f501a899deb3bf7ea8adbbd3aef1c412da", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1942d7ea1efd279a4ef4a81c", "type": "sha256", "value": "5aa35acedcb1d276b3b3a71371eb51bc910b970deb8a3c6111fa99959fe6c9c7", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-51a19ccbe0b138a1439a45f8", "type": "sha256", "value": "6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a64617d67e90408902bc3591", "type": "sha256", "value": "61c6caebd23921741fb5ffe6603f16634fca9840c2bf56ac8201e9264d6daccf", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c3245c8b331595f55678a81b", "type": "sha256", "value": "6281b1e2ea6a5d13e0fd8766295444b52867bc3298d5c2b6b55b1b22420f230c", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3739a3bb238636c0558767cd", "type": "sha256", "value": "67dcf7446d48b5a0cb944a63bd3b69470cc6a48c024223aeff0252cc5b4f11b5", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5b5aff26126691b2170ba2c1", "type": "sha256", "value": "6865cb6b98a7a93856092e5a4f0d44d6564e74513f685a1eef824a2f7ea77438", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-bf1decf2e0fcced6917ce915", "type": "sha256", "value": "6db9e00a697b239f66e81bff6d475a80c885dd2e533c93ddeed3e5883a79b8e1", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d660e86ab6fc2b0c533200c4", "type": "sha256", "value": "7a44293f37ed3ab18757c89dc76b673aa3ff923e31933ba1bdae740fb0e7ddd4", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a7e7bb261232af490440aec6", "type": "sha256", "value": "7a788d144a48f85a8f0ffd046f90c7ae89208a52463f9e5ba27833ab2085a291", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1b8b17a9019b172091fef03e", "type": "sha256", "value": "7d856e9985a83e2e6fa80ea41c6e67c8db9e19d9f30ce8d0a8d87ad942a00a31", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-29526c90ec493804d73efe38", "type": "sha256", "value": "826da83425629535790ab944e227e02a597999af91f0a662bcfb4351c950d274", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-eaead8b72c55ed59f71b1c7c", "type": "sha256", "value": "8380f10fcacb3780a860531c45384ab3bfdc2ab6a9b8ada7b38551448f69d889", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-aad0f48bea60a169e80d9275", "type": "sha256", "value": "8500d605a74853787e140b8e1fcc945de816b28bda06093a3a9d3a9fe00b9b6e", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-dff181f262a287c73de16caf", "type": "sha256", "value": "8bf7a76576baee734a750ad21b0a8a583de9ef4312e41f7043594910e6649eed", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f78e0b44df436f2789a18ec2", "type": "sha256", "value": "8ed18faec0943d33882e94cf8e4f01b732ff4e7c84294a9852dbed7cbb07afd7", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-444dd11e3d378730ebaec1ce", "type": "sha256", "value": "8f34acb688aeae2e39704c35a59767aa10f9b6b99d81f681b8398b23c2d56f22", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-fa5082585fa4beb433f75448", "type": "sha256", "value": "9346b79af539d6aa4f72a0499ca1459c42e1a6e2becf0d015ba2f4237f0a9eab", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-541713d83e37fa75ff6398eb", "type": "sha256", "value": "96bc02edb88af74dfe132e8341ef9a8694400d86bf0deb6fd93d06591bc5fa8d", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d92d0bb43acb97336b07910e", "type": "sha256", "value": "99fb918a282d39d585d3d759f7903f7508925d0f78ae80e427cec27378c5b71b", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-9240ed6286fa2c23ad6ba950", "type": "sha256", "value": "9a3425a07bbde19cc69878e803f30c78d60b61f49049265a20a01841a1028350", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-687ad259fb50956e1995cb4c", "type": "sha256", "value": "9d0bbca6eb531759098a56914524f615a1d5a75a1b2c429d7b238973c2610c7a", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-48caf17309371c5fa2fd15ee", "type": "sha256", "value": "a002c9d3c0bfd9a9ff3c9ff2b1dbd79beb6bf0af5b45933ccad66337bc6864eb", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6ccea4ba3fff84a57c808595", "type": "sha256", "value": "a131c2b10883bc8647bffa08b4a6b27f04b376bbddb267a4d0c9d3e8ea851aa0", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-814a595ba31f4b8953fc9d9f", "type": "sha256", "value": "a1dbd5350e586eab4363644e8a82826a3032bc4f83694543d50fb6498ea6e82e", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-9bdda0aa0508bc21616c1677", "type": "sha256", "value": "a2ce3a0fa7d2a833d1801e01ec48e35b70d84f3467cc9f8fab370386e13879c7", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b594505c2b5f5055a2cd3b61", "type": "sha256", "value": "a6dd05c22e36e46f367bb82192f989ccf6b9f5407e61addeaab44b7c53e30a00", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-641671af1bb36f8886479078", "type": "sha256", "value": "aa81dc4dfa58c4040d0e5c08813a963dd3e8a8a16fd1c76ed758e703b62761f2", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-47b43a8c68843fe4df4ee680", "type": "sha256", "value": "ad927cfd47a633c08193fec7881a927102c04802a42fa9d880c34dcba5d473ed", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c8248b770d4c98bf8daa857b", "type": "sha256", "value": "ad984172bbde72d905cb477edf2775b567580976ef1327612313d7490a3d30ae", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b1c78ac699f5236954202662", "type": "sha256", "value": "ae4f99d83e633923748305e0dd6434264babf605d56deb7d05345710796038fa", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-216499ede0f639ca64308445", "type": "sha256", "value": "af5e4f327b79424352a42bf43df71e6a2f52d6f8948b82d6a42b4c2e97f7bfea", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3c51fa0db7a1560105868f65", "type": "sha256", "value": "b3719e3eda456a7457adfe13e6eed36fcef0901b0c31c22cc8ff48629ce8dcee", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-73a745c2efd2e6b4a103536c", "type": "sha256", "value": "b824ce476646a4ea83e2e7b3ccff9864cb702bf597c05656a470ec609954f9db", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b5c07290196fcd67e84edaad", "type": "sha256", "value": "b84161c9fbf7520cd14e7019f92120bd87a928a074156e91a992eba9fc9436e8", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-634077ba73808b24c345a9f4", "type": "sha256", "value": "c0f37380971fb93ecb0cfa3c2bd6d91cc77f254f0a6ca41edeff47fda0e409cc", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b4bf7cf5daa4adaa7fb705a5", "type": "sha256", "value": "c6e69e2ac48274e5650b25984db96e9b8c85f8c92941900207abb3d41b423cf7", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-80e4bc93f577cbd8c0ab98a4", "type": "sha256", "value": "c735ac343470ff44195d0167c35e9cb3e0bc43a7c749b67f50fb662300f73d9f", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4bee935118d7c5c57eb94087", "type": "sha256", "value": "c87f78fc36289e69a164914c940e5cecd31024d0a06089c2fab4dcd23e507ae6", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b65c464f4f2c8b413600e5f0", "type": "sha256", "value": "cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-98db67d28bca873eb1f1b27a", "type": "sha256", "value": "cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-96c79fa78eb9e19f47873623", "type": "sha256", "value": "cc59dfc0669d00ad2b72411ff19cf555e4d0f1b940f0c674904004c73a3edb07", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b71b1081e78d55f5f7f2fb81", "type": "sha256", "value": "cd649c61b13497605100760e8bf986b569254a716cc2b21612b8b4f09051a732", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-38d8d966a57eff253b88617b", "type": "sha256", "value": "ced5c873136c4fab4584c0c6d26dcd530c748303d7ed9b7a7966b2fe1d6f5915", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0e37fda133d6e4a20b568c70", "type": "sha256", "value": "cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-044828bfa4ce69e3039fe105", "type": "sha256", "value": "d1b728e19d551b8bc4f3f2d0c12541e7d8950358f95ae31e610b6ab46cb6ec96", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d7d1e4e9a32f1db50a192903", "type": "sha256", "value": "d4735e3a265e16eee03f59718b9b5d03019c07d8b6c51f90da3a666eec13ab35", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-15300bb69453b961e51687f1", "type": "sha256", "value": "d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d66b66ebcdb2dfab90657bd1", "type": "sha256", "value": "d84fb0e64ee9f712fb6a808e9caa959903068ae7d7805bd0ce5f4782a37422f4", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d3ea8098ef2a4ba9cbd9a825", "type": "sha256", "value": "d9e7bfb8aeed3257872096e5f7f09eb683adb4541c0fca3446823bea4a7c2168", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-fdd8eb18f5c8b53b11698d28", "type": "sha256", "value": "e2b232bd93d4faa6bd4156d3e31b542a24ac3afe877c6f7faf23c1f474eaf52a", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5054b7d15d9ed7f55bd3cbe1", "type": "sha256", "value": "e49188fece61523b27d736f94bccb9b04d8a3f018fe0a770fc5cf9b6c734fd0a", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b249292f69108bddf849eec8", "type": "sha256", "value": "e4c763b60274fbb4f5ebfb43603452f0c592aedf39647951ce87182fdb702955", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-323e688c3089cd1fa7e19be1", "type": "sha256", "value": "e56be3ba3f85b78893bce2432a38aad1afda3d3032ee8667589dd44ee9ed0cc1", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7d7efdfcf61d068f12b299ad", "type": "sha256", "value": "e6145cbc4aac4c3d685d04d508cee083e4e4a8a727af838ed46de8f0384b6119", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6c8d1f7fa83903de1ce7849a", "type": "sha256", "value": "e9d0f873040fb0ee7b073debbc6dfbfdbc80c0c17518d38b04b277a54e5fb275", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5e88a803b009d55b0b9dab9c", "type": "sha256", "value": "ea843998fbbcd38dd92e228250a9bf15521391a26c88cb25a16b162d7f35d0e1", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2a927173c7ddf7102c156f35", "type": "sha256", "value": "ebdab894f319fe12a1b14f3dc8c883d45caf4c15e389fb9d6568145f926f4126", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-386d4396306cea488de6c4a1", "type": "sha256", "value": "f1c1b50ae5a20dd8030ec9f6bc24823dd367b5255759b4e71b61fce9f7375d73", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8145f780af2c2e5e007d7e97", "type": "sha256", "value": "f2addf74a79c54d648ed7d227042c992f8d500dd95f072528f9e55c168cf97ad", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-46c1348259ea7666f727756d", "type": "sha256", "value": "f33c27745f2bd87344be790465ef984a972fd539dc83bd4f61d4242c607ef1ee", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-227b8be72f3cf5241facdb74", "type": "sha256", "value": "f379ea3023b93c6e5d2fe2945774dcf7c85a116326d9eb8f3274de541403811b", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e80d00594dc530ff2cf8336e", "type": "sha256", "value": "f59b3fd3d4f882d5c2154e3b8aa5e535416a696f482996ec2a134e7a6978c333", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ed1d367c9da4a9b8ed426245", "type": "sha256", "value": "f8e7288c0e055bff074b4d2f64cf687fa49de2e08955cd2cdb00d55eaacb3a61", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-212cc599b4b994cdee685cf1", "type": "sha256", "value": "f9496faf384dba29602fe3072688892f2dcf7738eecb77208c51de0eaa12562a", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7e6d602b3913ec1c58cf28c0", "type": "sha256", "value": "fa523f248a332cb89ae3ad8cf51d840153e0f96bcc2a4c8db736e02a340dab48", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-fb09fb4860e00c952245fa40", "type": "domain", "value": "api.bing.com", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7f65675196997f6bd9df7e6a", "type": "domain", "value": "isatap.localdomain", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-dfd1a09ab149f5dd57d0e665", "type": "domain", "value": "petrov2018-pc.sputnikhouse.org", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-fd3c7b24950abe944721a113", "type": "domain", "value": "sputnikhouse-dc.sputnikhouse.org", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4d9c3d11633432de285fb4de", "type": "domain", "value": "wpad.localdomain", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0e349b07febe00d49d4a389e", "type": "domain", "value": "wpad.sputnikhouse.org", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-76583fca897523fee7e5fcf4", "type": "domain", "value": "1605158521.rsc.cdn77.org", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-fe10fa0795e6b4e516999708", "type": "domain", "value": "506163eff52ac0e798da9465b8af1d86.lswcdn.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a5bb793866c2afcb813d62d8", "type": "domain", "value": "ad.turn.com.akadns.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7aeb5097eb572f241799e07a", "type": "domain", "value": "ads-bid.l.doubleclick.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0f7ce750d04ffb0fcf24d428", "type": "domain", "value": "ads-east1-132899269.us-east-1.elb.amazonaws.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f2b1a270b75af79f4c286e81", "type": "domain", "value": "ads-sc2-lb9.adsymptotic.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-394c6e831c76b7ab1e8c8645", "type": "domain", "value": "alb-vpc-pixel-tracker-front-prod-1906776940.us-east-1.elb.amazonaws.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1b348bfc7c6c49215ee89197", "type": "domain", "value": "apps.digsigtrust.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c7d7561fc45fc5da5cd46bfe", "type": "domain", "value": "b1-lsw-use1.zemanta.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-588ed136aab83456eb3f8e7a", "type": "domain", "value": "beacon-cdn.walmart.com.akadns.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7fd2b9f7ba17bd1af4deacb9", "type": "domain", "value": "cdn-na.onthe.io", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-37f64cba6c320580e3093220", "type": "domain", "value": "cdn.digicertcdn.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-68cdfeacc780f8eb6173581c", "type": "domain", "value": "cds.n3g2w2j5.hwcdn.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1359ffe062d1480e3e999067", "type": "domain", "value": "cds.p5q6b2e4.hwcdn.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2c0ea2d53f7116a86e70db76", "type": "domain", "value": "cookie.brealtime.com.cdn.cloudflare.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-23afc23031aa020c2ceaffb3", "type": "domain", "value": "cookiesyncing-1395500543.us-east-1.elb.amazonaws.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f54b1e1823352d1a1eb5d287", "type": "domain", "value": "crt.comodoca.com.cdn.cloudflare.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-01bc0161b78878e280ebfe87", "type": "domain", "value": "cs574.wpc.edgecastcdn.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-07238b9b5823a2ddba1f7aff", "type": "domain", "value": "cs84.wac.edgecastcdn.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f7f8934debb864d5857db0e2", "type": "domain", "value": "d3f7zc5bbfci5.cloudfront.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b2c8ba48117917e32ca40b63", "type": "domain", "value": "dmp-pixel.aolp-prd.public.aol.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e1875a4ebf86af6a156c04e5", "type": "domain", "value": "dxedge-prod-lb-1585771072.us-west-2.elb.amazonaws.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4920e51a7821d3573eee5c87", "type": "domain", "value": "elb-aws-ca-clickdistrict-2095435364.us-west-1.elb.amazonaws.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1c964b2e7437cc190baeb13e", "type": "domain", "value": "f2.shared.global.fastly.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ddecbd1fdb7799ecd88d52e5", "type": "domain", "value": "fo-fd-world-new.yax.gysm.yahoodns.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-bd2f38a015b83953b03d070e", "type": "domain", "value": "googleadapis.l.google.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b09ed558f364542f73f3dd3a", "type": "domain", "value": "googleapis.l.google.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-349ba8af8e4678c63ef80e72", "type": "domain", "value": "gstaticadssl.l.google.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5223a166b2911bd817f53dfa", "type": "domain", "value": "hb-api-usa02.omnitagjs.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f7a0961eb7f7f7a37f03ab3e", "type": "domain", "value": "idsync-ext-weight-2.rlcdn.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-af825af7e0b2aad0ea5d230a", "type": "domain", "value": "jadserve.postrelease.com.akadns.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-74bedc0e2316ce1a8d1e7df9", "type": "domain", "value": "match-243508202.us-west-2.elb.amazonaws.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-359f394d8016d5670c1f3e7a", "type": "domain", "value": "match-us-east-1.sharethrough.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-09c49e3a6fe2b30ae2ee8c37", "type": "domain", "value": "matchuswest-922949909.us-west-1.elb.amazonaws.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0c7cc89688ed279ae185f0b8", "type": "domain", "value": "mixi1-1.s1.mixi.space", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1aeb95bd8b22199bf627019f", "type": "domain", "value": "na-eb2.3lift.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2286e451a5b01f61f73e18cb", "type": "domain", "value": "odr-712357372.us-east-1.elb.amazonaws.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8767b61498be41398234f1f1", "type": "domain", "value": "pagead-googlehosted.l.google.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a7bd74ce76c0a15332c145f7", "type": "domain", "value": "pagead.l.doubleclick.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7e1de8f72f455b172072f6d3", "type": "domain", "value": "pagead46.l.doubleclick.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5bcfcb58e4282b617d917004", "type": "domain", "value": "partnerad.l.doubleclick.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ed51281a4ed1677ae452db3b", "type": "domain", "value": "partners-1732315393.us-east-1.elb.amazonaws.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0f88359f0c8d541f876d4814", "type": "domain", "value": "perf-token.rubiconproject.net.akadns.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f51422c41bd3b907dc23493d", "type": "domain", "value": "pixel-origin.mathtag.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b997abc0b05b7a562321ba67", "type": "domain", "value": "pixel-us-east.rubiconproject.net.akadns.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4694891b72b0db6cd56f734e", "type": "domain", "value": "pixel.rubiconproject.net.akadns.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8d8cc838440243cbb68b4280", "type": "domain", "value": "pool.tokyo.iponweb.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b8ebc93e8e7620bb9f25020a", "type": "domain", "value": "pop.yandex.ru", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b898229e3cd130c5431c097f", "type": "domain", "value": "pr-bh.ybp.gysm.yahoodns.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d2661cb38f1da2ae0a68e1bb", "type": "domain", "value": "prod-dem-collector-elb-611025824.eu-west-1.elb.amazonaws.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0127f71438fb6619bbed9b83", "type": "domain", "value": "prod.appnexus.map.fastly.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-aa25b6613b43f9145a8e76c9", "type": "domain", "value": "prod.contextweb.map.fastlylb.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-beaab0e8c5b53356aaba3247", "type": "domain", "value": "prod.outbrain.map.fastlylb.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1200c1fbdccafee93c257673", "type": "domain", "value": "px-us-ca.adhigh.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c6e3119a491151bff31bce5c", "type": "domain", "value": "rs-lb-b.lkqd.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7f8ecbd1ac90287c017557a9", "type": "domain", "value": "rtb.adgrx.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-fe3df222de8acea991a5fb40", "type": "domain", "value": "s.gycs.b.yahoodns.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2df3f21d97039ad62e2a4343", "type": "domain", "value": "s0-2mdn-net.l.google.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-487178ef06d4aef29afe849e", "type": "domain", "value": "scontent.xx.fbcdn.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c46be5a4c6b196d790545a89", "type": "domain", "value": "smtp.yandex.ru", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-65034a4ec011119eb75abb1b", "type": "domain", "value": "ssl.cdn.marphezis.com.c.footprint.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6258a03ac4ea72d0d9f1272f", "type": "domain", "value": "static-doubleclick-net.l.google.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6dca5138dbb3f442ea4f11ea", "type": "domain", "value": "stats.l.doubleclick.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-abab6f57883a3f35a2229b8d", "type": "domain", "value": "td.thebrighttag.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6e61f4d495da78b41cf66845", "type": "domain", "value": "track-eu.adformnet.akadns.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3cc7663e2a08ea553217811a", "type": "domain", "value": "tracking-prod-public-741746200.us-west-1.elb.amazonaws.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e84cdc0986031b8253fb6ca3", "type": "domain", "value": "trc.taboola.map.fastly.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-52b7722e8059b34b71cce374", "type": "domain", "value": "usorlzdiprd-external-190420686.us-west-2.elb.amazonaws.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-85f325c27426fd96d6234106", "type": "domain", "value": "vap.lijit.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d467d184c5bb15cfa57a8165", "type": "domain", "value": "vpaid-springserve-net.ssmb.netdna-cdn.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-902669b7995b7b6254b98b4e", "type": "domain", "value": "wpc.en.rt.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d08d631236a6321e263fa479", "type": "domain", "value": "www-google-analytics.l.google.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4dde73c118afffbca84325d9", "type": "domain", "value": "www-googletagmanager.l.google.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-557c32bce40750d250148c04", "type": "domain", "value": "xs2-1096111735.us-east-1.elb.amazonaws.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c17dcfbfdc90d0382eeb4107", "type": "domain", "value": "youtube-ui.l.google.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1e8ebb97374ef7799279b3b3", "type": "domain", "value": "ytimg-edge-static.l.google.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1cd721c3cc1a93bb66d2aac8", "type": "domain", "value": "ytstatic.l.google.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-73540aa58b5062e149836c34", "type": "domain", "value": "ztag-trackedevents-enterprise-1441845540.us-west-2.elb.amazonaws.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-cd7fb7958f0e2779d483933e", "type": "ipv4", "value": "104.16.237.184", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c3a141b03c0fcb563c6c467a", "type": "ipv4", "value": "104.16.238.184", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e1b5c61e54e446b76b2969aa", "type": "ipv4", "value": "104.16.239.184", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2b813e1a7b061bac8bb4b909", "type": "ipv4", "value": "104.16.241.184", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c4d3518f17c5c3341402dd18", "type": "ipv4", "value": "104.16.89.188", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6c31200e36e32c63d73f368a", "type": "ipv4", "value": "104.16.91.188", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-27512987e138866f89753fc2", "type": "ipv4", "value": "104.16.92.188", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-554b0daccc73aac4b2eb9c48", "type": "ipv4", "value": "104.16.93.188", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-dfb30ca3154714bcb20705ee", "type": "ipv4", "value": "104.193.83.157", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e0b81521f345d3e8b13ce9d6", "type": "ipv4", "value": "104.198.109.132", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-388f98a86dd3cc25b6f08680", "type": "ipv4", "value": "104.20.20.239", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f787bf9dd4359cf0ad667c2a", "type": "ipv4", "value": "104.24.247.16", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-256203749f16488b6341059c", "type": "ipv4", "value": "104.25.162.34", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-91673b98b50d053008c8ea1b", "type": "ipv4", "value": "104.254.150.108", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3c2b81e758c3d9a44ede8a37", "type": "ipv4", "value": "104.254.150.11", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ac3886b441ecaed4560e9ab6", "type": "ipv4", "value": "104.254.150.13", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c2e4771f6243938295742a51", "type": "ipv4", "value": "104.254.150.37", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-01dcc88640decf68314d2800", "type": "ipv4", "value": "104.254.150.4", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-eee5e8216fba99b59a939884", "type": "ipv4", "value": "104.254.150.58", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-871189e0c432cc7b8f79aa02", "type": "ipv4", "value": "104.254.150.59", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-73289d24150c8460c7926585", "type": "ipv4", "value": "104.254.150.70", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d7123cbae498a33d05a83609", "type": "ipv4", "value": "104.254.150.9", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-dd9497a4395dbb2881d7503a", "type": "ipv4", "value": "107.21.48.136", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-17a7745e38a13c08315a0acc", "type": "ipv4", "value": "107.23.160.218", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-755706316ba19459ee092e0f", "type": "ipv4", "value": "107.23.83.163", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7aba3a755465363099c2b3ae", "type": "ipv4", "value": "108.177.12.120", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f870cbc074aa5f6b73ac1873", "type": "ipv4", "value": "108.177.12.94", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-9b9c1c7243f75246db674120", "type": "ipv4", "value": "108.59.0.12", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8a365e15ed870724ef72faca", "type": "ipv4", "value": "108.59.0.8", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-55319fc89eaa18fb407aa9f9", "type": "ipv4", "value": "108.59.4.171", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0caa487a95688442a4a0ee9f", "type": "ipv4", "value": "108.59.4.172", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-db87856edd3a46b67d15deb4", "type": "ipv4", "value": "108.59.4.173", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a8e8d717d2f3c00897d001b7", "type": "ipv4", "value": "109.232.197.33", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-431a8bebcf09aff10e381b32", "type": "ipv4", "value": "13.107.21.200", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-735eb278fd02dee8709733eb", "type": "ipv4", "value": "13.107.5.80", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-76fa16bfab85d8dbe112d4d5", "type": "ipv4", "value": "13.33.107.131", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4fd8792c563fce9ab9d5eeb9", "type": "ipv4", "value": "13.33.107.209", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3c6faa35dad298b10a50bf8b", "type": "ipv4", "value": "13.33.107.212", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a03eaa020c90236a3f038427", "type": "ipv4", "value": "13.33.78.144", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8b23663457051139c7d6a663", "type": "ipv4", "value": "13.33.78.214", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-37ca79d2bfddd8afd9bb1827", "type": "ipv4", "value": "13.33.78.217", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-13241b6c11e46674b6720b68", "type": "ipv4", "value": "13.33.78.38", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-23ab7029992ae0d03a601347", "type": "ipv4", "value": "13.33.78.48", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-26dbc1df975d91621a50d29d", "type": "ipv4", "value": "13.33.78.61", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-42d788bcbb6f84a6a2032dbb", "type": "ipv4", "value": "13.56.1.77", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-644dddf741e2acd314da7516", "type": "ipv4", "value": "13.57.103.80", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3de91ba3161cbcfad2aaa019", "type": "ipv4", "value": "13.57.162.22", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-fd9b2668bea4b45a64bc40e5", "type": "ipv4", "value": "13.57.96.247", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-63402ffdc034d4492cadf4b7", "type": "ipv4", "value": "13.59.169.161", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-9c1d4ab7b5d0af4014ea2cff", "type": "ipv4", "value": "13.59.61.143", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6ffaeef16043e82dc50f30bc", "type": "ipv4", "value": "136.243.249.79", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-80e17f5b10edc8328dac0b52", "type": "ipv4", "value": "136.243.42.207", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-dc3c5c7ac4fdfb2fb957d8b3", "type": "ipv4", "value": "136.243.7.47", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7ebad788b7c844f8f6c76ac6", "type": "ipv4", "value": "136.243.73.56", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f2ad0cbce89c596f79a2dec3", "type": "ipv4", "value": "136.243.95.174", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-12305c763292151e238f63d2", "type": "ipv4", "value": "136.243.95.176", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-9f82c8a5628c978b10d706c3", "type": "ipv4", "value": "142.93.53.73", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a60a74d688c33633ce5510db", "type": "ipv4", "value": "142.93.61.36", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-296063da5c21ef8de9d47d75", "type": "ipv4", "value": "142.93.61.39", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6eae8c16399ea5a5a709625a", "type": "ipv4", "value": "142.93.61.40", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-cb1349d7a7401aab36f627e1", "type": "ipv4", "value": "144.76.121.172", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ff309a071771487afd419035", "type": "ipv4", "value": "146.20.132.242", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d11a67f9eff3c4baaa91b6a7", "type": "ipv4", "value": "146.20.132.244", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b40e834ae969526d2af052f8", "type": "ipv4", "value": "146.20.132.245", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5664d3168b5f9573e03d8f5e", "type": "ipv4", "value": "146.20.132.246", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-9cdd144aea08b9dba1619870", "type": "ipv4", "value": "146.20.132.247", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2353443b9c9551ab74189021", "type": "ipv4", "value": "146.20.132.248", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f31b6750936ec669d024dc2f", "type": "ipv4", "value": "146.20.132.249", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-fabf0280ad790aa8f601c254", "type": "ipv4", "value": "146.20.132.250", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0848c5e065383867bff165f9", "type": "ipv4", "value": "146.20.132.251", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-20d4838af0c15cee654cf37c", "type": "ipv4", "value": "146.20.132.252", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f4c798f6049033b02aa30116", "type": "ipv4", "value": "146.20.132.253", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8622f3ab505499dbcdcf852a", "type": "ipv4", "value": "146.20.132.254", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-00b6d4e7c05c1c61acff0ccb", "type": "ipv4", "value": "146.20.132.255", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-457f199b9960be382116fa5c", "type": "ipv4", "value": "146.20.133.0", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-64d0593319b0815ffb920d1d", "type": "ipv4", "value": "146.20.133.1", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2d671221cedcc06cf1854b9e", "type": "ipv4", "value": "146.20.133.82", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e98cef13093f61c9f06d83e0", "type": "ipv4", "value": "146.20.133.83", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e69c9e01fa603839d0758dce", "type": "ipv4", "value": "146.20.133.84", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5f2e1c3b94ecd73a76177993", "type": "ipv4", "value": "146.20.133.85", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1f80af41b748f405b72b8bd7", "type": "ipv4", "value": "146.20.133.86", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5302bc645751f78b78ad1625", "type": "ipv4", "value": "146.20.133.88", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-03f378060419dc26995e0868", "type": "ipv4", "value": "146.20.133.89", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c517e49f4fe1fb4d099e8e97", "type": "ipv4", "value": "146.20.133.90", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-dd97acc872854791c2c0649f", "type": "ipv4", "value": "146.20.133.91", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-66421ac70b7a362d6cae74af", "type": "ipv4", "value": "146.20.133.92", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c38df622f741be56dbc5a3f2", "type": "ipv4", "value": "146.20.133.93", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d3654d3c19e1ae6f4290a597", "type": "ipv4", "value": "146.20.133.94", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a9b08dde55157c62483df084", "type": "ipv4", "value": "146.20.133.95", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-65dec8e525e1a02cc7c1c964", "type": "ipv4", "value": "146.20.133.96", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8c5325a6e0af4360a59dbb01", "type": "ipv4", "value": "146.20.133.97", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f42ef9630b8c9fbf0f12486e", "type": "ipv4", "value": "151.101.128.166", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-18beb671a52243b24c4627f1", "type": "ipv4", "value": "151.101.130.2", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-353e182073fdab85b32b2411", "type": "ipv4", "value": "151.101.130.49", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c4153ecca717eabe9584063d", "type": "ipv4", "value": "151.101.192.166", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-cff9cd7aba62d733cfccfa98", "type": "ipv4", "value": "151.101.194.2", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0cf18939e9ce1dd8dbc93b38", "type": "ipv4", "value": "151.101.194.49", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-645a83affdcd1c2c39d85de0", "type": "ipv4", "value": "151.101.64.166", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3da98076a3313d04ffe99719", "type": "ipv4", "value": "151.101.66.2", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-60cd80a4a8bf52b8d413a422", "type": "ipv4", "value": "151.101.66.49", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-85f2cf451cf75d70aecb7b6d", "type": "ipv4", "value": "152.163.13.4", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-242824b6d9de3abd39c175ef", "type": "ipv4", "value": "156.154.136.36", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-496dc6de5831a74cedcb1d7a", "type": "ipv4", "value": "162.210.196.115", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-79d16283f77fcd5321a26b96", "type": "ipv4", "value": "162.210.196.116", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b407691369d51e198c88d6af", "type": "ipv4", "value": "162.210.197.137", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-baa626635df45cb6c19234c8", "type": "ipv4", "value": "172.217.0.46", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a604d37204943840ec698d49", "type": "ipv4", "value": "172.217.6.74", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-09d7554751955443d5f1d580", "type": "ipv4", "value": "176.9.67.12", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e0baf28c4095518f57acc5ce", "type": "ipv4", "value": "178.154.131.216", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-869d9f7e5c4f56869b897672", "type": "ipv4", "value": "178.154.131.217", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e81813376f707581d2e1db41", "type": "ipv4", "value": "18.185.181.189", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2f75b8abe131ec90fb7e67c3", "type": "ipv4", "value": "18.197.74.2", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-26062e57d8d0c6e57e1f24bc", "type": "ipv4", "value": "18.211.105.159", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-02af47575d899b0416a5037c", "type": "ipv4", "value": "18.218.252.177", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-be003a2ce96b34cdc4e73070", "type": "ipv4", "value": "18.219.146.238", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2d580dc1f20ed011010bd7f3", "type": "ipv4", "value": "18.220.35.131", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b3e392d5837cea1a5b983381", "type": "ipv4", "value": "18.221.66.92", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-28ad3736011505ef20f4eca4", "type": "ipv4", "value": "185.167.166.40", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-647e18feead336ed22e360d3", "type": "ipv4", "value": "185.86.137.17", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e85d6d3775b6542a5d22aeea", "type": "ipv4", "value": "185.86.137.32", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5e52ac605b62c00915d50437", "type": "ipv4", "value": "185.86.137.42", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3067df8b6a654db0c431c2a5", "type": "ipv4", "value": "185.99.9.116", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4b0b9eb748eb9422c012dfe9", "type": "ipv4", "value": "185.99.9.123", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b0e10e0119a02a4066729c01", "type": "ipv4", "value": "185.99.9.124", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-eb6562d3d5b26867a0de5dc8", "type": "ipv4", "value": "188.40.114.5", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-968a0e4f9d96e4b2551628bd", "type": "ipv4", "value": "188.40.114.52", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6c6aef21ba85127603a8a536", "type": "ipv4", "value": "188.40.115.111", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-97c6afb874030c57e5d6e120", "type": "ipv4", "value": "188.40.115.112", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-08855ed6f27d08e66abe2d1c", "type": "ipv4", "value": "188.40.118.169", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-581e22079d56132df78b21d5", "type": "ipv4", "value": "192.184.65.2", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a38e574705304847cef00a57", "type": "ipv4", "value": "192.184.65.3", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-004267b410c919bfe039d490", "type": "ipv4", "value": "192.184.65.4", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d10eacd8bb3ce9540afbe0c4", "type": "ipv4", "value": "192.184.65.5", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a21ff2d99d79cc9f4bf81fe6", "type": "ipv4", "value": "194.226.130.226", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b22b45a2962a992f9df73f3b", "type": "ipv4", "value": "194.226.130.227", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-edf5382b8e7c90dc0f36528f", "type": "ipv4", "value": "195.244.31.11", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-034af9e98486ff2b973ebcce", "type": "ipv4", "value": "198.23.90.56", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5330dbb153efa9c6a170557a", "type": "ipv4", "value": "198.23.90.62", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-77efb9df3b8a635946b23000", "type": "ipv4", "value": "198.54.12.127", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-bd482a1921dc3371e9748be3", "type": "ipv4", "value": "198.7.56.229", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-9e641980a234dc9f4d634834", "type": "ipv4", "value": "198.70.71.147", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-289ab7b7876b92eacc7425f2", "type": "ipv4", "value": "199.59.149.233", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-216d0f0b3362b9b540866e1e", "type": "ipv4", "value": "204.11.109.65", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ee490f4b63b155c277fa126c", "type": "ipv4", "value": "204.11.109.66", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a02fa51e97ef753c9e8db1e7", "type": "ipv4", "value": "204.11.109.67", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-82c356f87ebaf2a0d46a6bd0", "type": "ipv4", "value": "204.236.186.16", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d309e04a9772ccd90d3ec099", "type": "ipv4", "value": "204.79.197.229", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4cb4b7e307a6f4af72d382a8", "type": "ipv4", "value": "207.244.108.217", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ad28a76e6bafc7270487bea4", "type": "ipv4", "value": "207.244.110.3", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-84a33fddc38359ce695d606f", "type": "ipv4", "value": "207.244.121.25", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a177265ead569a870b878750", "type": "ipv4", "value": "207.244.121.27", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-55342d117704343a6daae087", "type": "ipv4", "value": "207.244.66.112", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3e41d8da4cf6629d62290f7a", "type": "ipv4", "value": "207.244.67.98", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-9f802443151fb648c9ed1d6b", "type": "ipv4", "value": "207.244.67.99", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f259ab3dea97ce65ac78d185", "type": "ipv4", "value": "207.244.76.83", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a2db4073fa680f434b13ba3a", "type": "ipv4", "value": "207.244.94.20", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-72e1f81e0d4f43f6b0804909", "type": "ipv4", "value": "208.185.50.90", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f8822fefb70101aa37834e9c", "type": "ipv4", "value": "209.191.163.208", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f8fc766a9732ce162fcff7a8", "type": "ipv4", "value": "209.191.163.213", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6855e375ae701b20b0627af4", "type": "ipv4", "value": "209.58.136.29", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b12cece31f6959996ad07939", "type": "ipv4", "value": "209.58.136.32", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1472887ee65bdf6fa6d18e70", "type": "ipv4", "value": "209.58.139.154", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5a246e5429cb187a8c2814cb", "type": "ipv4", "value": "213.155.156.165", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b52b4e755f0ad657a99c795a", "type": "ipv4", "value": "213.155.156.166", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f3a3f8adc155b9682060f440", "type": "ipv4", "value": "213.155.156.167", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c72c0c25307f94e3298d6829", "type": "ipv4", "value": "213.155.156.168", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-24d4f0eb2b96a1384b0fe256", "type": "ipv4", "value": "213.155.156.169", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-88356829632a7394259c2500", "type": "ipv4", "value": "213.155.156.180", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6c3078c98dbef908d21a7a5a", "type": "ipv4", "value": "213.155.156.181", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1e90897e0aca293168046ab8", "type": "ipv4", "value": "213.155.156.182", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3c1726dfcaedf67fe59ab8d1", "type": "ipv4", "value": "213.155.156.183", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1dda96c2bf79a94b11f14c0c", "type": "ipv4", "value": "213.155.156.184", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b59c4d96b90ce639411ee930", "type": "ipv4", "value": "213.155.156.185", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3b92bfb65a50601af91e4b62", "type": "ipv4", "value": "213.180.193.38", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-16530eaebf9e9a0a80a4a54d", "type": "ipv4", "value": "213.180.204.37", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3ba20341aeea758c3138a0e6", "type": "ipv4", "value": "213.180.204.38", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-fa7babca841453878b2221dc", "type": "ipv4", "value": "213.180.204.90", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1a14340b8b4ca1739e37d220", "type": "ipv4", "value": "216.115.100.124", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-92e6378e8c1f5f7286af7290", "type": "ipv4", "value": "216.200.232.234", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-9e77721891f795d5e5b32114", "type": "ipv4", "value": "216.200.232.235", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b8eecb18ecca00ee191d2437", "type": "ipv4", "value": "216.58.194.170", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a4dd7efb7c9ebe25b9079aef", "type": "ipv4", "value": "216.58.194.174", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-45ada13018f3c4109461baa5", "type": "ipv4", "value": "216.58.194.182", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-680374a0875e411bcf2990fa", "type": "ipv4", "value": "216.58.194.202", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-15d6908e9ac548ff6395deac", "type": "ipv4", "value": "216.58.194.206", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-da00669c56cf49ecaa116393", "type": "ipv4", "value": "216.58.194.214", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5f5b2115e9ba8090c8cc4ed0", "type": "ipv4", "value": "216.58.195.74", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6803328e2d52699b0ab534ab", "type": "ipv4", "value": "216.58.195.78", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-aee57217c61a4cb0704e6e46", "type": "ipv4", "value": "216.58.195.86", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3e9a3a79932cbad5d80eb340", "type": "ipv4", "value": "217.182.126.162", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e769dd156852577a2b5fa450", "type": "ipv4", "value": "217.182.126.163", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3149718017233eb5f69636df", "type": "ipv4", "value": "23.108.190.222", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ad3e87a0b43a3f5a47d57485", "type": "ipv4", "value": "23.108.190.223", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-eee6428ac61b6b9f71e1afdf", "type": "ipv4", "value": "23.20.105.102", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-fc6e2dc5360928bb233a832c", "type": "ipv4", "value": "23.23.98.214", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-77d7dca3e61499cc6c45c859", "type": "ipv4", "value": "23.23.99.70", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1741226040b4bc8a2e2d8b63", "type": "ipv4", "value": "34.192.56.110", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-16e300586a954f0d55d8a741", "type": "ipv4", "value": "34.193.211.130", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5d176b047a8a673c7633bf16", "type": "ipv4", "value": "34.193.227.152", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-cb3e79699a3484eb4824cd9d", "type": "ipv4", "value": "34.193.232.33", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7a059689fef519c6a6aa3e5b", "type": "ipv4", "value": "34.194.151.202", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-acdc84e3da63ae5385dd3ef1", "type": "ipv4", "value": "34.194.88.13", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-105e2fa8dfb8274705bf3a9a", "type": "ipv4", "value": "34.195.63.41", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-933118c6288ddd65ab778f24", "type": "ipv4", "value": "34.196.110.17", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f8cc7715823cc6636715a1ad", "type": "ipv4", "value": "34.196.181.242", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2046bfab9e1d8cec3c548cf2", "type": "ipv4", "value": "34.196.187.76", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-64b5d4e850af2c302a5bf075", "type": "ipv4", "value": "34.197.131.250", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-bab5a540c09849506cb83ac0", "type": "ipv4", "value": "34.198.228.49", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-94e3ffe36b839fac2ecdee8b", "type": "ipv4", "value": "34.199.147.44", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-31c789c5c8aaa86562493304", "type": "ipv4", "value": "34.201.202.206", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a43c150d4d4623e003e8a752", "type": "ipv4", "value": "34.205.99.3", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3066dbc8eb329299cbd4ca2c", "type": "ipv4", "value": "34.206.197.3", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f4ece3622c08a31a0d0d0964", "type": "ipv4", "value": "34.206.215.186", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e0c0f402d1c99fba08d2e5c1", "type": "ipv4", "value": "34.208.13.206", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-924195c86da4f2d607d42b23", "type": "ipv4", "value": "34.208.25.6", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ac1edb1d279d97c47152884e", "type": "ipv4", "value": "34.208.49.173", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4c57383480dd0877f0efba56", "type": "ipv4", "value": "34.209.105.94", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3f0b2f5098a5effc04908b10", "type": "ipv4", "value": "34.210.171.204", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e087d1e00e1072416979dee7", "type": "ipv4", "value": "34.210.7.129", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-74e4414e299ddcb4d0100a39", "type": "ipv4", "value": "34.211.210.144", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ca399ab4e4cb1ed1f0e5ab2b", "type": "ipv4", "value": "34.212.197.102", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4a86dd187eb4fc8594ada98f", "type": "ipv4", "value": "34.212.77.105", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-bf4a5491d26cf3183390bf8b", "type": "ipv4", "value": "34.213.2.162", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c45c7917a2a1c350f082dbf0", "type": "ipv4", "value": "34.213.219.1", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ce8988b21d0be84d92604081", "type": "ipv4", "value": "34.213.95.197", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-fb6edd1a256f471751cfd10a", "type": "ipv4", "value": "34.214.108.62", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ec23b353057e65c523fa7bde", "type": "ipv4", "value": "34.215.18.221", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-44c02e8992a6e6a8da7cf08e", "type": "ipv4", "value": "34.216.116.50", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-634801e7f3c65b135eaecb54", "type": "ipv4", "value": "34.224.45.36", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d715cc8dd48ff75ccf5315c6", "type": "ipv4", "value": "34.226.161.213", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4aece5924689c6d1796e0535", "type": "ipv4", "value": "34.226.179.16", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-416eb66db9b18c0866c52cc1", "type": "ipv4", "value": "34.226.50.209", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b6841e1df1f13331988142cf", "type": "ipv4", "value": "34.231.203.163", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8c2a67b9372e637e1e79766b", "type": "ipv4", "value": "34.233.214.90", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-667e9f86abee671bf0a3fc5f", "type": "ipv4", "value": "34.233.6.212", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-087936c2a9d7dad867139713", "type": "ipv4", "value": "34.234.134.91", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-335d1f62f4b9990605498358", "type": "ipv4", "value": "34.235.5.53", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-19ccb2245a6b68c638ad3a65", "type": "ipv4", "value": "34.235.70.251", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1d815dbf2b97ace4b839aab4", "type": "ipv4", "value": "34.236.75.36", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2b911f856af2ff50cba4bac2", "type": "ipv4", "value": "34.237.159.145", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-98c494718554b6b27ea8b4a4", "type": "ipv4", "value": "34.239.209.246", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-cc00cda2fb396ab1294707c6", "type": "ipv4", "value": "34.239.239.138", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-85f0ec52dfe58997632e49ff", "type": "ipv4", "value": "34.246.164.247", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-cdbc2513b250ba0e98c5331d", "type": "ipv4", "value": "34.246.74.216", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1cffd7318b77e6e5b7fd5eef", "type": "ipv4", "value": "34.247.143.160", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-9b15f8e84bb6f5e5d5eb0b6e", "type": "ipv4", "value": "34.248.66.236", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f7280335e231793c80212a79", "type": "ipv4", "value": "34.251.231.74", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-074c8941fdb17ee18915d315", "type": "ipv4", "value": "35.160.145.246", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e00e153bf1eeb0ba770eeed1", "type": "ipv4", "value": "35.160.44.27", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-59489f42b5c98e126c038480", "type": "ipv4", "value": "35.160.46.147", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a85016df8437ec33799649d9", "type": "ipv4", "value": "35.160.51.142", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b1464ca324230850fa0247b5", "type": "ipv4", "value": "35.161.139.221", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-40677e12c292bbe3c2d73fc7", "type": "ipv4", "value": "35.161.228.236", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6e879c2fe0d1000a4182e330", "type": "ipv4", "value": "35.162.109.147", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-cf1276deebd21a5ab25e7860", "type": "ipv4", "value": "35.162.194.159", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ba32264fce0ca768c69f8ccf", "type": "ipv4", "value": "35.163.160.113", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d864fe61a2c3adbe7efc90a5", "type": "ipv4", "value": "35.164.101.53", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8d832c3ace1393b7d9a2e619", "type": "ipv4", "value": "35.165.34.205", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-aee0223ec68332c194d14015", "type": "ipv4", "value": "35.166.4.4", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-70e8b0651079c30048014568", "type": "ipv4", "value": "35.168.109.209", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-252e8f41151ee9b9ca1a86fc", "type": "ipv4", "value": "35.169.19.220", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-9e61a302989b39757a2fe5e6", "type": "ipv4", "value": "35.169.196.58", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-34afb266f9a3013a70ae302f", "type": "ipv4", "value": "35.169.72.130", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-34095736b5dfd674ce23436f", "type": "ipv4", "value": "35.171.120.51", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f53e5d9b7de8a706cdb9b803", "type": "ipv4", "value": "35.185.199.249", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-76b3383e73ae96315a5b403d", "type": "ipv4", "value": "35.185.211.128", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-07df4427156a4b9bec3a987b", "type": "ipv4", "value": "35.185.219.146", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1f9a89c96157cd66e41d64de", "type": "ipv4", "value": "35.185.232.105", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-aae220ff0c13b18a77427581", "type": "ipv4", "value": "35.185.241.45", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-86cf2e9f3d9dbeb205105b37", "type": "ipv4", "value": "35.185.245.217", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-76ab575c9b15c4b34d3bc0e9", "type": "ipv4", "value": "35.185.250.254", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-19074ef722769ecb53676603", "type": "ipv4", "value": "35.185.251.80", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-56739ebd4b99ee2484d600c8", "type": "ipv4", "value": "37.157.4.39", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-01ba4b1dae3691498679407e", "type": "ipv4", "value": "37.157.4.40", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d9702c1b04d698dfe28062a2", "type": "ipv4", "value": "37.157.6.245", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-be4ab9db58c2ee7ea06a2238", "type": "ipv4", "value": "37.157.6.251", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-148f36b505180a8ff442f845", "type": "ipv4", "value": "38.106.34.104", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2f7e0eb8495b5b5874bc8f8c", "type": "ipv4", "value": "38.106.34.125", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0f44f762586edde9e6326439", "type": "ipv4", "value": "38.106.34.142", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1672a1c90df4cccff1816bf5", "type": "ipv4", "value": "38.106.34.155", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d246300e6e08696888d5210d", "type": "ipv4", "value": "38.106.34.160", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2765506c51ffbdbbb0934b34", "type": "ipv4", "value": "38.106.34.163", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-09135e634dbb79c69ca8c95d", "type": "ipv4", "value": "38.106.34.164", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5e5fd9905743b4e064476266", "type": "ipv4", "value": "46.161.36.4", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ffda9ebf7cdbfaae8f408a33", "type": "ipv4", "value": "46.161.36.6", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-cf846570f09c1f6699c5cfa8", "type": "ipv4", "value": "46.51.169.56", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e0d23477dba7154b43092e14", "type": "ipv4", "value": "46.51.174.75", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-9cba802271afb88608af966c", "type": "ipv4", "value": "46.51.193.164", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-452bb27f69878b4bce77025f", "type": "ipv4", "value": "5.39.44.194", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ca372d506ba75028a8014c7c", "type": "ipv4", "value": "50.16.185.226", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-fdaa97f7c8b79855e4385467", "type": "ipv4", "value": "50.16.204.65", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-35f0e022b7b5c729b00bf6ca", "type": "ipv4", "value": "50.16.205.103", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-39c148a915e3a2e9e1ff89d3", "type": "ipv4", "value": "50.16.223.11", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d9fb6035f9eb88e7e4ef9349", "type": "ipv4", "value": "50.16.230.124", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f5eb2bea6b31017fa5b11654", "type": "ipv4", "value": "50.18.110.80", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3bfc2b66a542f9d481562910", "type": "ipv4", "value": "50.18.173.83", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7a1f66b92fdcd16c51e1d869", "type": "ipv4", "value": "50.18.61.120", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d238906899bd0969d7f2fac0", "type": "ipv4", "value": "50.18.61.141", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-15644cc772f7ee4399f6cb14", "type": "ipv4", "value": "50.19.167.223", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-99372f0001c98bdcf0d4b2b5", "type": "ipv4", "value": "50.19.205.30", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c52bdb7491d9facc2b665124", "type": "ipv4", "value": "50.19.51.56", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5749833c834315adde3a3bca", "type": "ipv4", "value": "52.0.134.142", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-87f2f06f54fb8a96f16e13d0", "type": "ipv4", "value": "52.0.244.217", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b70fcded377d7b36b3efdd06", "type": "ipv4", "value": "52.11.6.29", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-06feb3d09e0040e1f887e184", "type": "ipv4", "value": "52.11.73.127", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-bf9a068fc0ced0ee3a13cf5d", "type": "ipv4", "value": "52.11.94.156", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b81fe7c400aadae24d76085c", "type": "ipv4", "value": "52.15.253.50", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0c485aea30f16f0fd9298091", "type": "ipv4", "value": "52.15.46.161", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e91b2e6fc1ef86384c8d84fc", "type": "ipv4", "value": "52.16.89.247", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a9e08f33296634a8a6e64ca1", "type": "ipv4", "value": "52.17.182.129", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ac016ee126007731c9a4e7ca", "type": "ipv4", "value": "52.20.201.251", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ccf76845ef0b527d523b6628", "type": "ipv4", "value": "52.200.135.6", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-cdd4f2c21e4aee07da20dc16", "type": "ipv4", "value": "52.202.121.146", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e6b51cdfa4e595121e3f1e56", "type": "ipv4", "value": "52.202.36.55", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0141b31e6eca4e5167110921", "type": "ipv4", "value": "52.202.74.78", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6941973e2a52833ae4a41e4e", "type": "ipv4", "value": "52.203.113.55", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-de7c9b1993d626ea110b97d7", "type": "ipv4", "value": "52.203.152.20", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-019eb35b5a70ff60d66bc5a9", "type": "ipv4", "value": "52.203.238.185", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e5ea9cd9eaa2be2ed713c3d4", "type": "ipv4", "value": "52.204.11.61", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c46e10656f9008597493e8b2", "type": "ipv4", "value": "52.204.188.86", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e3c14792694c4a86f71fde59", "type": "ipv4", "value": "52.205.207.146", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2bcc73771a1a14bd87080fe4", "type": "ipv4", "value": "52.206.139.43", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e2861ad094fb4673f35c4348", "type": "ipv4", "value": "52.206.55.46", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d6c829335001d4d38186649f", "type": "ipv4", "value": "52.207.120.98", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-47f74216c062b657c4b01753", "type": "ipv4", "value": "52.207.61.182", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-995a8a36202622486ed18c03", "type": "ipv4", "value": "52.209.191.106", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-27dea6e4b37d746050f95120", "type": "ipv4", "value": "52.212.134.173", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5f3b44042a7e1094936be9c6", "type": "ipv4", "value": "52.212.137.44", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f2681bbea8fd2d34dfb5300b", "type": "ipv4", "value": "52.22.107.11", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3a9afc527f5cfb37143147de", "type": "ipv4", "value": "52.22.146.31", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-af6b10bb86e4097af11a1950", "type": "ipv4", "value": "52.22.167.180", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-9f464c6941868146a9a01685", "type": "ipv4", "value": "52.22.246.227", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-aca1db89651a19716ac639a0", "type": "ipv4", "value": "52.22.78.109", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c26001e2dec8854f0d0401be", "type": "ipv4", "value": "52.221.28.32", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-9c53acbb21b043f94fb83545", "type": "ipv4", "value": "52.221.38.91", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-71f472ca8a364f6e186753fc", "type": "ipv4", "value": "52.23.112.47", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2524d7e1f2efc0697b3a0036", "type": "ipv4", "value": "52.24.120.129", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-594c61f84faea0890bbad123", "type": "ipv4", "value": "52.24.137.134", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-22044c2f0e20ceba17750c23", "type": "ipv4", "value": "52.24.57.89", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f9b06c24b674531b42557ace", "type": "ipv4", "value": "52.25.151.172", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-656a41eaeae867c87bccae47", "type": "ipv4", "value": "52.25.20.224", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-882056bb1423e9ad376f2c1f", "type": "ipv4", "value": "52.25.205.181", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-de686498b0de1e22e16391b7", "type": "ipv4", "value": "52.25.41.120", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a5ff037a719c83660fb06d54", "type": "ipv4", "value": "52.25.46.76", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-805885c7fc341b553164189c", "type": "ipv4", "value": "52.25.98.6", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7c7707e87cb91bb422304b94", "type": "ipv4", "value": "52.26.10.3", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8fbe6f170fdff9abe11ae3f5", "type": "ipv4", "value": "52.26.143.166", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4275a0ccd0e75429a69749a3", "type": "ipv4", "value": "52.26.246.54", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f12557d4106d173602d6c6da", "type": "ipv4", "value": "52.27.59.211", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c5b97c94c44307ccd29a3821", "type": "ipv4", "value": "52.27.97.168", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e14d22076bd839feedcedd05", "type": "ipv4", "value": "52.29.182.113", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e1f82b4ab452f069576e1124", "type": "ipv4", "value": "52.3.158.250", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-cd3e2a5d6add88993e93392d", "type": "ipv4", "value": "52.3.167.150", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c524ccbee165d70cdaa4bf77", "type": "ipv4", "value": "52.3.171.209", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-96cef92c0c7b434c5055aedc", "type": "ipv4", "value": "52.3.24.219", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a51fbebcaeeb52bbb3f0a33e", "type": "ipv4", "value": "52.3.56.159", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c32d650fc7727bc465ac4794", "type": "ipv4", "value": "52.32.112.140", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c599a1e0667d5bffbcc19081", "type": "ipv4", "value": "52.32.135.110", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f4b6da9a41641f2d6ee74b7d", "type": "ipv4", "value": "52.32.152.21", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6b191428766459266858c5b8", "type": "ipv4", "value": "52.33.181.135", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ef27e7d21198e70e74d6e4dc", "type": "ipv4", "value": "52.33.53.65", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-20b29e26e7bd4c69c2f5b2d1", "type": "ipv4", "value": "52.34.250.5", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-72515161ef2de953ab44f376", "type": "ipv4", "value": "52.34.60.103", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ddb77241b90276ce55542127", "type": "ipv4", "value": "52.34.79.42", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f1325efc6b985186252ac445", "type": "ipv4", "value": "52.35.100.30", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-413a7b0137bc4651962f12b4", "type": "ipv4", "value": "52.35.138.60", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-baf0db8fcaa5aa96982aa423", "type": "ipv4", "value": "52.35.251.146", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3027edf003fe6e1a681ad9cb", "type": "ipv4", "value": "52.35.48.81", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-508575253f218ea74e9f40b3", "type": "ipv4", "value": "52.36.101.222", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-db4594523558cfc58cf9b496", "type": "ipv4", "value": "52.36.116.231", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5c04f194c88914c3dab1a764", "type": "ipv4", "value": "52.36.228.150", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5e85af5b9a2fbc665243d20e", "type": "ipv4", "value": "52.36.43.94", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ce89d986266ef4b535d879a5", "type": "ipv4", "value": "52.37.19.179", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a40b5a3e674d64f5d44e92d9", "type": "ipv4", "value": "52.38.108.180", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3a0f2918475d56bc9f5c9074", "type": "ipv4", "value": "52.4.123.24", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b2d46b1530cdbc526406ced3", "type": "ipv4", "value": "52.4.138.39", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-489ac2a53f0d25851debfb66", "type": "ipv4", "value": "52.4.188.134", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b0a33c4537001bf625905f8f", "type": "ipv4", "value": "52.4.234.47", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8090b0e3fb932327df81ba93", "type": "ipv4", "value": "52.4.92.244", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-cc66c034c5bed8a686b15c56", "type": "ipv4", "value": "52.40.188.201", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1e364be4895796bb3d281234", "type": "ipv4", "value": "52.40.243.130", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-97e7e8925d71e88a2c890b8f", "type": "ipv4", "value": "52.41.250.17", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5281c3137ea667a72014cb1f", "type": "ipv4", "value": "52.42.185.39", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ad61b3140230690ec1b2c3f5", "type": "ipv4", "value": "52.43.107.250", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c702b8ce0d6151888595ac89", "type": "ipv4", "value": "52.43.21.121", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f3867c0eb0a189c8ea145eec", "type": "ipv4", "value": "52.43.30.37", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5124d979bf719179c0af4444", "type": "ipv4", "value": "52.43.42.188", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e81e526ef6635997e6ac57b6", "type": "ipv4", "value": "52.44.153.144", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5bf72395b868b89509266d12", "type": "ipv4", "value": "52.44.175.211", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-fc8ef82ac16a88bc142f1faa", "type": "ipv4", "value": "52.44.213.64", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8fa1f07d35a58afdf6ecd0ab", "type": "ipv4", "value": "52.44.246.171", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-36c9b4172842496193eace34", "type": "ipv4", "value": "52.44.93.202", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0e142ec94ce3b7662ace3ef4", "type": "ipv4", "value": "52.45.111.226", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-9fc7074b75482d8320feeb79", "type": "ipv4", "value": "52.45.217.171", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1ec047c6abd6a072676d35e8", "type": "ipv4", "value": "52.45.218.154", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-02fe9360a2e8a153f7861cce", "type": "ipv4", "value": "52.48.134.100", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d55f678f539a812abefa2e70", "type": "ipv4", "value": "52.48.186.5", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-cf707ac028e5bd7bb99c0991", "type": "ipv4", "value": "52.51.131.19", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8369b321fa39477fdbe45092", "type": "ipv4", "value": "52.52.130.100", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6a9c5e009a885bd7508fb82e", "type": "ipv4", "value": "52.52.14.142", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0c1ee1eb4be5f78d68a250c9", "type": "ipv4", "value": "52.52.177.27", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f84c77d598da94018cf93632", "type": "ipv4", "value": "52.53.134.30", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ca5361e96c1efd2b349a8a05", "type": "ipv4", "value": "52.54.127.128", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ce6c3c55be719f72ba7ca601", "type": "ipv4", "value": "52.54.208.77", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-77d4f2fc8036138da238effb", "type": "ipv4", "value": "52.55.152.195", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8467c1d2ff8d17b3fb14352a", "type": "ipv4", "value": "52.55.182.21", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-90f4966fb6e2a0d90eb07165", "type": "ipv4", "value": "52.7.157.238", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f70099dc04559d269d4e1f13", "type": "ipv4", "value": "52.7.2.46", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f847d56b684ec949f8ededa7", "type": "ipv4", "value": "52.70.11.152", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ad799f46b61475c6b76db4c8", "type": "ipv4", "value": "52.70.2.4", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4006c1e83c2216ff57df81f3", "type": "ipv4", "value": "52.71.116.75", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ad7ddcfb7afb3fab760a87aa", "type": "ipv4", "value": "52.71.249.74", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6825abc9e0673670f46f8f0c", "type": "ipv4", "value": "52.72.198.167", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-9a8600c0534e79c7d4cb889d", "type": "ipv4", "value": "52.72.75.34", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ad0271c2ae3178546f1f900c", "type": "ipv4", "value": "52.73.123.67", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-12d2b8e3bfc757f0ebf2c04f", "type": "ipv4", "value": "52.73.148.73", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-45adaa7ffc9ba4809122db1e", "type": "ipv4", "value": "52.73.178.249", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-03d0b5c174437987678f4c66", "type": "ipv4", "value": "52.73.182.32", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-16c743e1b3c8762adf5fc574", "type": "ipv4", "value": "52.8.138.67", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-bc41c4aa9cd8292826c487eb", "type": "ipv4", "value": "52.8.189.11", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-52a9e8273e01a15f4b6f5f3b", "type": "ipv4", "value": "52.8.197.244", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-77a20e42bed45b0c4ccb4dda", "type": "ipv4", "value": "52.8.251.186", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c730c49e2116c225c1581f9d", "type": "ipv4", "value": "52.8.70.179", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4b26c87b8ef8c9a15e6fd1dc", "type": "ipv4", "value": "52.86.196.91", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-9bf25433c2ade97205beb57f", "type": "ipv4", "value": "52.87.104.142", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-eda040ad72613546b905ffb9", "type": "ipv4", "value": "52.88.205.160", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-487312f6ddfab4ffebd89f67", "type": "ipv4", "value": "52.88.9.91", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5e23d0ac9437e8fe9aff5ed4", "type": "ipv4", "value": "52.89.134.163", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7ce647c0aaa8463cbe717a22", "type": "ipv4", "value": "52.89.92.187", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6902a05e5808d3a2ed0d4500", "type": "ipv4", "value": "52.9.0.53", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8f52bf0d0416aa0c88333ce9", "type": "ipv4", "value": "52.9.113.206", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5381ef590d7c482a33b32bcf", "type": "ipv4", "value": "52.9.116.187", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1fe060e34cb25f84f1c0e957", "type": "ipv4", "value": "52.9.158.123", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a0f5bdba320a71a6b5513d0e", "type": "ipv4", "value": "52.9.185.0", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0883636a62e5ee974b0aa8a3", "type": "ipv4", "value": "52.9.204.110", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2ed05feff070e888f13fafc0", "type": "ipv4", "value": "52.9.74.88", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e022c14922369b9f683c4f97", "type": "ipv4", "value": "52.9.96.194", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-962d1d34b1f2f3215a934c85", "type": "ipv4", "value": "54.148.121.12", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-31863a77fc0432ae7d260c98", "type": "ipv4", "value": "54.149.127.255", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-15dfe1372a688b8399428ac4", "type": "ipv4", "value": "54.149.176.112", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b86dddff7e18fd7f1c827aab", "type": "ipv4", "value": "54.149.221.157", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-9bc494675bc4337ed6f75366", "type": "ipv4", "value": "54.149.32.18", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3b2af74d1b12f1a8c62ca573", "type": "ipv4", "value": "54.164.252.1", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-29866ce56f613352d0a89e9c", "type": "ipv4", "value": "54.165.0.72", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-25e31c3c39639a3080801ec0", "type": "ipv4", "value": "54.165.113.198", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b4064bfc9be0fd4141bd2f5b", "type": "ipv4", "value": "54.165.9.33", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ab59f8d211f3c137d7f38f86", "type": "ipv4", "value": "54.173.10.244", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a20651b716d3ae849646f751", "type": "ipv4", "value": "54.173.104.93", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-fa86216648ea6941656ca452", "type": "ipv4", "value": "54.175.140.118", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-34e2ffc35f5dd8e531fe7111", "type": "ipv4", "value": "54.175.180.42", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0ad9f9ee2503fdcc8f9b123c", "type": "ipv4", "value": "54.176.31.176", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c0c1e11f86192c40abf26583", "type": "ipv4", "value": "54.177.34.72", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-57bf02508a34ddfebbbc2039", "type": "ipv4", "value": "54.183.102.11", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f3803fa853964e7ee69e8b42", "type": "ipv4", "value": "54.183.154.61", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6f8def799300ed5c9422aaf0", "type": "ipv4", "value": "54.187.102.150", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-658dad5c2ca448ebe56e13f9", "type": "ipv4", "value": "54.187.181.128", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4a430282c79fff2129fcf5f8", "type": "ipv4", "value": "54.187.200.180", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b8c0640106033639aaff4ef9", "type": "ipv4", "value": "54.187.213.9", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-588bc75bdfcf0961d9f9f9e1", "type": "ipv4", "value": "54.187.42.255", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-39812596beceb9a26a2d4c94", "type": "ipv4", "value": "54.191.120.89", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2e4bf9a1861b41196a61fecc", "type": "ipv4", "value": "54.191.224.161", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2aedebdf1b37bf03c2cdfdc0", "type": "ipv4", "value": "54.193.14.224", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4b916056fa3832bb4db10943", "type": "ipv4", "value": "54.193.27.242", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2177029723f55999a429709e", "type": "ipv4", "value": "54.193.79.237", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-702dff3b73afae166dc2027c", "type": "ipv4", "value": "54.193.88.44", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-26b3c98aae9f123888131e56", "type": "ipv4", "value": "54.200.173.146", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3ba29849927cc86da42f867e", "type": "ipv4", "value": "54.200.4.214", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0ffcf54c08f7d0c796c4a86b", "type": "ipv4", "value": "54.201.23.177", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-bfd22d9682a55f792ea7a826", "type": "ipv4", "value": "54.203.249.16", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-dd6177e43cee8d02103bacd5", "type": "ipv4", "value": "54.209.142.208", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-82decfe34a787d49c7f5c3d8", "type": "ipv4", "value": "54.209.175.132", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-481cb7b46c2e99ad7eae95d5", "type": "ipv4", "value": "54.209.175.196", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c0e45c50fbc6d6b6c136578c", "type": "ipv4", "value": "54.210.242.59", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-bc973b86063f9d97408fc03a", "type": "ipv4", "value": "54.210.250.119", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-76988637353c474e7387b2bd", "type": "ipv4", "value": "54.210.58.162", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-00a2aa2a9c4679140ddb26d9", "type": "ipv4", "value": "54.214.247.4", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3b88e9c369fbb6b96b9fcab6", "type": "ipv4", "value": "54.214.30.198", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ec32f74d0f46743769015cc3", "type": "ipv4", "value": "54.215.177.163", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e99e186af81eb062c86e3414", "type": "ipv4", "value": "54.215.190.205", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-9cdadca08a9f3b20f4601eaf", "type": "ipv4", "value": "54.217.209.217", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-35e40db894ac3706b8a4c133", "type": "ipv4", "value": "54.217.228.98", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-efa14573be4441a47ee7b727", "type": "ipv4", "value": "54.217.236.197", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-600dc3a1cce721f9c374b84c", "type": "ipv4", "value": "54.228.184.13", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0ef2937cbd07ece3edd64d28", "type": "ipv4", "value": "54.228.212.156", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e75b6f24cee18addd3227c06", "type": "ipv4", "value": "54.236.143.74", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-74870aa007904c720c6826ac", "type": "ipv4", "value": "54.236.168.144", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7114b0821292e2887952dd73", "type": "ipv4", "value": "54.236.222.119", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1d62a34407800397a39cdf83", "type": "ipv4", "value": "54.241.143.220", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8d33d7204ac38bd8e38d2097", "type": "ipv4", "value": "54.241.145.51", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-727d514e278bf2b815072736", "type": "ipv4", "value": "54.241.184.236", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3707e64197e83c9452e2ff0e", "type": "ipv4", "value": "54.244.243.41", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0b4a4e0b808b6cb7bab0573a", "type": "ipv4", "value": "54.244.245.107", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-98c8096a8f84e88d2c73e128", "type": "ipv4", "value": "54.64.58.164", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-271ededa53b2794e47edaf27", "type": "ipv4", "value": "54.64.66.233", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-36109b85b666b3549a53de30", "type": "ipv4", "value": "54.65.114.208", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d94d286b0dc0c8516459b37b", "type": "ipv4", "value": "54.67.106.41", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c1bdfc07ed284c17727b90f3", "type": "ipv4", "value": "54.68.131.249", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-bf67beaa8651ac2d2f40783c", "type": "ipv4", "value": "54.68.251.4", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4f0079a4aeeb42d858c9e556", "type": "ipv4", "value": "54.68.83.10", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8cb25072bbba4051d6398dc6", "type": "ipv4", "value": "54.68.84.37", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-52e47c41fda0d201e54ca92e", "type": "ipv4", "value": "54.68.91.165", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-da64b37d3213bff2b68b5579", "type": "ipv4", "value": "54.69.174.218", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f61857651693821df0111dda", "type": "ipv4", "value": "54.69.219.111", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-752736fb55b883341c899a6b", "type": "ipv4", "value": "54.69.22.79", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ae15c8c0e383a590a2bd28e5", "type": "ipv4", "value": "54.69.25.207", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3a30d195a01588057c7446ec", "type": "ipv4", "value": "54.69.93.253", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3f5725cdf349251b4c962676", "type": "ipv4", "value": "54.70.199.124", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-18a39b8a1e8a5d78d39d5289", "type": "ipv4", "value": "54.71.113.104", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-854d48a11e2f0fd192f48eca", "type": "ipv4", "value": "54.82.13.247", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-cc7b81e9fc19ce348c097b8e", "type": "ipv4", "value": "54.84.37.167", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d8866312a684198ef76baa60", "type": "ipv4", "value": "63.251.253.232", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-57abb6e8ec4642e39878b394", "type": "ipv4", "value": "63.251.95.2", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ccba202c16c5f14b2f1e5816", "type": "ipv4", "value": "63.251.95.3", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-39350972ea69ce4d81fb8891", "type": "ipv4", "value": "63.251.95.4", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5d8d21d22a05e9a0f15c8ff4", "type": "ipv4", "value": "64.233.161.120", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-edae78360d2be19f029260f9", "type": "ipv4", "value": "64.233.161.94", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b2e2c1287bbbfb50bcf1e3b3", "type": "ipv4", "value": "64.233.171.120", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7e8b9352c862f7bcb123e460", "type": "ipv4", "value": "64.233.171.94", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b28e3c83bd87e207501c9b19", "type": "ipv4", "value": "64.233.184.120", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-470aee9fc573ff1fe369e140", "type": "ipv4", "value": "64.41.197.60", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-49b77e0e18b015741218dd73", "type": "ipv4", "value": "64.7.200.2", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-01efa668bd26c00640bbc8d9", "type": "ipv4", "value": "64.7.200.3", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-9a0a5eb8264730f0ca59f104", "type": "ipv4", "value": "64.7.200.4", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3c9bcb03db1dbf2848bbe936", "type": "ipv4", "value": "64.7.200.5", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-71e2ebbb332abcdf14bf148b", "type": "ipv4", "value": "64.7.201.2", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c2e84bfeaa8465437332ebc3", "type": "ipv4", "value": "64.7.201.3", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-17bfaf935f64e5fbe665afa0", "type": "ipv4", "value": "64.7.201.4", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-57070dfc7d2e629dca557f3f", "type": "ipv4", "value": "64.7.201.5", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-9fa1127a0b17628d20f8923f", "type": "ipv4", "value": "74.121.136.131", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-63212db3891673008f57406b", "type": "ipv4", "value": "74.125.126.120", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-013b786627fb3c5bfdb18a74", "type": "ipv4", "value": "74.125.126.94", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ec083a1bbc668d0296ab1a54", "type": "ipv4", "value": "74.125.195.157", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-fa58b1db6b21751df6dec6f7", "type": "ipv4", "value": "74.125.200.120", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-356f70f0ac544bf156dc62a8", "type": "ipv4", "value": "74.125.200.94", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-cd9b749be1762153677779c4", "type": "ipv4", "value": "74.125.23.120", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-fdb2408a3655a79d8eeece3f", "type": "ipv4", "value": "74.125.23.94", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-60dda77a9eff23c4f2732415", "type": "ipv4", "value": "74.125.28.120", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1e9e131d8aab0cbd9cd804b1", "type": "ipv4", "value": "74.125.28.94", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4822415353743f64abee4b0b", "type": "ipv4", "value": "74.214.196.134", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-baa1ac3d771d33f876e2c065", "type": "ipv4", "value": "77.88.21.119", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d9cfaf09ac939c262dd4f5ac", "type": "ipv4", "value": "77.88.21.90", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-61396f391c29efe596973a1b", "type": "ipv4", "value": "8.39.36.142", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-cf137e388fe78b75c56e873a", "type": "ipv4", "value": "8.39.36.144", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-60c4872b89e9b3f83c1eb6fd", "type": "ipv4", "value": "8.39.36.173", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c57fa17cde42bd21d4c76b73", "type": "ipv4", "value": "85.114.159.118", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2dda969d1be000e22c2609a4", "type": "ipv4", "value": "87.240.129.71", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-9c1adb2b6e8bfea6b034bf90", "type": "ipv4", "value": "87.240.180.136", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e25b7b968a3fd05e18e36539", "type": "ipv4", "value": "87.240.182.224", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d77aa6a6d8ae8e8e96d1e559", "type": "ipv4", "value": "87.250.250.119", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d7a49598f768fd5941026415", "type": "ipv4", "value": "87.250.250.38", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-806f32d1a7b2154f89077794", "type": "ipv4", "value": "87.250.250.90", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-cf01ddf0b26c905c02aaece3", "type": "ipv4", "value": "87.250.251.119", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ac96f854054632eb466b5fa9", "type": "ipv4", "value": "88.212.196.101", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c003dc4dd1acb682267a3bb3", "type": "ipv4", "value": "88.212.196.102", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-9f687975633ba3d4774960e7", "type": "ipv4", "value": "88.212.196.104", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-73d9fca28c2dcd12d4724d07", "type": "ipv4", "value": "88.212.196.105", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7681c5cc62a1b75c7ba6a8d8", "type": "ipv4", "value": "88.212.196.122", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-43578ae382f42bf247aa4eb7", "type": "ipv4", "value": "88.212.196.124", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4aae51b38312b6ec3daf541f", "type": "ipv4", "value": "88.212.196.66", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-136652b072d43f49012fba15", "type": "ipv4", "value": "88.212.196.69", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0c5c73af7f0b2b67cad6f731", "type": "ipv4", "value": "88.212.196.72", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0567c831d9fe032fb822ba36", "type": "ipv4", "value": "88.212.196.75", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-af88ead8553c1ae19150e86f", "type": "ipv4", "value": "88.212.196.77", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-df8f406cfe44a0267c8b02b6", "type": "ipv4", "value": "88.212.201.193", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-31d357366cea0426cb5cec8b", "type": "ipv4", "value": "88.212.201.194", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-abdbebf3dea87840b30976ec", "type": "ipv4", "value": "88.212.201.195", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1e8f133e1212322df98e5715", "type": "ipv4", "value": "88.212.201.196", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2086181ab66706cad5c306e9", "type": "ipv4", "value": "88.212.201.197", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d2fe92dbed966b147efea5a8", "type": "ipv4", "value": "88.212.201.199", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-cb448c3a75b1a53e78ca2997", "type": "ipv4", "value": "88.212.201.205", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4be9f05da879a53c58b11890", "type": "ipv4", "value": "88.212.201.207", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2b759bf8abf168f1588d2538", "type": "ipv4", "value": "88.212.201.208", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b323beeeb202c42dd4dec554", "type": "ipv4", "value": "88.212.252.69", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-43a27b88853edc7622d439ff", "type": "ipv4", "value": "88.212.252.70", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-db8ddc94ac99a686a33baf2c", "type": "ipv4", "value": "88.212.252.78", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-cbc54f6dfc5b0b9f057681a0", "type": "ipv4", "value": "88.99.210.183", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7dbf89bd69d6b3e94d8300e5", "type": "ipv4", "value": "88.99.232.10", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-91ad5f832dc8e7ac5aa00851", "type": "ipv4", "value": "88.99.5.37", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ee70debf204f955a93268bb2", "type": "ipv4", "value": "88.99.56.120", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d24a59a81e3f431f4bb0b644", "type": "ipv4", "value": "88.99.95.120", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-adfdd305a8424d11080c9350", "type": "ipv4", "value": "88.99.95.121", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-710e764d08c6926e11147cfa", "type": "ipv4", "value": "89.223.92.202", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4b31d34a848774b74f08ac41", "type": "ipv4", "value": "93.158.134.37", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f35f8f27a06bab48555515e1", "type": "ipv4", "value": "95.213.222.11", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6d46486541a1cce7b75b2dbf", "type": "ipv4", "value": "95.213.222.13", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-567b3c67e7a45d4e735e073d", "type": "ipv4", "value": "95.213.222.17", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2b239530509173dda09eb1c0", "type": "ipv4", "value": "95.213.222.27", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d029e37042f7fe5e6c2d216d", "type": "ipv4", "value": "95.213.222.29", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5cc7e4e2d671eb720d19faf5", "type": "ipv4", "value": "95.213.222.9", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f9c235eba1265c5b01796853", "type": "ipv4", "value": "95.216.24.148", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-00973c38f4f86204a789f912", "type": "ipv4", "value": "95.216.24.149", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-89d4c37435f131bacd4d3313", "type": "ipv4", "value": "95.216.24.150", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e17f8b987c9ba869003a6d26", "type": "ipv4", "value": "185.68.93.18", "priority": 100, "reasons": [ "existing-evidence-candidate", "http_request-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": true }, { "observable_id": "observable-adb255911d18e7d3b23f4927", "type": "sha256", "value": "b908d9b1001d0a39ba92501c086b1c25b05b171eeda035ae9f3e129d2776a314", "priority": 100, "reasons": [ "existing-evidence-candidate", "recovered-script-like-text-bytes" ], "direct_checked": false, "checked_providers": [ "malwarebazaar", "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": true }, { "observable_id": "observable-1c8cbc8a2feb26e33dbc1e23", "type": "sha256", "value": "1d762c3dcf8ec1d7cf68b813aed274886103a60b67c11ff9f166398e96fdedaf", "priority": 95, "reasons": [ "recovered-script-like-text-bytes" ], "direct_checked": false, "checked_providers": [ "malwarebazaar", "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-469955a2e09f0ab1c8be025d", "type": "sha256", "value": "225bd232b88e6072f4601058ebf7a0db0fa5cb3bf7537350c7de0bf5f2f5c54a", "priority": 95, "reasons": [ "recovered-script-like-text-bytes" ], "direct_checked": false, "checked_providers": [ "malwarebazaar", "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7f59b34c1404b2804edcb2f2", "type": "sha256", "value": "87da7fce38fb944279568a460f952df3009b4398083bbe5dedb489fde5f46814", "priority": 95, "reasons": [ "recovered-script-like-text-bytes" ], "direct_checked": false, "checked_providers": [ "malwarebazaar", "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f391393ca52867bcf147fef4", "type": "sha256", "value": "8ed22d97053651c1bf38b50de0630657e03c9dc1b82f2c80241d72dd68c34fc8", "priority": 95, "reasons": [ "recovered-script-like-text-bytes" ], "direct_checked": false, "checked_providers": [ "malwarebazaar", "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-bf135081606734b07b12c7f8", "type": "sha256", "value": "bc1fc69f9747dc034ece7d9bb795c5e596d9be6ca71efe75c6c0fd18f3cbfbf5", "priority": 95, "reasons": [ "recovered-pe-bytes" ], "direct_checked": false, "checked_providers": [ "malwarebazaar", "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a1e63b6f998929d2c2bbdfb8", "type": "sha256", "value": "beff9a913c0887163fd4a17d037f2188ed9e93f6c57f770448c2f7046ca7d141", "priority": 95, "reasons": [ "recovered-script-like-text-bytes" ], "direct_checked": false, "checked_providers": [ "malwarebazaar", "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-51124e568e4eea087652aafc", "type": "sha256", "value": "c0d599b80025a70004d813d62b587af4f8ae8abd64f514f280b6e4899436623f", "priority": 95, "reasons": [ "recovered-script-like-text-bytes" ], "direct_checked": false, "checked_providers": [ "malwarebazaar", "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-01688be6d59bc3dec4f7faf1", "type": "sha256", "value": "fb03a6b96e7aa8dc5c4e079289c84f446a7374d65f7bb79a734c34c9fb8e7703", "priority": 95, "reasons": [ "recovered-script-like-text-bytes" ], "direct_checked": false, "checked_providers": [ "malwarebazaar", "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7bba686247a58a37aa55c593", "type": "domain", "value": "connect.facebook.net", "priority": 80, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4ffac87c81591710ab6d3e1c", "type": "domain", "value": "r53x.com", "priority": 80, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-52c9f4f1fd3cceb704a7fb8c", "type": "domain", "value": "staticxx.facebook.com", "priority": 80, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d458120e432992d199b50450", "type": "domain", "value": "tass.com", "priority": 80, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ab2217bf6e2a522a1543de3d", "type": "domain", "value": "vk.com", "priority": 80, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-cd5a6ab6cd79e9a50658623b", "type": "domain", "value": "www.googletagmanager.com", "priority": 80, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-96aaa7bbf0447255e4ecb7b9", "type": "ipv4", "value": "103.5.149.72", "priority": 80, "reasons": [ "http_request-peer", "served-inspectable-file-not-transitive-verdict" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1ac3d2569214ee0d3b919151", "type": "ipv4", "value": "149.129.222.112", "priority": 80, "reasons": [ "http_request-peer", "served-inspectable-file-not-transitive-verdict" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-971ef05dd2064ac6ead2c21f", "type": "ipv4", "value": "157.240.11.22", "priority": 80, "reasons": [ "http_request-peer", "served-inspectable-file-not-transitive-verdict", "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-69192f7a4c1563cb96fb0b80", "type": "ipv4", "value": "216.58.192.8", "priority": 80, "reasons": [ "http_request-peer", "served-inspectable-file-not-transitive-verdict" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0ce6dbe582438056a0d3e7f2", "type": "ipv4", "value": "87.240.129.133", "priority": 80, "reasons": [ "http_request-peer", "served-inspectable-file-not-transitive-verdict", "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f21185fc200c9a6eef3b0a3a", "type": "domain", "value": "sputnikhouse.org", "priority": 60, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-934e2627f9334c71757cb2a7", "type": "domain", "value": "2886.tm.zedo.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f777454fc3bd916acbb09b8e", "type": "domain", "value": "a.company-target.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-10222abcad79cdccbc816638", "type": "domain", "value": "a.tribalfusion.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-fbb47adf15a799bb788dab4c", "type": "domain", "value": "a1.adform.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-dcebfe608057869781e73cab", "type": "domain", "value": "a1.seadform.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2f1304c9b5a98cd310d5a050", "type": "domain", "value": "aa.agkn.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d77642f1caea417e65b2c887", "type": "domain", "value": "acdn.adnxs.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5068e3d77075aadc4713431e", "type": "domain", "value": "ad.360yield.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d40ace90662479f3f4ca0111", "type": "domain", "value": "ad.lkqd.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8ac8395c06607fe22abab7c7", "type": "domain", "value": "ad.sxp.smartclip.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-beb6113bbe9119ab1a034569", "type": "domain", "value": "ad.turn.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2a62c6218d8e77b494a02db1", "type": "domain", "value": "ade.googlesyndication.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1431f11394a076d5106bd8b9", "type": "domain", "value": "ads.adaptv.advertising.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0301b278b153e90a49cdbcbd", "type": "domain", "value": "ads.creative-serving.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1c113eb07020d9064f3519eb", "type": "domain", "value": "ads.deliverimp.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4ab618521f66e8ca2f522a1f", "type": "domain", "value": "ads.lfstmedia.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8d783fe4d6467f6d8473f1fa", "type": "domain", "value": "ads.pubmatic.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1bd0579a2c166a0a875f00ee", "type": "domain", "value": "ads.rubiconproject.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3a62ea6ed897542e9266e274", "type": "domain", "value": "ads.scorecardresearch.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-733b2479d76b6a3b6565c633", "type": "domain", "value": "ads.stickyadstv.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6532c7f57b1bf4d31af9b9aa", "type": "domain", "value": "ads.yahoo.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ddb670955e1ae440d1b2174a", "type": "domain", "value": "adserver.adtech.advertising.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ac850e4b152503246c39a787", "type": "domain", "value": "adservice.google.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4eaccdae1741c28f56c7ec19", "type": "domain", "value": "adventori.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2729e512305fa7b5b9910e38", "type": "domain", "value": "ag.innovid.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-bc47abb78996bf01806765d8", "type": "domain", "value": "ajax.googleapis.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e7bc633a5f29e1c198ad7cf0", "type": "domain", "value": "an.yandex.ru", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ba07179d2d5eb2f6a67c1c96", "type": "domain", "value": "apnx-match.dotomi.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5db37a40b09aea568541b17c", "type": "domain", "value": "appnexus-partners.tremorhub.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-32914d384f2d694bc5e1387c", "type": "domain", "value": "apps.identrust.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0e180111e55812a0780becb3", "type": "domain", "value": "b1sync.zemanta.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3ce86d37873aa1ed1d48cfbe", "type": "domain", "value": "bcp.crwdcntrl.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-039607d4ead2613692c45d40", "type": "domain", "value": "beacon.tru.am", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-fdd558bc7afada9660d6acb1", "type": "domain", "value": "beacon.walmart.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e5148f17e6b2740d58ed8ab7", "type": "domain", "value": "bh.contextweb.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0f5c0dd3987f243ffa61b174", "type": "domain", "value": "bid.contextweb.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-295eb88469c855b00c376e7c", "type": "domain", "value": "bid.g.doubleclick.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-49569d00ad9a501d3e711a9f", "type": "domain", "value": "bidder.criteo.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-cc14587a63bbb378e587abf2", "type": "domain", "value": "bttrack.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8a95b938f3ca8ce1d9af9b6d", "type": "domain", "value": "c.bing.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3e636082c043f30c46c39c71", "type": "domain", "value": "c1.adform.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-07b01bc6376db90653fd692d", "type": "domain", "value": "cacerts.digicert.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3ef2c5743cff9c02351ac73c", "type": "domain", "value": "cdn-ssl.vidible.tv", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-447080e31c06cfe2a882149e", "type": "domain", "value": "cdn.adnxs.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4e7524f4352ae53c36402823", "type": "domain", "value": "cdn.doubleverify.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f1ef276d2e5165b1376b7de6", "type": "domain", "value": "cdn.jsdelivr.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-698ca1b7965a743c2cf40d8b", "type": "domain", "value": "cdn.marphezis.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-11caa9a42f5f0ef5cf7f4a52", "type": "domain", "value": "cdn.onthe.io", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8f5e8915ac6812872d813d28", "type": "domain", "value": "cdn1.tass.ru", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3d588cad94e0883438b1d29c", "type": "domain", "value": "cdn2.tass.ru", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a77e611ca230b53dfbc16ba5", "type": "domain", "value": "cdn3.doubleverify.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b1a30670a41ae63ba2bc4482", "type": "domain", "value": "cdni.rt.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-54bf5b371f538e33b544ef53", "type": "domain", "value": "ce.lijit.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-21ca2fb53ad396b752303c24", "type": "domain", "value": "cm.adform.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a880cd9083cb15bddfbce855", "type": "domain", "value": "cm.adgrx.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5d78dc8fd8aadddcc222e2d5", "type": "domain", "value": "cm.eyereturn.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0b1c758fb28c330e7f0867c0", "type": "domain", "value": "cm.g.doubleclick.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-068a6da0bb79c5358c41de74", "type": "domain", "value": "cms.quantserve.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-46e299f63770703c45b1fe13", "type": "domain", "value": "code.createjs.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false } ], "eligible_count": 1333, "next_batch": [ "observable-bb30103ef150f09e844062d3", "observable-11b3d20f8a01d79ad42e0f41", "observable-1b0dd5551415606cbe457769", "observable-675e39910228b5dfa2e4c4be", "observable-984aee067a4f012bc805745f", "observable-2349944df038289ddc008eb0", "observable-8191c7cc91a36f601f6d72cd", "observable-9fcbd8a9e74af65c74f74d50", "observable-a571e9fad414646fbe746f75", "observable-e49397f353a16eaec241c135" ], "scope": "Query recommendations, not IOC verdicts. Partial provider coverage stays pending; cooldowns/credential failures are not completed checks. Checked means completed attempted direct providers, not all available providers. Review before external disclosure." }, "assessment_sha256": "0e1fea8bce86de870206b4f28ffc2ca67ce29b6547f4ad0bd73880177ea3ff01" }, "enrichment": { "items": [ { "type": "domain", "value": "code.createjs.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:49:09.418246+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:09.416051+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:49:09.413011+00:00", "observable_id": "observable-46e299f63770703c45b1fe13" }, { "type": "domain", "value": "cms.quantserve.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:49:08.678442+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:08.676821+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:49:08.674967+00:00", "observable_id": "observable-068a6da0bb79c5358c41de74" }, { "type": "domain", "value": "cm.g.doubleclick.net", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:45:13.189219+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:08.672936+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:49:08.671080+00:00", "observable_id": "observable-0b1c758fb28c330e7f0867c0" }, { "type": "domain", "value": "cm.eyereturn.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:45:56.146510+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:08.666916+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:49:08.662889+00:00", "observable_id": "observable-5d78dc8fd8aadddcc222e2d5" }, { "type": "domain", "value": "cm.adgrx.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:45:55.750716+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:08.657755+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:49:08.653736+00:00", "observable_id": "observable-a880cd9083cb15bddfbce855" }, { "type": "domain", "value": "cm.adform.net", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:49:08.475717+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:08.471118+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:49:08.466432+00:00", "observable_id": "observable-21ca2fb53ad396b752303c24" }, { "type": "domain", "value": "ce.lijit.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:48:09.572549+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:08.461930+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:49:08.456050+00:00", "observable_id": "observable-54bf5b371f538e33b544ef53" }, { "type": "domain", "value": "cdni.rt.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:49:08.281199+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:08.276810+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:49:08.271620+00:00", "observable_id": "observable-b1a30670a41ae63ba2bc4482" }, { "type": "domain", "value": "cdn3.doubleverify.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:49:08.093195+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:08.088788+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:49:08.083889+00:00", "observable_id": "observable-a77e611ca230b53dfbc16ba5" }, { "type": "domain", "value": "cdn2.tass.ru", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:49:07.908551+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:07.904378+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:49:07.899290+00:00", "observable_id": "observable-3d588cad94e0883438b1d29c" }, { "type": "domain", "value": "cdn1.tass.ru", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:49:07.735438+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:07.733189+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:49:07.730128+00:00", "observable_id": "observable-8f5e8915ac6812872d813d28" }, { "type": "domain", "value": "cdn.onthe.io", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:49:07.184087+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:07.180255+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:49:07.175221+00:00", "observable_id": "observable-11caa9a42f5f0ef5cf7f4a52" }, { "type": "domain", "value": "cdn.marphezis.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:49:06.996611+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:06.992305+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:49:06.987958+00:00", "observable_id": "observable-698ca1b7965a743c2cf40d8b" }, { "type": "domain", "value": "cdn.jsdelivr.net", "signals": [ { "basis": "No direct maliciousness evidence", "actors": [], "source": "threatfox", "status": "ok", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:49:06.619253+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [ { "tier": 1, "source": "cdn.jsdelivr.net", "target": "https://cdn.jsdelivr.net/gh/vitiapig/api-bd7dff3f-84b7-4bbb-a8e1-7be98555d879/js", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "cdn.jsdelivr.net", "target": "https://cdn.jsdelivr.net/gh/vitiapig/lang-28/robot", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "cdn.jsdelivr.net", "target": "https://cdn.jsdelivr.net/gh/arinao7/8327ac99-c06c-422f-bd2e-4a80978d52c9/api-45", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "cdn.jsdelivr.net", "target": "https://cdn.jsdelivr.net/gh/arinao7/6e91d58f-acdf/e62", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "cdn.jsdelivr.net", "target": "https://cdn.jsdelivr.net/gh/arinao7/6e91d58f-acdf/key", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "cdn.jsdelivr.net", "target": "https://cdn.jsdelivr.net/gh/arinao7/86227780-d251hllg", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "cdn.jsdelivr.net", "target": "https://cdn.jsdelivr.net/gh/savina-41/mcv4f-jp5/launching", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "cdn.jsdelivr.net", "target": "https://cdn.jsdelivr.net/gh/savina-41/8a-96dfe89a4aa3/hum-id46", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "cdn.jsdelivr.net", "target": "https://cdn.jsdelivr.net/gh/savina-41/d846-4abc/id-7843", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "cdn.jsdelivr.net", "target": "https://cdn.jsdelivr.net/gh/savina-41/r4240-98d7-bc2c@main/fe3b", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "cdn.jsdelivr.net", "target": "https://cdn.jsdelivr.net/gh/savina-41/4240-98d7-bc2c@main/fe3b", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "cdn.jsdelivr.net", "target": "https://cdn.jsdelivr.net/gh/savina-41/jjh-765/nxx-5", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "cdn.jsdelivr.net", "target": "https://cdn.jsdelivr.net/gh/savina-41vf67-74j/forw-74", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "cdn.jsdelivr.net", "target": "https://cdn.jsdelivr.net/gh/louis-mellor/2d-aee4-1433332c1@main/f5", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "cdn.jsdelivr.net", "target": "https://cdn.jsdelivr.net/gh/galinavsuk6/sdg7-j9/r-fd7", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "cdn.jsdelivr.net", "target": "https://cdn.jsdelivr.net/gh/galinavsuk6/fjhg-567/hum", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "cdn.jsdelivr.net", "target": "https://cdn.jsdelivr.net/gh/galinavsuk6/fjhg-567/hm-354", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "cdn.jsdelivr.net", "target": "https://cdn.jsdelivr.net/gh/galinavsuk6/text-set/vbr", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "cdn.jsdelivr.net", "target": "https://cdn.jsdelivr.net/gh/galinavsuk6/text-set/vdr", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "cdn.jsdelivr.net", "target": "https://cdn.jsdelivr.net/gh/swiftvpnaccess/wanting-public-driver-barricade/78956-uuid", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "cdn.jsdelivr.net", "target": "https://cdn.jsdelivr.net/gh/swiftvpnaccess/wanting-public-driver-barricade/256446-uuid", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "cdn.jsdelivr.net", "target": "https://cdn.jsdelivr.net/gh/swiftvpnaccess/smtp-incoming-mx/load", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "cdn.jsdelivr.net", "target": "https://cdn.jsdelivr.net/gh/kud-981/9564-41286dbead85@d02d0a9/set", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "cdn.jsdelivr.net", "target": "https://cdn.jsdelivr.net/gh/zor-876/futures-import@8b224a7/requests", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "cdn.jsdelivr.net", "target": "https://cdn.jsdelivr.net/gh/zor-876/futures-import@04e2419/llm", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "cdn.jsdelivr.net", "target": "https://cdn.jsdelivr.net/gh/kud-981/sandy-lumping-mandarin@a1fee8e/sys", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "cdn.jsdelivr.net", "target": "https://cdn.jsdelivr.net/gh/kud-981/kirby-s1@3859d64/kk-w7", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "cdn.jsdelivr.net", "target": "https://cdn.jsdelivr.net/gh/kud-981/rt-3476@62fe780/kurt-38", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "cdn.jsdelivr.net", "target": "https://cdn.jsdelivr.net/gh/kud-981/upstroke@main/unaware", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "cdn.jsdelivr.net", "target": "https://cdn.jsdelivr.net/gh/kud-981/bunt@charred/error", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "cdn.jsdelivr.net", "target": "https://cdn.jsdelivr.net/gh/stroller-del/shrouded/growl", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "cdn.jsdelivr.net", "target": "https://cdn.jsdelivr.net/gh/stroller-del/slicing/doornail", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "cdn.jsdelivr.net", "target": "https://cdn.jsdelivr.net/gh/roadvillnet/fred/iren", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "cdn.jsdelivr.net", "target": "https://cdn.jsdelivr.net/gh/Max-856/treem/luda", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "cdn.jsdelivr.net", "target": "https://cdn.jsdelivr.net/gh/Max-856/crocs/fulls", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "cdn.jsdelivr.net", "target": "https://cdn.jsdelivr.net/gh/marye4562/trimester/implosive", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "cdn.jsdelivr.net", "target": "https://cdn.jsdelivr.net/gh/marye4562/drown/silenced", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "cdn.jsdelivr.net", "target": "https://cdn.jsdelivr.net/gh/payphone-blip/flamingo/lola", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "cdn.jsdelivr.net", "target": "https://cdn.jsdelivr.net/gh/marye4562/hd3y64jd8ryt6q/dh476f7fkr9t", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "cdn.jsdelivr.net", "target": "https://cdn.jsdelivr.net/gh/marye4562/hd3y64jd8ryt6q/dh476f7fkr9t", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" } ], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:06.614777+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:49:06.609651+00:00", "observable_id": "observable-f1ef276d2e5165b1376b7de6" }, { "type": "domain", "value": "cdn.doubleverify.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:44:59.472971+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:06.605219+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:49:06.600262+00:00", "observable_id": "observable-4e7524f4352ae53c36402823" }, { "type": "domain", "value": "cdn.adnxs.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:49:06.425885+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:06.421839+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:49:06.417528+00:00", "observable_id": "observable-447080e31c06cfe2a882149e" }, { "type": "domain", "value": "cdn-ssl.vidible.tv", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:49:06.240567+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:06.234901+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:49:06.228996+00:00", "observable_id": "observable-3ef2c5743cff9c02351ac73c" }, { "type": "domain", "value": "cacerts.digicert.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:49:06.069374+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:06.067688+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:49:06.066116+00:00", "observable_id": "observable-07b01bc6376db90653fd692d" }, { "type": "domain", "value": "c1.adform.net", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:44:58.799281+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:06.064418+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:49:06.062721+00:00", "observable_id": "observable-3e636082c043f30c46c39c71" }, { "type": "domain", "value": "c.bing.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:44:57.355750+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:06.061117+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:49:06.059420+00:00", "observable_id": "observable-8a95b938f3ca8ce1d9af9b6d" }, { "type": "domain", "value": "bttrack.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:44:56.981182+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:06.056900+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:49:06.054239+00:00", "observable_id": "observable-cc14587a63bbb378e587abf2" }, { "type": "domain", "value": "bidder.criteo.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:44:56.487748+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:05.681076+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:49:05.676145+00:00", "observable_id": "observable-49569d00ad9a501d3e711a9f" }, { "type": "domain", "value": "bid.g.doubleclick.net", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:46:16.065253+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:05.673366+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:49:05.671194+00:00", "observable_id": "observable-295eb88469c855b00c376e7c" }, { "type": "domain", "value": "bid.contextweb.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:49:05.502231+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:05.497614+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:49:05.491713+00:00", "observable_id": "observable-0f5c0dd3987f243ffa61b174" }, { "type": "domain", "value": "bh.contextweb.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:44:56.288623+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:05.487713+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:49:05.483313+00:00", "observable_id": "observable-e5148f17e6b2740d58ed8ab7" }, { "type": "domain", "value": "beacon.walmart.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:49:05.315876+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:05.313366+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:49:05.310723+00:00", "observable_id": "observable-fdd558bc7afada9660d6acb1" }, { "type": "domain", "value": "beacon.tru.am", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:49:05.132423+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:05.130001+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:49:05.127371+00:00", "observable_id": "observable-039607d4ead2613692c45d40" }, { "type": "domain", "value": "bcp.crwdcntrl.net", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:48:34.683484+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:05.124596+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:49:05.121831+00:00", "observable_id": "observable-3ce86d37873aa1ed1d48cfbe" }, { "type": "domain", "value": "b1sync.zemanta.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:44:54.921986+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:05.119349+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:49:05.116400+00:00", "observable_id": "observable-0e180111e55812a0780becb3" }, { "type": "domain", "value": "apps.identrust.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:48:45.690197+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:05.113565+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:49:05.110663+00:00", "observable_id": "observable-32914d384f2d694bc5e1387c" }, { "type": "domain", "value": "appnexus-partners.tremorhub.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:49:04.938184+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:04.936374+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:49:04.933642+00:00", "observable_id": "observable-5db37a40b09aea568541b17c" }, { "type": "domain", "value": "apnx-match.dotomi.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:49:04.437220+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:04.433200+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:49:04.428668+00:00", "observable_id": "observable-ba07179d2d5eb2f6a67c1c96" }, { "type": "domain", "value": "an.yandex.ru", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:49:04.249057+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:04.247234+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:49:04.245261+00:00", "observable_id": "observable-e7bc633a5f29e1c198ad7cf0" }, { "type": "domain", "value": "ajax.googleapis.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:45:10.341533+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:04.243462+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:49:04.241621+00:00", "observable_id": "observable-bc47abb78996bf01806765d8" }, { "type": "domain", "value": "ag.innovid.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:48:21.118393+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:04.239317+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:49:04.237143+00:00", "observable_id": "observable-2729e512305fa7b5b9910e38" }, { "type": "domain", "value": "adventori.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:49:04.063991+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:04.059067+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:49:04.055303+00:00", "observable_id": "observable-4eaccdae1741c28f56c7ec19" }, { "type": "domain", "value": "adservice.google.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:44:49.436607+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:04.051287+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:49:04.047329+00:00", "observable_id": "observable-ac850e4b152503246c39a787" }, { "type": "domain", "value": "adserver.adtech.advertising.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:45:52.871850+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:04.042538+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:49:04.038468+00:00", "observable_id": "observable-ddb670955e1ae440d1b2174a" }, { "type": "domain", "value": "ads.yahoo.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:44:48.848605+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:04.034254+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:49:04.028193+00:00", "observable_id": "observable-6532c7f57b1bf4d31af9b9aa" }, { "type": "domain", "value": "ads.stickyadstv.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:49:03.850117+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:03.845857+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:49:03.841010+00:00", "observable_id": "observable-733b2479d76b6a3b6565c633" }, { "type": "domain", "value": "ads.scorecardresearch.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:49:03.668905+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:03.666296+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:49:03.663234+00:00", "observable_id": "observable-3a62ea6ed897542e9266e274" }, { "type": "domain", "value": "ads.rubiconproject.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:48:20.371432+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:03.242321+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:49:03.238390+00:00", "observable_id": "observable-1bd0579a2c166a0a875f00ee" }, { "type": "domain", "value": "ads.pubmatic.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:44:48.666824+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:03.234029+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:49:03.228281+00:00", "observable_id": "observable-8d783fe4d6467f6d8473f1fa" }, { "type": "domain", "value": "ads.lfstmedia.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:49:03.039384+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:03.035030+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:49:03.029666+00:00", "observable_id": "observable-4ab618521f66e8ca2f522a1f" }, { "type": "domain", "value": "ads.deliverimp.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:49:02.849478+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:02.846193+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:49:02.841923+00:00", "observable_id": "observable-1c113eb07020d9064f3519eb" }, { "type": "domain", "value": "ads.creative-serving.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:49:02.673702+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:02.671994+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:49:02.669721+00:00", "observable_id": "observable-0301b278b153e90a49cdbcbd" }, { "type": "domain", "value": "ads.adaptv.advertising.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:49:02.095057+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:02.093353+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:49:02.091623+00:00", "observable_id": "observable-1431f11394a076d5106bd8b9" }, { "type": "domain", "value": "ade.googlesyndication.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:44:48.492813+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:02.089950+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:49:02.088189+00:00", "observable_id": "observable-2a62c6218d8e77b494a02db1" }, { "type": "domain", "value": "ad.turn.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:44:48.311339+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:02.086451+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:49:02.084389+00:00", "observable_id": "observable-beb6113bbe9119ab1a034569" }, { "type": "domain", "value": "ad.sxp.smartclip.net", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:49:01.911066+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:01.909237+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:49:01.906960+00:00", "observable_id": "observable-8ac8395c06607fe22abab7c7" }, { "type": "domain", "value": "ad.lkqd.net", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:49:01.731613+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:01.729517+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:49:01.726542+00:00", "observable_id": "observable-d40ace90662479f3f4ca0111" }, { "type": "domain", "value": "ad.360yield.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:49:01.239305+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:01.237086+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:49:01.234582+00:00", "observable_id": "observable-5068e3d77075aadc4713431e" }, { "type": "domain", "value": "acdn.adnxs.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:44:47.815272+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:01.231849+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:49:01.228626+00:00", "observable_id": "observable-d77642f1caea417e65b2c887" }, { "type": "domain", "value": "aa.agkn.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:44:46.562458+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:01.225470+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:49:01.222737+00:00", "observable_id": "observable-2f1304c9b5a98cd310d5a050" }, { "type": "domain", "value": "a1.seadform.net", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:49:01.041410+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:01.038517+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:49:01.035778+00:00", "observable_id": "observable-dcebfe608057869781e73cab" }, { "type": "domain", "value": "a1.adform.net", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:49:00.881562+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:00.879602+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:49:00.877635+00:00", "observable_id": "observable-fbb47adf15a799bb788dab4c" }, { "type": "domain", "value": "a.tribalfusion.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:44:46.368151+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:00.875661+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:49:00.873479+00:00", "observable_id": "observable-10222abcad79cdccbc816638" }, { "type": "domain", "value": "a.company-target.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:49:00.706504+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:00.703676+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:49:00.700020+00:00", "observable_id": "observable-f777454fc3bd916acbb09b8e" }, { "type": "domain", "value": "2886.tm.zedo.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:49:00.522590+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:00.520047+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:49:00.516856+00:00", "observable_id": "observable-934e2627f9334c71757cb2a7" }, { "type": "domain", "value": "sputnikhouse.org", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:49:00.339668+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:00.335254+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:49:00.329591+00:00", "observable_id": "observable-f21185fc200c9a6eef3b0a3a" }, { "type": "ipv4", "value": "87.240.129.133", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:49:00.146530+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:49:00.143999+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:49:00.141099+00:00", "observable_id": "observable-0ce6dbe582438056a0d3e7f2" }, { "type": "ipv4", "value": "216.58.192.8", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:59.390971+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:59.386066+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:59.380554+00:00", "observable_id": "observable-69192f7a4c1563cb96fb0b80" }, { "type": "ipv4", "value": "157.240.11.22", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:59.197115+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:59.194172+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:59.190613+00:00", "observable_id": "observable-971ef05dd2064ac6ead2c21f" }, { "type": "ipv4", "value": "149.129.222.112", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:59.014714+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:59.010975+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:59.008177+00:00", "observable_id": "observable-1ac3d2569214ee0d3b919151" }, { "type": "ipv4", "value": "103.5.149.72", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:58.819359+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:58.815511+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:58.812095+00:00", "observable_id": "observable-96aaa7bbf0447255e4ecb7b9" }, { "type": "domain", "value": "www.googletagmanager.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:46:38.593969+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:58.809039+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:58.805929+00:00", "observable_id": "observable-cd5a6ab6cd79e9a50658623b" }, { "type": "domain", "value": "vk.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:58.630659+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:58.624906+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:58.619384+00:00", "observable_id": "observable-ab2217bf6e2a522a1543de3d" }, { "type": "domain", "value": "tass.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:58.438980+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:58.435173+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:58.429864+00:00", "observable_id": "observable-d458120e432992d199b50450" }, { "type": "domain", "value": "staticxx.facebook.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:46:55.130563+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:58.424653+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:58.420275+00:00", "observable_id": "observable-52c9f4f1fd3cceb704a7fb8c" }, { "type": "domain", "value": "r53x.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:58.246401+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:58.244167+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:58.241918+00:00", "observable_id": "observable-4ffac87c81591710ab6d3e1c" }, { "type": "domain", "value": "connect.facebook.net", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:45:14.006547+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:58.239371+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:58.235982+00:00", "observable_id": "observable-7bba686247a58a37aa55c593" }, { "type": "sha256", "value": "fb03a6b96e7aa8dc5c4e079289c84f446a7374d65f7bb79a734c34c9fb8e7703", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:57.529282+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:57.336025+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:57.334072+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:57.331870+00:00", "observable_id": "observable-01688be6d59bc3dec4f7faf1" }, { "type": "sha256", "value": "c0d599b80025a70004d813d62b587af4f8ae8abd64f514f280b6e4899436623f", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:56.972335+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:56.779811+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:56.774680+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:56.770025+00:00", "observable_id": "observable-51124e568e4eea087652aafc" }, { "type": "sha256", "value": "beff9a913c0887163fd4a17d037f2188ed9e93f6c57f770448c2f7046ca7d141", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:56.412307+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:56.215443+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:56.210887+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:56.205775+00:00", "observable_id": "observable-a1e63b6f998929d2c2bbdfb8" }, { "type": "sha256", "value": "bc1fc69f9747dc034ece7d9bb795c5e596d9be6ca71efe75c6c0fd18f3cbfbf5", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:55.867820+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:55.659352+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:55.653017+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:55.647069+00:00", "observable_id": "observable-bf135081606734b07b12c7f8" }, { "type": "sha256", "value": "8ed22d97053651c1bf38b50de0630657e03c9dc1b82f2c80241d72dd68c34fc8", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:55.304777+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:55.118127+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:55.116313+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:55.114041+00:00", "observable_id": "observable-f391393ca52867bcf147fef4" }, { "type": "sha256", "value": "87da7fce38fb944279568a460f952df3009b4398083bbe5dedb489fde5f46814", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:54.766174+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:54.584832+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:54.582794+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:54.580522+00:00", "observable_id": "observable-7f59b34c1404b2804edcb2f2" }, { "type": "sha256", "value": "225bd232b88e6072f4601058ebf7a0db0fa5cb3bf7537350c7de0bf5f2f5c54a", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:54.135663+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:53.924814+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:53.916622+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:53.910393+00:00", "observable_id": "observable-469955a2e09f0ab1c8be025d" }, { "type": "sha256", "value": "1d762c3dcf8ec1d7cf68b813aed274886103a60b67c11ff9f166398e96fdedaf", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:53.425006+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:53.225287+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:53.221151+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:53.216084+00:00", "observable_id": "observable-1c8cbc8a2feb26e33dbc1e23" }, { "type": "sha256", "value": "b908d9b1001d0a39ba92501c086b1c25b05b171eeda035ae9f3e129d2776a314", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:52.845478+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:52.657913+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:52.656090+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:52.654281+00:00", "observable_id": "observable-adb255911d18e7d3b23f4927" }, { "type": "ipv4", "value": "185.68.93.18", "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:52.654243+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:52.460656+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:52.458085+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:52.454803+00:00", "observable_id": "observable-e17f8b987c9ba869003a6d26" } ], "coverage": { "cache_hits": 0, "active_scans": 0, "batch_results": [ { "status": "deferred-rate-limit", "provider": "virustotal", "observable_id": "observable-46e299f63770703c45b1fe13" }, { "status": "not_found", "provider": "threatfox", "observable_id": "observable-46e299f63770703c45b1fe13" } ], "batch_targets": 1, "payload_uploads": 0, "targets_omitted": 0, "retained_targets": 81, "full_urls_disclosed": 0, "provider_lookups_started": 1 }, "updated_at": "2026-09-22T17:49:09.577235+00:00", "schema_version": "pcap-reputation-v1", "snapshot_sha256": "ba08d4b3c86201e6a731df20d81845d1308d8403dfb9c755caafd7b4f17bb89f", "source_semantic_sha256": "eff186db84f39bad8d8e2238b877933bb8a81647330004f85a47dde7eb9b8ce5", "previous_snapshot_sha256": "9b19cd40d73a2b170994996e32d415a24ca9eb20f6110cc175fa7d218c37089c" }, "artifact_download_available": true, "source_tlp": "TLP:CLEAR", "techniques": [ { "attack_id": "T1071.001", "name": "Application Layer Protocol: Web Protocols", "tactic": "command-and-control", "confidence": 0.85, "evidence": "T1071.001 Application Layer Protocol: Web Protocols", "review_status": "suggested", "evidence_start": 33070, "evidence_end": 33121, "evidence_source": "source-text", "llm_verified": true, "review_note": null, "reviewer": null, "reviewed_at": null }, { "attack_id": "T1105", "name": "Ingress Tool Transfer", "tactic": "command-and-control", "confidence": 0.8, "evidence": "T1105 Ingress Tool Transfer", "review_status": "suggested", "evidence_start": 33218, "evidence_end": 33245, "evidence_source": "source-text", "llm_verified": true, "review_note": null, "reviewer": null, "reviewed_at": null } ], "apt_matches": [ { "group_attack_id": "G0071", "group_name": "Orangeworm", "similarity": 0.3333, "shared_count": 1, "shared_techniques": [ "T1071.001" ] }, { "group_attack_id": "G1013", "group_name": "Metador", "similarity": 0.2222, "shared_count": 2, "shared_techniques": [ "T1071.001", "T1105" ] }, { "group_attack_id": "G0075", "group_name": "Rancor", "similarity": 0.2222, "shared_count": 2, "shared_techniques": [ "T1071.001", "T1105" ] }, { "group_attack_id": "G0083", "group_name": "SilverTerrier", "similarity": 0.2, "shared_count": 1, "shared_techniques": [ "T1071.001" ] }, { "group_attack_id": "G1042", "group_name": "RedEcho", "similarity": 0.1667, "shared_count": 1, "shared_techniques": [ "T1071.001" ] }, { "group_attack_id": "G0026", "group_name": "APT18", "similarity": 0.1667, "shared_count": 2, "shared_techniques": [ "T1071.001", "T1105" ] }, { "group_attack_id": "G0123", "group_name": "Volatile Cedar", "similarity": 0.1667, "shared_count": 1, "shared_techniques": [ "T1105" ] }, { "group_attack_id": "G0127", "group_name": "TA551", "similarity": 0.1429, "shared_count": 2, "shared_techniques": [ "T1071.001", "T1105" ] }, { "group_attack_id": "G0044", "group_name": "Winnti Group", "similarity": 0.1429, "shared_count": 1, "shared_techniques": [ "T1105" ] }, { "group_attack_id": "G0130", "group_name": "Ajax Security Team", "similarity": 0.1429, "shared_count": 1, "shared_techniques": [ "T1105" ] } ], "public_note": "Public derivative: full packet extraction retained; provider evidence bounded; other-session details omitted. Original snapshot hashes do not hash this serialized derivative." }